#!/bin/sh #********************************************************************# # Firewall 0.3 Sesame,basé sur celui de fjord # # Pour iptables sur base de noyau Linux v2.4 # # # # Sources : # # Packet-Fitering HOWTO de Paul 'Rusty' Russel # # Ipchains HOWTO chapitre "a serious example" # # Firewall Zamok de Samuel 'SamK' Krempp (oct 2000) # # Essai Cyril Lacoux # # Auteur: # # Mickael Profeta (nov 2000) # # Retouché par Jerome KIEFFER (sept2001) # # arranged for wifi/Sesame (May 2003) # #********************************************************************# # Network Diagram # # //////////// //////////// # / Wireless /192.168.100.254 / Sesame /----------->ISP # / Access /-------------------/ Wireless /eth0 # / Point / 100.253 / gateway / # //////////// eth1//////////// bugInfo=echo IPTABLES="/sbin/iptables" MODPROBE="/sbin/modprobe" IFACE_INET="eth0" # To the Internet IFACE_WLAN="eth1" # To the Wireless LAN #IPs of the DNS servers IP_DNS1="192.168.100.254" # Internet Solution1 IP_DNS2="196.23.2.2" # Internet Solution2 IP_WLAN="192.168.100.0/24" # IPs of the Nated (W)Lan IP_AP="192.168.100.4" # Wireless Access Point IP_GW="192.168.100.254" # interface connected to the AP #Ports open from the (internet) #UDP_oPORT="" TCP_oPORT="22 80" TCP_WLAN="20 21 22 37 53 80 110 113 143 443" #********************************************************************# # Subroutine for clearing # #********************************************************************# clear () { $IPTABLES -F $IPTABLES -X $IPTABLES -F INPUT $IPTABLES -F OUTPUT $IPTABLES -F FORWARD $IPTABLES -P INPUT ACCEPT $IPTABLES -P OUTPUT ACCEPT $IPTABLES -P FORWARD ACCEPT $IPTABLES -A INPUT -i lo -j ACCEPT $IPTABLES -A OUTPUT -o lo -j ACCEPT $IPTABLES -A FORWARD -j ACCEPT $IPTABLES -t nat -A POSTROUTING -o $IFACE_INET -j MASQUERADE } #********************************************************************# # Load all the modules to build the firewall # #********************************************************************# loadmod() { for mod in ip_tables ip_conntrack ip_conntrack_ftp iptable_nat ip_nat_ftp ipt_MASQUERADE ipt_LOG ipt_ULOG do $MODPROBE $mod echo -n "."; done echo "Ok." } #********************************************************************# # Activating the filter and IP-forwarding # #********************************************************************# setone() { # Enable IP Forwarding, if it isn't already echo 1 > /proc/sys/net/ipv4/ip_forward # TODO: Remarked by Deon because of error - kernel version? # Enable always defragging Protection #echo 1 > /proc/sys/net/ipv4/ip_always_defrag # Enable broadcast echo Protection echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Enable bad error message Protection echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses # Enable IP spoofing protection # turn on Source Address Verification for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f done # Disable ICMP Redirect Acceptance for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo 0 > $f done for f in /proc/sys/net/ipv4/conf/*/send_redirects; do echo 0 > $f done # Disable Source Routed Packets for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do echo 0 > $f done # Log Spoofed Packets, Source Routed Packets, Redirect Packets for f in /proc/sys/net/ipv4/conf/*/log_martians; do echo 1 > $f done } enleve_tout() { echo -n "Removing all rules..." # Flush the table $IPTABLES -F echo -n "." # Delete all chains $IPTABLES -X echo -n "." # Flush the NAT table $IPTABLES -t nat -F echo -n "." $IPTABLES -P INPUT ACCEPT $IPTABLES -P OUTPUT ACCEPT $IPTABLES -P FORWARD ACCEPT echo -n "..." echo "Ok." } #**********************************************************************# # During the script execution, everything is rejected # # these lines are deleted at the end # # So NEVER stop the execution of the script, use "try" instead. # #**********************************************************************# rejette_tout () { echo -n "Reject everything ..." $IPTABLES -A INPUT -i ! lo -j REJECT $IPTABLES -A OUTPUT -o ! lo -j REJECT $IPTABLES -A FORWARD -i ! lo -j REJECT echo -n "..." $IPTABLES -A INPUT -i lo -j ACCEPT $IPTABLES -A OUTPUT -o lo -j ACCEPT $IPTABLES -A FORWARD -i lo -j ACCEPT echo -n "..." echo "Ok." $IPTABLES -P INPUT DROP $IPTABLES -P OUTPUT DROP $IPTABLES -P FORWARD DROP } cree_chaines() { echo -n "Creating new Chains ..." for i in inet wlan do $IPTABLES -N gateway-$i # source : server $IPTABLES -N $i-gateway # destination : server echo -n ".." done echo "Ok." $IPTABLES -N wlan-inet $IPTABLES -N inet-wlan } attribue_chaines() { echo -n "Attribution of physical connection