English: #!/sbin/runscript IPTABLES=/sbin/iptables IPTABLESSAVE=/sbin/iptables-save IPTABLESRESTORE=/sbin/iptables-restore FIREWALL=/etc/firewall.rules DNS1=212.242.40.3 DNS2=212.242.40.51 #inside IIP=10.0.0.2 IINTERFACE=eth0 LOCAL_NETWORK=10.0.0.0/24 #outside OIP=217.157.156.144 OINTERFACE=eth1 opts="${opts} showstatus panic save restore showoptions rules" depend() { need net } rules() { stop ebegin "Setting internal rules" einfo "Setting default rule to drop" $IPTABLES -P FORWARD DROP $IPTABLES -P INPUT DROP $IPTABLES -P OUTPUT DROP #default rule einfo "Creating states chain" $IPTABLES -N allowed-connection $IPTABLES -F allowed-connection $IPTABLES -A allowed-connection -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A allowed-connection -i $IINTERFACE -m limit -j LOG --log-prefix \ "Bad packet from ${IINTERFACE}:" $IPTABLES -A allowed-connection -j DROP #ICMP traffic einfo "Creating icmp chain" $IPTABLES -N icmp_allowed $IPTABLES -F icmp_allowed $IPTABLES -A icmp_allowed -m state --state NEW -p icmp --icmp-type \ time-exceeded -j ACCEPT $IPTABLES -A icmp_allowed -m state --state NEW -p icmp --icmp-type \ destination-unreachable -j ACCEPT $IPTABLES -A icmp_allowed -p icmp -j LOG --log-prefix "Bad ICMP traffic:" $IPTABLES -A icmp_allowed -p icmp -j DROP #Incoming traffic einfo "Creating incoming ssh traffic chain" $IPTABLES -N allow-ssh-traffic-in $IPTABLES -F allow-ssh-traffic-in #Flood protection $IPTABLES -A allow-ssh-traffic-in -m limit --limit 1/second -p tcp --tcp-flags \ ALL RST --dport ssh -j ACCEPT $IPTABLES -A allow-ssh-traffic-in -m limit --limit 1/second -p tcp --tcp-flags \ ALL FIN --dport ssh -j ACCEPT $IPTABLES -A allow-ssh-traffic-in -m limit --limit 1/second -p tcp --tcp-flags \ ALL SYN --dport ssh -j ACCEPT $IPTABLES -A allow-ssh-traffic-in -m state --state RELATED,ESTABLISHED -p tcp --dport ssh -j ACCEPT #outgoing traffic einfo "Creating outgoing ssh traffic chain" $IPTABLES -N allow-ssh-traffic-out $IPTABLES -F allow-ssh-traffic-out $IPTABLES -A allow-ssh-traffic-out -p tcp --dport ssh -j ACCEPT einfo "Creating outgoing dns traffic chain" $IPTABLES -N allow-dns-traffic-out $IPTABLES -F allow-dns-traffic-out $IPTABLES -A allow-dns-traffic-out -p udp -d $DNS1 --dport domain \ -j ACCEPT $IPTABLES -A allow-dns-traffic-out -p udp -d $DNS2 --dport domain \ -j ACCEPT einfo "Creating outgoing http/https traffic chain" $IPTABLES -N allow-www-traffic-out $IPTABLES -F allow-www-traffic-out $IPTABLES -A allow-www-traffic-out -p tcp --dport www -j ACCEPT $IPTABLES -A allow-www-traffic-out -p tcp --dport https -j ACCEPT #Catch portscanners einfo "Creating portscan detection chain" $IPTABLES -N check-flags $IPTABLES -F check-flags $IPTABLES -A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -m limit \ --limit 5/minute -j LOG --log-level alert --log-prefix "NMAP-XMAS:" $IPTABLES -A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP $IPTABLES -A check-flags -p tcp --tcp-flags ALL ALL -m limit --limit \ 5/minute -j LOG --log-level 1 --log-prefix "XMAS:" $IPTABLES -A check-flags -p tcp --tcp-flags ALL ALL -j DROP $IPTABLES -A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG \ -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "XMAS-PSH:" $IPTABLES -A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP $IPTABLES -A check-flags -p tcp --tcp-flags ALL NONE -m limit \ --limit 5/minute -j LOG --log-level 1 --log-prefix "NULL_SCAN:" $IPTABLES -A check-flags -p tcp --tcp-flags ALL NONE -j DROP $IPTABLES -A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -m limit \ --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/RST:" $IPTABLES -A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -j DROP $IPTABLES -A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit \ --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/FIN:" $IPTABLES -A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP # Apply and add invalid states to the chains einfo "Applying chains to INPUT" $IPTABLES -A INPUT -m state --state INVALID -j DROP $IPTABLES -A INPUT -p icmp -j icmp_allowed $IPTABLES -A INPUT -j check-flags $IPTABLES -A INPUT -i lo -j ACCEPT $IPTABLES -A INPUT -j allow-ssh-traffic-in $IPTABLES -A INPUT -j allowed-connection einfo "Applying chains to FORWARD" $IPTABLES -A FORWARD -m state --state INVALID -j DROP $IPTABLES -A FORWARD -p icmp -j icmp_allowed $IPTABLES -A FORWARD -j check-flags $IPTABLES -A FORWARD -o lo -j ACCEPT $IPTABLES -A FORWARD -j allow-ssh-traffic-in $IPTABLES -A FORWARD -j allow-www-traffic-out $IPTABLES -A FORWARD -j allowed-connection einfo "Applying chains to OUTPUT" $IPTABLES -A OUTPUT -m state --state INVALID -j DROP $IPTABLES -A OUTPUT -p icmp -j icmp_allowed $IPTABLES -A OUTPUT -j check-flags $IPTABLES -A OUTPUT -o lo -j ACCEPT $IPTABLES -A OUTPUT -j allow-ssh-traffic-out $IPTABLES -A OUTPUT -j allow-dns-traffic-out $IPTABLES -A OUTPUT -j allow-www-traffic-out $IPTABLES -A OUTPUT -j allowed-connection #Allow client to route through via NAT (Network Address Translation) $IPTABLES -t nat -A POSTROUTING -o $OINTERFACE -j MASQUERADE eend $?
