Iptables Firewall Script.
#!/bin/sh
# Iptables Firewall --> Joel
IPT=` which iptables`
INSMOD=` which modprobe`
AWK=` which awk`
SED=` which sed`
GREP=`which grep`
LSMOD=`which lsmod`
## FLUSHING THE CURRENT RULES
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD DROP
$IPT -F
$IPT -t filter -F INPUT
$IPT -t filter -F OUTPUT
$IPT -t filter -F FORWARD
$IPT -t nat -F OUTPUT
$IPT -t nat -F POSTROUTING
$IPT -t mangle -F PREROUTING
$IPT -t mangle -F OUTPUT
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD DROP
echo "Stopping Firewall... [ OK ]"
sleep 1
## PROC CONFIGURATION
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
# enable ip forwading
echo 1 > /proc/sys/net/ipv4/ip_forward
# enable sync cookies protection
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
# turn on sourse addr vref. i.e spoof protection
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $f
done
# disable ICMP redirect
for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
echo 0 > $f
done
# disable source routed packets
for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
echo 0 > $f
done
# ignore broadcast
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 0 > /proc/sys/net/ipv4/tcp_ecn
echo "2048 60416 " > /proc/sys/net/ipv4/ip_local_port_range
##### ip_conntrack_ftp
if [ -z "` $LSMOD | $GREP ip_conntrack_ftp | $AWK {'print $1'} `" ]; then
$INSMOD ip_conntrack_ftp
fi
##### ip_nat_ftp
if [ -z "` $LSMOD | $GREP ip_nat_ftp | $AWK {'print $1'} `" ]; then
$INSMOD ip_nat_ftp
fi
## MANGLE TABLE
$IPT -t mangle -A OUTPUT -p 6 --dport 80 -j TOS --set-tos Maximize-Throughput
$IPT -t mangle -A OUTPUT -p 6 --dport 23 -j TOS --set-tos Minimize-Delay
$IPT -t mangle -A OUTPUT -p 6 --dport 22 -j TOS --set-tos Minimize-Delay
$IPT -t mangle -A OUTPUT -p 6 --dport 20 -j TOS --set-tos Minimize-Cost
$IPT -t mangle -A OUTPUT -p 6 --dport 21 -j TOS --set-tos Minimize-Delay
$IPT -t mangle -A OUTPUT -p 6 --dport 25 -j TOS --set-tos Minimize-Delay
$IPT -t mangle -A OUTPUT -p 6 --dport 110 -j TOS --set-tos Minimize-Delay
$IPT -t mangle -A OUTPUT -p 6 --dport 143 -j TOS --set-tos Minimize-Delay
## LOOPBACK ACCEPTS ALL TRAFFIC
$IPT -A INPUT -i lo -j ACCEPT
## TCP INCOMING RULES
$IPT -I INPUT -p 6 -s 0/0 -m multiport --dport 21,22,25,80,113,3128,143,110,443,1863 -j ACCEPT
$IPT -I INPUT -p ICMP -s 0.0.0.0/0 --icmp-type 8 -j ACCEPT
$IPT -I INPUT -p ICMP -s 0.0.0.0/0 --icmp-type 11 -j ACCEPT
$IPT -A INPUT -s 255.255.255.255 -j DROP
$IPT -A INPUT -s 224.0.0.0/4 -j DROP
$IPT -A INPUT -s 240.0.0.0/5 -j DROP
## TCP OUTGOING RULES TO INTERNET
$IPT -I INPUT -p 6 -d 0.0.0.0/0 -m multiport --sport 21,22,25,80,113,3128,143,110,443,1863 -j ACCEPT
$IPT -I INPUT -p ICMP -d 0.0.0.0/0 -j ACCEPT
## UDP INCOMING RULES
$IPT -I INPUT -p UDP -s 0.0.0.0/0 --dport 53 -j ACCEPT
## UDP OUTGOING RULES
$IPT -I INPUT -p UDP -d 0.0.0.0/0 --sport 53 -j ACCEPT
echo "Starting Firewall... [ OK ]"
## Squid transparent proxy
# $IPT -t nat -A PREROUTING -i eth4 -p tcp --dport 80 -j REDIRECT --to-port 3128 -d ! 202.160.161.0/26