#!/bin/bash
# firewall voor servers
# versie 28-06-2021

# executables
IPTABLES="/sbin/iptables"
MODPROBE="/sbin/modprobe"
LOGGER="/usr/bin/logger"
ECHO="/bin/echo"

# voor /var/log/messages
$LOGGER -t `basename $0` "Begin starting firewall"

# dit laad de modules:
$MODPROBE ipt_REJECT
$MODPROBE ipt_state
$MODPROBE ip_conntrack
$MODPROBE ipt_LOG
$MODPROBE ipt_owner

# Spoof protection
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
     $ECHO 1 > $f
done

# Syn cookies protection in kernel aanzetten
if [ -e /proc/sys/net/ipv4/tcp_syncookies ]; then
$ECHO 1 > /proc/sys/net/ipv4/tcp_syncookies
fi

# dit zet IP-forwarding aan
# $ECHO "1" > /proc/sys/net/ipv4/ip_forward

# weghalen van alle regels en chains
$IPTABLES -F
$IPTABLES -X
$IPTABLES -t nat -F
$IPTABLES -t nat -X
$IPTABLES -t mangle -F
$IPTABLES -t mangle -X

# policy
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT DROP

# chains maken:
$IPTABLES -N logdrop   
$IPTABLES -A logdrop   -j LOG --log-level info --log-prefix "FW:"
$IPTABLES -A logdrop   -j DROP
$IPTABLES -N logaccept
$IPTABLES -A logaccept -j LOG --log-level info --log-prefix "FW:"
$IPTABLES -A logaccept -j ACCEPT
$IPTABLES -N logreject
$IPTABLES -A logreject -j LOG --log-level info --log-prefix "FW:"
$IPTABLES -A logreject -j REJECT

# accepteer interne loopback
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT

# accepteer verkeer via openvpn
# $IPTABLES -A INPUT -i tun0  -j ACCEPT
# $IPTABLES -A OUTPUT -o tun0  -j ACCEPT
# $IPTABLES -A FORWARD -i tun0 -j ACCEPT
# $IPTABLES -A FORWARD -o tun0 -j ACCEPT

## ICMP naar internet openzetten
$IPTABLES -A INPUT -p ICMP -j ACCEPT
$IPTABLES -A OUTPUT -p ICMP -j ACCEPT

# accepteer inkomend SSH verkeer
# $IPTABLES -A INPUT -p TCP --dport 22 -j ACCEPT
# accepteer inkomend SSH verkeer van bepaald IP-nummer
# Paul thuis
$IPTABLES -A INPUT -p TCP --dport 22 -s 188.213.90.187 -j ACCEPT
# VM voor nood
$IPTABLES -A INPUT -p TCP --dport 22 -s 91.198.178.27 -j ACCEPT
# lokaal
# $IPTABLES -A INPUT -p TCP --dport 22 -s 192.168.0.31 -j ACCEPT

# accepteer inkomend verkeer

# HTTP:
# $IPTABLES -A INPUT -p TCP --dport 80 -j ACCEPT
# $IPTABLES -A INPUT -p TCP --dport 443 -j ACCEPT

# SMTP:
# $IPTABLES -A INPUT -p TCP --dport 25 -j ACCEPT
# $IPTABLES -A INPUT -p TCP --dport 465 -j ACCEPT

# IMAP:
# $IPTABLES -A INPUT -p TCP --dport 143 -j ACCEPT
# $IPTABLES -A INPUT -p TCP --dport 993 -j ACCEPT

# POP3:
# $IPTABLES -A INPUT -p TCP --dport 110 -j ACCEPT
# $IPTABLES -A INPUT -p TCP --dport 995 -j ACCEPT

# SUBMISSION:
# $IPTABLES -A INPUT -p TCP --dport 587 -j ACCEPT


# accepteer verkeer wat vanaf machine geinitieerd is
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT  

# accepteer al het uitgaande verkeer van machine
$IPTABLES -A OUTPUT -j ACCEPT

# al het andere verkeer wat niet OK is, wordt gelogt
#$IPTABLES -A INPUT -j logdrop
#$IPTABLES -A OUTPUT -j logdrop
#$IPTABLES -A FORWARD -j logdrop

# voor /var/log/messages
$LOGGER -t `basename $0` "End starting firewall"
$ECHO "Firewall gestart"

#--------------ipv6
IP6TABLES="/sbin/ip6tables"

# policy
$IP6TABLES -F
$IP6TABLES -X
$IP6TABLES -t mangle -F
$IP6TABLES -t mangle -X
$IP6TABLES -P INPUT DROP
$IP6TABLES -P FORWARD DROP
$IP6TABLES -P OUTPUT DROP

# chains maken:
$IP6TABLES -N logdrop
$IP6TABLES -A logdrop   -j LOG --log-level info --log-prefix "FW:"
$IP6TABLES -A logdrop   -j DROP
$IP6TABLES -N logaccept
$IP6TABLES -A logaccept -j LOG --log-level info --log-prefix "FW:"
$IP6TABLES -A logaccept -j ACCEPT
$IP6TABLES -N logreject
$IP6TABLES -A logreject -j LOG --log-level info --log-prefix "FW:"
$IP6TABLES -A logreject -j REJECT

# accepteer interne loopback
$IP6TABLES -A INPUT -i lo -j ACCEPT
$IP6TABLES -A OUTPUT -o lo -j ACCEPT

# output en reakties daarop accepteren
$IP6TABLES -A OUTPUT -j ACCEPT
$IP6TABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# HTTP:
# $IP6TABLES -A INPUT -p TCP --dport 80 -j ACCEPT
# $IP6TABLES -A INPUT -p TCP --dport 443 -j ACCEPT

# SMTP:
# $IP6TABLES -A INPUT -p TCP --dport 25 -j ACCEPT
# $IP6TABLES -A INPUT -p TCP --dport 465 -j ACCEPT

# IMAP:
# $IP6TABLES -A INPUT -p TCP --dport 143 -j ACCEPT
# $IP6TABLES -A INPUT -p TCP --dport 993 -j ACCEPT

# POP3:
# $IP6TABLES -A INPUT -p TCP --dport 110 -j ACCEPT
# $IP6TABLES -A INPUT -p TCP --dport 995 -j ACCEPT

# SUBMISSION:
# $IP6TABLES -A INPUT -p TCP --dport 587 -j ACCEPT

# ssh
# $IP6TABLES -A INPUT -p tcp --dport 22 -j ACCEPT
# paul thuis:
$IP6TABLES -A INPUT -p tcp --dport 22 -s 2a10:3781:13b6::2 -j ACCEPT
# nood management systeem:
$IP6TABLES -A INPUT -p tcp --dport 22 -s 2a01:1b0:7999:424::27 -j ACCEPT

# ICMP
$IP6TABLES -A INPUT  -p icmpv6 -j ACCEPT
$IP6TABLES -A OUTPUT -p icmpv6 -j ACCEPT

# logging
# $IP6TABLES -A INPUT -j logdrop
# $IP6TABLES -A OUTPUT -j logdrop
# $IP6TABLES -A FORWARD -j logdrop