French: #!/sbin/runscript IPTABLES=/sbin/iptables IPTABLESSAVE=/sbin/iptables-save IPTABLESRESTORE=/sbin/iptables-restore FIREWALL=/etc/firewall.rules DNS1=212.242.40.3 DNS2=212.242.40.51 #interne IIP=10.0.0.2 IINTERFACE=eth0 LOCAL_NETWORK=10.0.0.0/24 #externe OIP=217.157.156.144 OINTERFACE=eth1 opts="${opts} showstatus panic save restore showoptions rules" depend() { need net } rules() { stop ebegin "Paramétrer les règles internes" einfo "On ignore tout par défaut" $IPTABLES -P FORWARD DROP $IPTABLES -P INPUT DROP $IPTABLES -P OUTPUT DROP # Règles par default einfo "Créer les chaînes d'état" $IPTABLES -N allowed-connection $IPTABLES -F allowed-connection $IPTABLES -A allowed-connection -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A allowed-connection -i $IINTERFACE -m limit -j LOG --log-prefix \ "Bad packet from ${IINTERFACE}:" $IPTABLES -A allowed-connection -j DROP # Trafic ICMP einfo "Créer la chaîne icmp" $IPTABLES -N icmp_allowed $IPTABLES -F icmp_allowed $IPTABLES -A icmp_allowed -m state --state NEW -p icmp --icmp-type \ time-exceeded -j ACCEPT $IPTABLES -A icmp_allowed -m state --state NEW -p icmp --icmp-type \ destination-unreachable -j ACCEPT $IPTABLES -A icmp_allowed -p icmp -j LOG --log-prefix "Bad ICMP traffic:" $IPTABLES -A icmp_allowed -p icmp -j DROP # Trafic entrant einfo "Créer la chaîne de trafic ssh entrant" $IPTABLES -N allow-ssh-traffic-in $IPTABLES -F allow-ssh-traffic-in # Protection anti Flood $IPTABLES -A allow-ssh-traffic-in -m limit --limit 1/second -p tcp --tcp-flags \ ALL RST --dport ssh -j ACCEPT $IPTABLES -A allow-ssh-traffic-in -m limit --limit 1/second -p tcp --tcp-flags \ ALL FIN --dport ssh -j ACCEPT $IPTABLES -A allow-ssh-traffic-in -m limit --limit 1/second -p tcp --tcp-flags \ ALL SYN --dport ssh -j ACCEPT $IPTABLES -A allow-ssh-traffic-in -p tcp --dport ssh -j ACCEPT # Trafic sortant einfo "Créer la chaîne de trafic SSH sortant" $IPTABLES -N allow-ssh-traffic-out $IPTABLES -F allow-ssh-traffic-out $IPTABLES -A allow-ssh-traffic-out -p tcp --dport ssh -j ACCEPT einfo "Créer la chaîne de trafic DNS sortant" $IPTABLES -N allow-dns-traffic-out $IPTABLES -F allow-dns-traffic-out $IPTABLES -A allow-dns-traffic-out -p udp -d $DNS1 --dport domain \ -j ACCEPT $IPTABLES -A allow-dns-traffic-out -p udp -d $DNS2 --dport domain \ -j ACCEPT einfo "Créer la chaîne de trafic HTTP/HTTPS sortant" $IPTABLES -N allow-www-traffic-out $IPTABLES -F allow-www-traffic-out $IPTABLES -A allow-www-traffic-out -p tcp --dport www -j ACCEPT $IPTABLES -A allow-www-traffic-out -p tcp --dport https -j ACCEPT # Détecter les scanneurs de ports. einfo "Créer la chaîne de détection de portscan" $IPTABLES -N check-flags $IPTABLES -F check-flags $IPTABLES -A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -m limit \ --limit 5/minute -j LOG --log-level alert --log-prefix "NMAP-XMAS:" $IPTABLES -A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP $IPTABLES -A check-flags -p tcp --tcp-flags ALL ALL -m limit --limit \ 5/minute -j LOG --log-level 1 --log-prefix "XMAS:" $IPTABLES -A check-flags -p tcp --tcp-flags ALL ALL -j DROP $IPTABLES -A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG \ -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "XMAS-PSH:" $IPTABLES -A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP $IPTABLES -A check-flags -p tcp --tcp-flags ALL NONE -m limit \ --limit 5/minute -j LOG --log-level 1 --log-prefix "NULL_SCAN:" $IPTABLES -A check-flags -p tcp --tcp-flags ALL NONE -j DROP $IPTABLES -A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -m limit \ --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/RST:" $IPTABLES -A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -j DROP $IPTABLES -A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit \ --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/FIN:" $IPTABLES -A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP # Applique et ajoute les chaînes invalides.