to chains ." $IPTABLES -A OUTPUT -o $IFACE_INET -d 0/0 -j gateway-inet $IPTABLES -A INPUT -i $IFACE_INET -j inet-gateway $IPTABLES -A OUTPUT -o $IFACE_WLAN -d $IP_WLAN -j gateway-wlan $IPTABLES -A INPUT -i $IFACE_WLAN -s $IP_WLAN -d $IP_GW -j wlan-gateway $IPTABLES -A FORWARD -i $IFACE_WLAN -s $IP_WLAN -o $IFACE_INET -j wlan-inet $IPTABLES -A FORWARD -i $IFACE_INET -o $IFACE_WLAN -d $IP_WLAN -j inet-wlan echo .. } fait_masquerade() { echo -n "Activating NAT .." $IPTABLES -t nat -A POSTROUTING -o $IFACE_INET -j MASQUERADE #could be also done with NAT $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT #proxy-transparent : uncomment to redirect everything:80 to Gateway:squid #$IPTABLES -A PREROUTING -t nat -p tcp -s $IP_WLAN --dport 80 -j DNAT --to-destination 192.168.100.254:80 echo ".Ok." } #********************************************************************# fait_firewall() { #********************************************************************# # No restriction from the gateway to the Wlan $IPTABLES -A gateway-wlan -j ACCEPT echo -n " Opening the firewall for WLAN on tcp/" for PORT in $TCP_WLAN; do echo -n " $PORT," $IPTABLES -A wlan-gateway -p tcp --dport $PORT -j ACCEPT done echo . echo Login, DHCP, DNS and PING allowed from WLan $IPTABLES -A wlan-gateway -p udp --dport 53 -j ACCEPT $IPTABLES -A wlan-gateway -p udp --dport 67 -j ACCEPT $IPTABLES -A wlan-gateway -p tcp --dport 8080 -j ACCEPT # No restriction to the internet $IPTABLES -A gateway-inet -j ACCEPT #en local on accepte tout. $IPTABLES -A INPUT -i lo -j ACCEPT $IPTABLES -A OUTPUT -o lo -j ACCEPT $IPTABLES -A FORWARD -i lo -j ACCEPT # If you want the Wireless Access point to connect on UDP/514:syslog # $IPTABLES -A wlan-gateway -p udp -d $IP_GW --dport 514 -s $IP_AP -j ACCEPT #rejecting eveything else from wlan to the internet $IPTABLES -A wlan-inet -j LOG # Add redirection rule to iptables for all addresses in subnet for (( ADDR = 10; ADDR <= 253; ADDR++ )); do $IPTABLES -t nat -A PREROUTING -i eth1 -s 192.168.100.$ADDR -p tcp -m tcp --dport 80 -j DNAT --to 192.168.100.254 $IPTABLES -t nat -A POSTROUTING -d 192.168.100.$ADDR -p tcp -m tcp --dport 80 -j SNAT --to 192.168.100.254 done $IPTABLES -A wlan-inet -j REJECT # if the gateway is a server for the internet : for PORT in $TCP_oPORT; do $IPTABLES -A inet-gateway -p tcp --dport $PORT -j ACCEPT done $IPTABLES -A wlan-inet -p tcp --dport 20 -j ACCEPT $IPTABLES -A wlan-inet -p tcp --dport 21 -j ACCEPT $IPTABLES -A inet-wlan -p tcp --sport 21 -j ACCEPT $IPTABLES -A inet-wlan -p tcp --sport 20 -j ACCEPT for PORT in $UDP_oPORT; do $IPTABLES -A inet-gateway -p udp --dport $PORT -j ACCEPT done #icmp : accepting ping fom the internet (can be controlled by QOS) $IPTABLES -A inet-gateway -p icmp --icmp-type echo-request -j ACCEPT #commun aux paquets entrant sur gateway et reseau local $IPTABLES -N inet $IPTABLES -A inet-gateway -j inet $IPTABLES -A inet-wlan -j inet #accept all DNS requests $IPTABLES -A inet -s $IP_DNS1 -p udp --dport 53 -j ACCEPT #DNS $IPTABLES -A inet -s $IP_DNS2 -p udp --dport 53 -j ACCEPT $IPTABLES -A inet -p icmp --icmp-type echo-reply -j ACCEPT $IPTABLES -A inet -p icmp --icmp-type destination-unreachable -j ACCEPT $IPTABLES -A inet -p icmp --icmp-type source-quench -j ACCEPT $IPTABLES -A inet -p icmp --icmp-type time-exceeded -j ACCEPT $IPTABLES -A inet -p icmp --icmp-type parameter-problem -j ACCEPT #accept connections established, related $IPTABLES -A inet -m state --state ESTABLISHED,RELATED -j ACCEPT #log rogue packets $IPTABLES -A inet -p tcp -j LOG --log-level 5 --log-prefix 'tcp DROP ' #$IPTABLES -A ext -p tcp -j ULOG --ulog-prefix 'tcp DROP ' #if you prefer ulog $IPTABLES -A inet -p tcp -j DROP $IPTABLES -A inet -p udp -j LOG --log-level 5 --log-prefix 'udp DROP ' #$IPTABLES -A ext -p udp -j ULOG --ulog-prefix 'udp DROP ' #if you prefer ulog $IPTABLES -A inet -p udp -j DROP } libere() { $IPTABLES -D FORWARD 1 $IPTABLES -D INPUT 1 $IPTABLES -D OUTPUT 1 } #********************************************************************# # Routine de lancement du Firewall # #********************************************************************# start () { setone loadmod enleve_tout rejette_tout cree_chaines attribue_chaines fait_masquerade fait_firewall libere } case "$1" in start) start ;; stop) echo "Never STOP a firewall, clear it !" ;; restart|force-reload) start ;; clear) clear ;; status) $IPTABLES -nv -L ;; try) date;start;date;sleep 10;clear;date ;; *) echo "Usage: /etc/init.d/firewall {start|status|stop|restart|force-reload|clear}" echo " -> Starting firewall, as a default." start exit 1 ;; esac exit 0