#!/bin/bash
### BEGIN INIT INFO
# Provides: firewall
# Required-Start: $network $syslog
# Required-Stop: $network $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Start/Stop firewall
# Description: This script manages the firewall rules using iptables.
### END INIT INFO
iptables=$(which iptables)
iptablesv6=$(which ip6tables)
#User Definition mit Zugriffen auf spezielle Services
#user="user.dyndns.org,deinedyn.homedns.com"
#(Ist vor Block APNIC eingebaut!)
#sharepartner="bla.dyndns.org"
# wenn iptables nicht installiert, Fehlermeldung ausgeben und abbrechen
if [ -z "$iptables" ]; then
echo "[Error] iptables is not installed or not in the PATH." >&2
exit 1
fi
# wenn iptablesv6 nicht installiert, Fehlermeldung ausgeben und abbrechen
if [ -z "$iptablesv6" ]; then
echo "[Error] iptablesv6 is not installed or not in the PATH." >&2
exit 1
fi
case "$1" in
start)
echo "[+] Waiting 5 seconds..."
sleep 5
echo "[+] Starting firewall..."
# alle Regeln löschen
$iptables -t nat -F
$iptables -t filter -F
$iptables -X
#$iptablesv6 -t nat -F
$iptablesv6 -t filter -F
$iptablesv6 -X
$iptables -P INPUT DROP
$iptables -P FORWARD DROP
$iptablesv6 -P FORWARD DROP
$iptables -A INPUT -i lo -j ACCEPT
$iptables -A OUTPUT -o lo -j ACCEPT
$iptablesv6 -A INPUT -i lo -j ACCEPT
$iptablesv6 -A OUTPUT -o lo -j ACCEPT
$iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptablesv6 -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#$iptablesv6 -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -P OUTPUT ACCEPT
$iptablesv6 -P OUTPUT ACCEPT
# OpenVPN (IP Adresse ggf. anpassen und zum aktivieren des Zugriffs # entfernen!)
#$iptables -A INPUT -p icmp --icmp-type 8 -s 0/0 -d 10.20.30.40 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#$iptables -A OUTPUT -p icmp --icmp-type 0 -s 10.20.30.40 -d 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# SSH
$iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport 22222 -j ACCEPT
#Xtream-Codes (Port ggf. anpassen und zum aktivieren des Zugriffs # entfernen!)
#$iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport PORT -j ACCEPT
#OScam Webif (Port ggf. anpassen und zum aktivieren des Zugriffs # entfernen!)
#$iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport PORT -j ACCEPT
#CCcam Share (Port ggf. anpassen und zum aktivieren des Zugriffs # entfernen!)
#$iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport PORT -j ACCEPT
#Cs378x Share (Port ggf. anpassen und zum aktivieren des Zugriffs # entfernen!)
#$iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport PORT -j ACCEPT
#DROPS (unerwünschte IPs, von denen JEGLICHE Anfragen verworfen werden):
#$iptables -I INPUT --source <IP> -j DROP
#$iptables -I INPUT --source <IP> -j DROP
#Sharepartner Beispiel CE Port 1337
#$iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED --source $sharepartner -p tcp --dport 1337-j ACCEPT
#Jeder Sharepartner kann somit auf Port 1337 connecten.
#Willst du das es einer nicht mehr tut, dann einfach oben in der Variable den betroffenen Sharepartner entfernen!
#Block APNIC LACNIC
#Hinweis: Blockiert Asien, Südamerika, Mittelamerika, beschränkt Russland bzw. Osteuropa!
APNIC=(
"1.0.0.0/8"
"14.0.0.0/8"
"27.0.0.0/8"
"36.0.0.0/8"
"39.0.0.0/8"
"42.0.0.0/8"
"43.0.0.0/8"
"49.0.0.0/8"
"58.0.0.0/8"
"59.0.0.0/8"
"60.0.0.0/8"
"61.0.0.0/8"
"101.0.0.0/8"
"103.0.0.0/8"
"106.0.0.0/8"
"110.0.0.0/8"
"111.0.0.0/8"
"112.0.0.0/8"
"113.0.0.0/8"
"114.0.0.0/8"
"115.0.0.0/8"
"116.0.0.0/8"
"117.0.0.0/8"
"118.0.0.0/8"
"119.0.0.0/8"
"120.0.0.0/8"
"121.0.0.0/8"
"122.0.0.0/8"
"123.0.0.0/8"
"124.0.0.0/8"
"125.0.0.0/8"
"126.0.0.0/8"
"133.0.0.0/8"
"150.0.0.0/8"
"153.0.0.0/8"
"163.0.0.0/8"
"171.0.0.0/8"
"175.0.0.0/8"
"177.0.0.0/8"
"179.0.0.0/8"
"180.0.0.0/8"
"181.0.0.0/8"
"182.0.0.0/8"
"183.0.0.0/8"
"186.0.0.0/8"
"187.0.0.0/8"
"189.0.0.0/8"
"190.0.0.0/8"
"200.0.0.0/8"
"201.0.0.0/8"
"202.0.0.0/8"
"203.0.0.0/8"
"210.0.0.0/8"
"211.0.0.0/8"
"218.0.0.0/8"
"219.0.0.0/8"
"220.0.0.0/8"
"221.0.0.0/8"
"222.0.0.0/8"
"223.0.0.0/8"
)
for blockapnic in "${APNIC[@]}"
do
$iptables -A INPUT --source $blockapnic -j DROP
done
$iptables -N LOGGING
$iptables -A INPUT -j LOGGING
$iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7
$iptables -A LOGGING -j DROP
$iptables -A LOGGING -j REJECT
#PING Sperre
$iptables -A INPUT -i eth0 -j REJECT
# SICHERHEIT
$iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j DROP
$iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
$iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
$iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s
echo "[OK] Firewall has been activated, the server is protected."
;;
stop)
echo "[+] Stopping firewall..."
$iptables -t nat -F
$iptables -t filter -F
$iptables -X
$iptables -P INPUT ACCEPT
$iptables -P OUTPUT ACCEPT
$iptables -P FORWARD ACCEPT
$iptablesv6 -t nat -F
$iptablesv6 -t filter -F
$iptablesv6 -X
$iptablesv6 -P INPUT ACCEPT
$iptablesv6 -P OUTPUT ACCEPT
$iptablesv6 -P FORWARD ACCEPT
echo "[!] Firewall has been stopped, the server is unprotected."
;;
restart|reload|force-reload)
$0 stop
$0 start
;;
*)
echo "[Error] Invalid argument."
echo "Usage: $0 (start|stop|restart)"
exit 1
#;;
esac
exit 0