NoPaste

iptables Einstellungen 12.02.2015

von chho

SNIPPET_TEXT:
  1. #!/bin/sh
  2. #
  3. # rc.firewall-iptables-stronger
  4. #
  5. FWVER=0.88s
  6. echo "\nLoading rc.firewall-iptables-STRONGER - version $FWVER..\n"
  7.  
  8. # The location of various iptables and other shell programs
  9. IPTABLES=/sbin/iptables
  10. LSMOD=/sbin/lsmod
  11. DEPMOD=/sbin/depmod
  12. MODPROBE=/sbin/modprobe
  13. GREP=/bin/grep
  14. AWK=/usr/bin/awk
  15. IFCONFIG=/sbin/ifconfig
  16.  
  17.  
  18. #Setting the EXTERNAL and INTERNAL interfaces for the network
  19. EXTIF1="eth0"
  20. EXTIF2="tun0"
  21. INTIF1="eth1"
  22. INTIF2="eth2"
  23. INTIF3="wlan0"
  24. echo "  External Interface 1:  $EXTIF1"
  25. echo "  External Interface 2:  $EXTIF2"
  26. echo "  Internal Interface 1:  $INTIF1"
  27. echo "  Internal Interface 2:  $INTIF2"
  28. echo "  Internal Interface 3:  $INTIF3"
  29. echo "  ---"
  30.  
  31. # external IP address
  32. EXTIP1="`$IFCONFIG $EXTIF1 | $AWK /$EXTIF1/'{next}//{split($0,a,":");split(a[2],a," ");print a[1];exit}'`"
  33. EXTIP2="`$IFCONFIG $EXTIF2 | $AWK /$EXTIF2/'{next}//{split($0,a,":");split(a[2],a," ");print a[1];exit}'`"
  34. echo "  External IP1: $EXTIP1"
  35. echo "  External IP2: $EXTIP2"
  36. echo "  ---"
  37.  
  38. # Assign the internal TCP/IP network and IP address
  39. INTNET1="192.168.1.0/24"
  40. INTIP1="192.168.1.1/32"
  41. INTNET2="192.168.2.0/24"
  42. INTIP2="192.168.2.1/32"
  43. INTNET3="192.168.3.0/24"
  44. INTIP3="192.168.3.1/32"
  45. echo "  Internal Network 1: $INTNET1"
  46. echo "  Internal IP 1:      $INTIP1"
  47. echo "  Internal Network 2: $INTNET2"
  48. echo "  Internal IP 2:      $INTIP2"
  49. echo "  Internal Network 3: $INTNET3"
  50. echo "  Internal IP 3:      $INTIP3"
  51. echo "  ---"
  52.  
  53. # Setting a few other local variables
  54. UNIVERSE="0.0.0.0/0"
  55.  
  56. echo "  Enabling forwarding.."
  57. echo "1" > /proc/sys/net/ipv4/ip_forward
  58.  
  59. echo "  Enabling DynamicAddr.."
  60. echo "1" > /proc/sys/net/ipv4/ip_dynaddr
  61. echo "  ---"
  62.  
  63. #Clearing any previous configuration
  64. #Unless specified, the defaults for INPUT, OUTPUT, and FORWARD to DROP
  65.  
  66. echo "  Clearing any existing rules and setting default policy to DROP.."
  67. $IPTABLES -P INPUT DROP
  68. $IPTABLES -F INPUT
  69. $IPTABLES -P OUTPUT DROP
  70. $IPTABLES -F OUTPUT
  71. $IPTABLES -P FORWARD DROP
  72. $IPTABLES -F FORWARD
  73. $IPTABLES -F -t nat
  74.  
  75. #Not needed and it will only load the unneeded kernel module
  76. #$IPTABLES -F -t mangle
  77.  
  78. # Delete all User-specified chains
  79. $IPTABLES -X
  80.  
  81. # Reset all IPTABLES counters
  82. $IPTABLES -Z
  83.  
  84. #Configuring specific CHAINS for later use in the ruleset
  85. #  NOTE:  Some users prefer to have their firewall silently
  86. #         "DROP" packets while others prefer to use "REJECT"
  87. #         to send ICMP error messages back to the remote
  88. #         machine.  The default is "REJECT" but feel free to
  89. #         change this below.
  90. #
  91.  
  92. echo "  Creating a DROP chain.."
  93. $IPTABLES -N reject-and-log-it
  94. $IPTABLES -A reject-and-log-it -j LOG --log-level info
  95. $IPTABLES -A reject-and-log-it -j REJECT
  96. echo "\n   - Loading INPUT rulesets"
  97.  
