RootForum Community

Code: Select all

#!/bin/sh 
### Grundkonfiguration 
# Externes Interface 
INET_IP="217.160.x.x" 
INET_IFACE="eth0" 
# Internes Interface 
LO_IFACE="lo" 
LO_IP="127.0.0.1" 
# Pfad zu iptables-Binary 
IPTABLES="/sbin/iptables" 

# Laden der benötigten Kernel-Module 
/sbin/depmod -a 
/sbin/modprobe ip_tables 
/sbin/modprobe ip_conntrack 
/sbin/modprobe iptable_filter 
/sbin/modprobe iptable_mangle 
/sbin/modprobe iptable_nat 
/sbin/modprobe ipt_LOG 
/sbin/modprobe ipt_limit 
/sbin/modprobe ipt_state 

# Aktivierung IP-Forwarding 
echo "1" > /proc/sys/net/ipv4/ip_forward 

### Regelwerk 
# Default-Policy -> alles droppen 
$IPTABLES -P INPUT DROP 
$IPTABLES -P OUTPUT DROP 
$IPTABLES -P FORWARD DROP 

# Neue Tables anlegen, um Paketgruppen zu definieren 
$IPTABLES -N bad_tcp_packets 
$IPTABLES -N allowed 
$IPTABLES -N icmp_packets 
$IPTABLES -N tcp_packets 

# "Böse" Pakete werden direkt "aussortiert" 
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG  
--log-prefix "New not syn:" 
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP 

# "Normale" Pakete durchlassen 
$IPTABLES -A allowed -p TCP --syn -j ACCEPT 
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT 
$IPTABLES -A allowed -p TCP -j DROP 

# Benötigte Ports öffnen 
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed 
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed 
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 25 -j allowed 
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed 
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 443 -j allowed 

# ICMP auf's nötigste Begrenzen (echo request und time exceeded) 
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT 
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT 

# Input-Table 
$IPTABLES -A INPUT -p tcp -j bad_tcp_packets 
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT 
$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED  
-j ACCEPT 
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets 
$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udpincoming_packets 
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets 
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG  
--log-level DEBUG --log-prefix "IPT INPUT packet died: " 

# Forward-Table (theoretisch unnötig für Rootserver) 
$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets 
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG  
--log-level DEBUG --log-prefix "IPT FORWARD packet died: " 

# Output-Table 
$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets 
$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT 
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT 
$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT