UTIN Firewall script UTIN Firewall script project is a script for Linux 2.4.x and iptables.
Download

UTIN Firewall script Ranking & Summary

UTIN Firewall script Tags

IP firewall firewall script iptables firewall ip firewall UTIN

UTIN Firewall script Description

UTIN Firewall script project is a script for Linux 2.4.x and iptables. UTIN Firewall script project is a script for Linux 2.4.x and iptables.############ Configuration options, these will speed you up getting this script to# work with your own setup.## your LAN's IP range and localhost IP. /24 means to only use the first 24 # bits of the 32 bit IP adress. the same as netmask 255.255.255.0## INET_IP is used by me to allow myself to do anything to myself, might# be a security risc but sometimes I want this. If you don't have a static# IP, I suggest not using this option at all for now but it's still# enabled per default and will add some really nifty security bugs for all# those who skips reading the documentation=)LAN_IP="192.168.0.2"LAN_BCAST_ADRESS="192.168.0.255"LAN_IFACE="eth1"LO_IFACE="lo"LO_IP="127.0.0.1"INET_IP="194.236.50.155"INET_IFACE="eth0"IPTABLES="/usr/local/sbin/iptables"########## Load all required IPTables modules### Needed to initially load modules#/sbin/depmod -a## Adds some iptables targets like LOG, REJECT and MASQUARADE.#/sbin/modprobe ipt_LOG#/sbin/modprobe ipt_REJECT/sbin/modprobe ipt_MASQUERADE## Support for owner matching##/sbin/modprobe ipt_owner## Support for connection tracking of FTP and IRC.##/sbin/modprobe ip_conntrack_ftp#/sbin/modprobe ip_conntrack_irc## Enable ip_forward, this is critical since it is turned off as defaul in# Linux.#echo "1" > /proc/sys/net/ipv4/ip_forward## Dynamic IP users:##echo "1" > /proc/sys/net/ipv4/ip_dynaddr## Enable simple IP Forwarding and Network Address Translation#$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP## Set default policies for the INPUT, FORWARD and OUTPUT chains#$IPTABLES -P INPUT DROP$IPTABLES -P OUTPUT DROP$IPTABLES -P FORWARD DROP## bad_tcp_packets chain## Take care of bad TCP packets that we don't want.#$IPTABLES -N bad_tcp_packets$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP## Do some checks for obviously spoofed IP's#$IPTABLES -A bad_tcp_packets -i $INET_IFACE -s 192.168.0.0/16 -j DROP$IPTABLES -A bad_tcp_packets -i $INET_IFACE -s 10.0.0.0/8 -j DROP$IPTABLES -A bad_tcp_packets -i $INET_IFACE -s 172.16.0.0/12 -j DROP$IPTABLES -A bad_tcp_packets -i $LAN_IFACE ! -s 192.168.0.0/16 -j DROP## Bad TCP packets we don't want#$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets## Accept the packets we actually want to forward between interfaces.#$IPTABLES -A FORWARD -p tcp --dport 21 -i $LAN_IFACE -j ACCEPT$IPTABLES -A FORWARD -p tcp --dport 80 -i $LAN_IFACE -j ACCEPT$IPTABLES -A FORWARD -p tcp --dport 110 -i $LAN_IFACE -j ACCEPT$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "## Create separate chains for ICMP, TCP and UDP to traverse#$IPTABLES -N icmp_packets$IPTABLES -N tcp_packets$IPTABLES -N udpincoming_packets## The allowed chain for TCP connections#$IPTABLES -N allowed$IPTABLES -A allowed -p TCP --syn -j ACCEPT$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT$IPTABLES -A allowed -p TCP -j DROP## ICMP rules## Changed rules totally$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT## TCP rules#$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 113 -j allowed## UDP ports#$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 123 -j ACCEPT$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 2074 -j ACCEPT$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 4000 -j ACCEPT## INPUT chain## Bad TCP packets we don't want#$IPTABLES -A INPUT -p tcp -j bad_tcp_packets## Rules for incoming packets from anywhere #$IPTABLES -A INPUT -p ICMP -j icmp_packets$IPTABLES -A INPUT -p TCP -j tcp_packets$IPTABLES -A INPUT -p UDP -j udpincoming_packets## Rules for special networks not part of the Internet#$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED -j ACCEPT$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "## OUTPUT chain### Bad TCP packets we don't want#$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "

UTIN Firewall script Related Software