  98. #######################################################################
  99. # INPUT: Incoming traffic from various interfaces.  All rulesets are already flushed and set to a default policy of DROP.
  100.  
  101. # loopback interfaces are valid.
  102. $IPTABLES -A INPUT -i lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT
  103.  
  104. # local interface, local machines, going anywhere is valid
  105. $IPTABLES -A INPUT -i $INTIF1 -s $INTNET1 -d $UNIVERSE -j ACCEPT
  106. $IPTABLES -A INPUT -i $INTIF2 -s $INTNET2 -d $UNIVERSE -j ACCEPT
  107. $IPTABLES -A INPUT -i $INTIF3 -s $INTNET3 -d $UNIVERSE -j ACCEPT
  108.  
  109. # remote interface, claiming to be local machines, IP spoofing, get lost
  110. $IPTABLES -A INPUT -i $EXTIF1 -s $INTNET1 -d $UNIVERSE -j reject-and-log-it
  111. $IPTABLES -A INPUT -i $EXTIF1 -s $INTNET2 -d $UNIVERSE -j reject-and-log-it
  112. $IPTABLES -A INPUT -i $EXTIF1 -s $INTNET3 -d $UNIVERSE -j reject-and-log-it
  113. $IPTABLES -A INPUT -i $EXTIF2 -s $INTNET1 -d $UNIVERSE -j reject-and-log-it
  114. $IPTABLES -A INPUT -i $EXTIF2 -s $INTNET2 -d $UNIVERSE -j reject-and-log-it
  115. $IPTABLES -A INPUT -i $EXTIF2 -s $INTNET3 -d $UNIVERSE -j reject-and-log-it
  116.  
  117. # external interface, from any source, for ICMP traffic is valid
  118. #
  119. #  If you would like your machine to "ping" from the Internet, enable this next line
  120. #$IPTABLES -A INPUT -i $EXTIF -p ICMP -s $UNIVERSE -d $EXTIP -j ACCEPT
  121.  
  122. # remote interface, any source, going to the MASQ servers IP address is valid
  123. #
  124. #  ENABLE this line if you want ALL Internet traffic to connect to your
  125. #  the various servers running on the MASQ server.  This includes
  126. #  web servers, ssh servers, dns servers, etc.  
  127. #
  128. #  I DON'T recommend you enable this rule.  Instead, only enable specific access to select server ports under the "OPTIONAL INPUT Section".
  129. #  An example of enabling HTTP (WWW) has been given below:
  130. #$IPTABLES -A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -j ACCEPT
  131.  
  132. # Allow any related traffic coming back to the MASQ server in.
  133. #
  134. #  STATEFULLY TRACKED
  135. #
  136. $IPTABLES -A INPUT -i $EXTIF1 -m state --state ESTABLISHED,RELATED -j ACCEPT
  137. $IPTABLES -A INPUT -i $EXTIF2 -m state --state ESTABLISHED,RELATED -j ACCEPT
  138.  
  139. # ----- Begin OPTIONAL INPUT Section -----
  140.  
  141. # DHCPd - Enable the following lines if you run an INTERNAL DHCPd server
  142. $IPTABLES -A INPUT -i $INTIF1 -p tcp --sport 67:68 --dport 67:68 -j ACCEPT
  143. $IPTABLES -A INPUT -i $INTIF1 -p udp --sport 67:68 --dport 67:68 -j ACCEPT
  144. $IPTABLES -A INPUT -i $INTIF2 -p tcp --sport 67:68 --dport 67:68 -j ACCEPT
  145. $IPTABLES -A INPUT -i $INTIF2 -p udp --sport 67:68 --dport 67:68 -j ACCEPT
  146. $IPTABLES -A INPUT -i $INTIF3 -p tcp --sport 67:68 --dport 67:68 -j ACCEPT
  147. $IPTABLES -A INPUT -i $INTIF3 -p udp --sport 67:68 --dport 67:68 -j ACCEPT
  148.  
  149. # DHCP - listen on eth0
  150. $IPTABLES -A INPUT -i $EXTIF1 -p tcp --sport 67:68 --dport 67:68 -j ACCEPT
  151. $IPTABLES -A INPUT -i $EXTIF1 -p UDP --sport 67:68 --dport 67:68 -j ACCEPT
  152.  
  153.  
  154. # HTTPd - Enable the following lines if you run an EXTERNAL WWW server
  155. #
