#!/bin/sh
# firewall voor iptables, 27-5-2005
# paul@vandervlis.nl

# device voor internet
INTDEV="eth0"

# executables
IPTABLES="/sbin/iptables"
MODPROBE="/sbin/modprobe"
LOGGER="/usr/bin/logger"
ECHO="/bin/echo"

# voor /var/log/messages
$LOGGER -t `basename $0` "Begin starting firewall"

# dit laad de modules:
$MODPROBE ipt_REJECT
$MODPROBE ipt_MASQUERADE
$MODPROBE ipt_state
$MODPROBE iptable_nat
$MODPROBE ip_conntrack
# $MODPROBE ip_conntrack_ftp
# $MODPROBE ip_nat_ftp
$MODPROBE ipt_LOG
$MODPROBE ipt_owner

# Spoof protection
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
     $ECHO 1 > $f
done

# Syn cookies protection in kernel aanzetten
if [ -e /proc/sys/net/ipv4/tcp_syncookies ]; then
$ECHO 1 > /proc/sys/net/ipv4/tcp_syncookies
fi

# dit zet IP-forwarding aan
# $ECHO "1" > /proc/sys/net/ipv4/ip_forward

# weghalen van alle regels en chains
$IPTABLES -F
$IPTABLES -X
$IPTABLES -t nat -F
$IPTABLES -t nat -X
$IPTABLES -t mangle -F
$IPTABLES -t mangle -X

# policy
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT DROP

# chains maken:
$IPTABLES -N logdrop   
$IPTABLES -A logdrop   -j LOG --log-level info --log-prefix "FW:"
$IPTABLES -A logdrop   -j DROP
$IPTABLES -N logaccept
$IPTABLES -A logaccept -j LOG --log-level info --log-prefix "FW:"
$IPTABLES -A logaccept -j ACCEPT
$IPTABLES -N logreject
$IPTABLES -A logreject -j LOG --log-level info --log-prefix "FW:"
$IPTABLES -A logreject -j REJECT

# accepteer interne loopback
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT

## ICMP naar internet openzetten
$IPTABLES -A INPUT -i $INTDEV -p ICMP -j ACCEPT
$IPTABLES -A OUTPUT -o $INTDEV -p ICMP -j ACCEPT
# ICMP naar internet filteren
#$IPTABLES -A INPUT -i $INTDEV -p ICMP --icmp-type 0 -j ACCEPT
#$IPTABLES -A INPUT -i $INTDEV -p ICMP --icmp-type 3 -j ACCEPT
#$IPTABLES -A INPUT -i $INTDEV -p ICMP --icmp-type 5 -j ACCEPT
#$IPTABLES -A INPUT -i $INTDEV -p ICMP --icmp-type 11 -j ACCEPT

# blacklist:
$IPTABLES -A INPUT  -i $INTDEV -p TCP --dport 22 -s 116.31.116.40 -j DROP
$IPTABLES -A INPUT  -i $INTDEV -p TCP --dport 22 -s 91.224.161.103 -j DROP
$IPTABLES -A INPUT  -i $INTDEV -p TCP --dport 22 -s 49.233.73.178 -j DROP
$IPTABLES -A INPUT  -i $INTDEV -p TCP --dport 22 -s 222.186.0.0/16 -j DROP

# accepteer inkomend SSH verkeer
$IPTABLES -A INPUT  -i $INTDEV -p TCP --dport 22 -j ACCEPT
# $IPTABLES -A INPUT  -i $INTDEV -p TCP --dport 1022 -j ACCEPT
# accepteer inkomend SSH verkeer van bepaald IP-nummer
# Paul thuis
$IPTABLES -A INPUT -i $INTDEV -p TCP --dport 22 -s 45.95.238.187 -j ACCEPT
# VM voor nood
$IPTABLES -A INPUT -i $INTDEV -p TCP --dport 22 -s 91.198.178.27 -j ACCEPT
# om te testen:
$IPTABLES -A INPUT -i $INTDEV -p TCP --dport 22 -s 91.198.178.58 -j ACCEPT
# Heiko
$IPTABLES -A INPUT -i $INTDEV -p TCP --dport 22 -s 80.101.33.127 -j ACCEPT
# Sigmund
$IPTABLES -A INPUT -i $INTDEV -p TCP --dport 22 -s 91.198.178.50 -j ACCEPT

# accepteer inkomend HTTP verkeer
$IPTABLES -A INPUT  -i $INTDEV -p TCP --dport 80 -j ACCEPT
$IPTABLES -A INPUT  -i $INTDEV -p TCP --dport 443 -j ACCEPT

# accepteer inkomend FTP verkeer
# $IPTABLES -A INPUT  -i $INTDEV -p TCP --dport 21 -j ACCEPT
# $IPTABLES -A INPUT  -i $INTDEV -p TCP --dport 21 -j ACCEPT
# $IPTABLES -A INPUT  -i $INTDEV -p TCP --dport 40000:40100 -j ACCEPT

# accepteer inkomende mail
# $IPTABLES -A INPUT  -i $INTDEV -p TCP --dport 25 -j ACCEPT

# accepteer verkeer wat vanaf machine geinitieerd is
$IPTABLES -A INPUT -i $INTDEV -m state --state ESTABLISHED,RELATED \
    -j ACCEPT  

# accepteer al het uitgaande verkeer van machine naar internet
$IPTABLES -A OUTPUT -o $INTDEV  -j ACCEPT

# al het andere verkeer wat niet OK is, wordt gelogt
#$IPTABLES -A INPUT -j logdrop
#$IPTABLES -A OUTPUT -j logdrop
#$IPTABLES -A FORWARD -j logdrop

# voor /var/log/messages
$LOGGER -t `basename $0` "End starting firewall"
$ECHO "Firewall gestart"

#--------------ipv6
IP6TABLES="/sbin/ip6tables"

# policy
$IP6TABLES -F
$IP6TABLES -X
$IP6TABLES -t mangle -F
$IP6TABLES -t mangle -X
$IP6TABLES -P INPUT DROP
$IP6TABLES -P FORWARD DROP
$IP6TABLES -P OUTPUT DROP

# chains maken:
$IP6TABLES -N logdrop
$IP6TABLES -A logdrop   -j LOG --log-level info --log-prefix "FW:"
$IP6TABLES -A logdrop   -j DROP
$IP6TABLES -N logaccept
$IP6TABLES -A logaccept -j LOG --log-level info --log-prefix "FW:"
$IP6TABLES -A logaccept -j ACCEPT
$IP6TABLES -N logreject
$IP6TABLES -A logreject -j LOG --log-level info --log-prefix "FW:"
$IP6TABLES -A logreject -j REJECT

# accepteer interne loopback
$IP6TABLES -A INPUT -i lo -j ACCEPT
$IP6TABLES -A OUTPUT -o lo -j ACCEPT

# output en reakties daarop accepteren
$IP6TABLES -A OUTPUT -o $INTDEV  -j ACCEPT
$IP6TABLES -A INPUT  -i $INTDEV -m state --state ESTABLISHED,RELATED -j ACCEPT

# apache
$IP6TABLES -A INPUT  -i $INTDEV -p tcp --dport 80  -j ACCEPT
$IP6TABLES -A INPUT  -i $INTDEV -p tcp --dport 443 -j ACCEPT

# ssh
# paul thuis:
# $IP6TABLES -A INPUT  -i $INTDEV -p tcp --dport 22 -s 2001:980:beb0:1:0:0:0:2  -j ACCEPT
# nood management systeem:
# $IP6TABLES -A INPUT  -i $INTDEV -p tcp --dport 22 -s 2a01:1b0:7999:424::1b -j ACCEPT
# helpt tegen vertraging:
$IP6TABLES -A INPUT  -i $INTDEV -p TCP --dport 22 -j REJECT

# ICMP
$IP6TABLES -A INPUT  -i $INTDEV -p icmpv6 -j ACCEPT
$IP6TABLES -A OUTPUT -o $INTDEV -p icmpv6 -j ACCEPT

# logging
# $IP6TABLES -A INPUT -j logdrop
# $IP6TABLES -A OUTPUT -j logdrop
# $IP6TABLES -A FORWARD -j logdrop