  156. #    NOTE:  This is NOT needed for simply enabling PORTFW.  This is ONLY for users that plan on running Apache on the MASQ server itself
  157. #
  158. #echo "      - Allowing EXTERNAL access to the WWW server"
  159. #$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 80 -j ACCEPT
  160.  
  161. #
  162. # ----- End OPTIONAL INPUT Section -----
  163.  
  164.  
  165. # Catch all rule, all other incoming is denied and logged.
  166. #
  167. $IPTABLES -A INPUT -s $UNIVERSE -d $UNIVERSE -j reject-and-log-it
  168.  
  169. # ---------------------------------------------------------------------
  170.  
  171. echo "   - Loading OUTPUT rulesets"
  172.  
  173. ##########################################################################################################################
  174. # OUTPUT: Outgoing traffic from various interfaces.  All rulesets are already flushed and set to a default policy of DROP.
  175. ##########################################################################################################################
  176.  
  177. # Workaround bug in netfilter
  178. # See http://www.netfilter.org/security/2002-04-02-icmp-dnat.html
  179. $IPTABLES -A OUTPUT -m state -p icmp --state INVALID -j DROP
  180.  
  181. # loopback interface is valid.
  182. $IPTABLES -A OUTPUT -o lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT
  183.  
  184. # local interfaces, any source going to local net is valid
  185. $IPTABLES -A OUTPUT -o $INTIF1 -s $EXTIP1 -d $INTNET1 -j ACCEPT
  186. $IPTABLES -A OUTPUT -o $INTIF2 -s $EXTIP1 -d $INTNET2 -j ACCEPT
  187. $IPTABLES -A OUTPUT -o $INTIF3 -s $EXTIP1 -d $INTNET3 -j ACCEPT
  188. $IPTABLES -A OUTPUT -o $INTIF1 -s $EXTIP2 -d $INTNET1 -j ACCEPT
  189. $IPTABLES -A OUTPUT -o $INTIF2 -s $EXTIP2 -d $INTNET2 -j ACCEPT
  190. $IPTABLES -A OUTPUT -o $INTIF3 -s $EXTIP2 -d $INTNET3 -j ACCEPT
  191.  
  192. # local interface, MASQ server source going to the local net is valid
  193. $IPTABLES -A OUTPUT -o $INTIF1 -s $INTIP1 -d $INTNET1 -j ACCEPT
  194. $IPTABLES -A OUTPUT -o $INTIF2 -s $INTIP2 -d $INTNET2 -j ACCEPT
  195. $IPTABLES -A OUTPUT -o $INTIF3 -s $INTIP3 -d $INTNET3 -j ACCEPT
  196.  
  197. # outgoing to local net on remote interface, stuffed routing, deny
  198. $IPTABLES -A OUTPUT -o $EXTIF1 -s $UNIVERSE -d $INTNET1 -j reject-and-log-it
  199. $IPTABLES -A OUTPUT -o $EXTIF1 -s $UNIVERSE -d $INTNET2 -j reject-and-log-it
  200. $IPTABLES -A OUTPUT -o $EXTIF1 -s $UNIVERSE -d $INTNET3 -j reject-and-log-it
  201. $IPTABLES -A OUTPUT -o $EXTIF2 -s $UNIVERSE -d $INTNET1 -j reject-and-log-it
  202. $IPTABLES -A OUTPUT -o $EXTIF2 -s $UNIVERSE -d $INTNET2 -j reject-and-log-it
  203. $IPTABLES -A OUTPUT -o $EXTIF2 -s $UNIVERSE -d $INTNET3 -j reject-and-log-it
  204.  
  205. # anything else outgoing on remote interface is valid
  206. $IPTABLES -A OUTPUT -o $EXTIF1 -s $EXTIP1 -d $UNIVERSE -j ACCEPT
  207. $IPTABLES -A OUTPUT -o $EXTIF2 -s $EXTIP2 -d $UNIVERSE -j ACCEPT
  208.  
  209. # ----- Begin OPTIONAL OUTPUT Section -----
  210. #
  211. # DHCPd - Enable the following lines if you run an INTERNAL DHCPd server
  212. #
  213. $IPTABLES -A OUTPUT -o $INTIF1 -p tcp -s $INTIP1 --sport 67:68 -d 255.255.255.255 --dport 67:68 -j ACCEPT
  214. $IPTABLES -A OUTPUT -o $INTIF1 -p udp -s $INTIP1 --sport 67:68 -d 255.255.255.255 --dport 67:68 -j ACCEPT
  215. $IPTABLES -A OUTPUT -o $INTIF2 -p tcp -s $INTIP2 --sport 67:68 -d 255.255.255.255 --dport 67:68 -j ACCEPT
  216. $IPTABLES -A OUTPUT -o $INTIF2 -p udp -s $INTIP2 --sport 67:68 -d 255.255.255.255 --dport 67:68 -j ACCEPT
  217. $IPTABLES -A OUTPUT -o $INTIF3 -p tcp -s $INTIP3 --sport 67:68 -d 255.255.255.255 --dport 67:68 -j ACCEPT
  218. $IPTABLES -A OUTPUT -o $INTIF3 -p udp -s $INTIP3 --sport 67:68 -d 255.255.255.255 --dport 67:68 -j ACCEPT
  219.  
  220. # ----- End OPTIONAL OUTPUT Section -----
  221.  
  222. # Catch all rule, all other outgoing is denied and logged.
  223. $IPTABLES -A OUTPUT -s $UNIVERSE -d $UNIVERSE -j reject-and-log-it
  224.  
  225. echo "   - Loading FORWARD rulesets"
  226.  
  227. #######################################################################
  228. # FORWARD: Enable Forwarding and thus IPMASQ
  229. #######################################################################
  230.  
  231. # ----- Begin OPTIONAL FORWARD Section -----
  232. #
  233. #  Put PORTFW commands here
  234. #
  235. # ----- End OPTIONAL FORWARD Section -----
  236.  
  237. echo "     - FWD: Allow all internal interfaces to communicate between each other"
  238. $IPTABLES -A FORWARD -i $INTIF1 -o $INTIF2 -j ACCEPT
  239. $IPTABLES -A FORWARD -i $INTIF2 -o $INTIF1 -j ACCEPT
  240. $IPTABLES -A FORWARD -i $INTIF1 -o $INTIF3 -j ACCEPT
  241. $IPTABLES -A FORWARD -i $INTIF3 -o $INTIF1 -j ACCEPT
  242. $IPTABLES -A FORWARD -i $INTIF2 -o $INTIF3 -j ACCEPT
  243. $IPTABLES -A FORWARD -i $INTIF3 -o $INTIF2 -j ACCEPT
  244.  
  245. echo "     - FWD: Allow all connections OUT and only existing/related IN"
  246. $IPTABLES -A FORWARD -i $EXTIF1 -o $INTIF1 -m state --state ESTABLISHED,RELATED -j ACCEPT
  247. $IPTABLES -A FORWARD -i $INTIF1 -o $EXTIF1 -j ACCEPT
  248.  
  249. $IPTABLES -A FORWARD -i $EXTIF1 -o $INTIF2 -m state --state ESTABLISHED,RELATED -j ACCEPT
  250. $IPTABLES -A FORWARD -i $INTIF2 -o $EXTIF1 -j ACCEPT
  251.  
  252. $IPTABLES -A FORWARD -i $EXTIF1 -o $INTIF3 -m state --state ESTABLISHED,RELATED -j ACCEPT
  253. $IPTABLES -A FORWARD -i $INTIF3 -o $EXTIF1 -j ACCEPT
  254.  
  255. $IPTABLES -A FORWARD -i $EXTIF2 -o $INTIF1 -m state --state ESTABLISHED,RELATED -j ACCEPT
  256. $IPTABLES -A FORWARD -i $INTIF1 -o $EXTIF2 -j ACCEPT
  257.  
  258. $IPTABLES -A FORWARD -i $EXTIF2 -o $INTIF2 -m state --state ESTABLISHED,RELATED -j ACCEPT
  259. $IPTABLES -A FORWARD -i $INTIF2 -o $EXTIF2 -j ACCEPT
  260.  
  261. $IPTABLES -A FORWARD -i $EXTIF2 -o $INTIF3 -m state --state ESTABLISHED,RELATED -j ACCEPT
  262. $IPTABLES -A FORWARD -i $INTIF3 -o $EXTIF2 -j ACCEPT
  263.  
  264. # Catch all rule, all other forwarding is denied and logged.
  265. $IPTABLES -A FORWARD -j reject-and-log-it
  266.  
  267. echo "     - NAT: Enabling SNAT (MASQUERADE) functionality on $EXTIF1 and $EXTIF2"
  268. $IPTABLES -t nat -A POSTROUTING -o $EXTIF1 -j MASQUERADE
  269. $IPTABLES -t nat -A POSTROUTING -o $EXTIF2 -j MASQUERADE
  270.  
  271.  
  272. #######################################################################
  273. echo "\nrc.firewall-iptables-stronger $FWVER done.\n"

Quellcode

Hier kannst du den Code kopieren und ihn in deinen bevorzugten Editor einfügen. PASTEBIN_DOWNLOAD_SNIPPET_EXPLAIN

Verlinken

URL: alles markieren
https://nopaste.debianforum.de/38302

BBCode: alles markieren
[NP]38302[/NP]

LATEST_SNIPPETS