Main   Changelog   Spec   Patches   Sources   Download   Gear   Bugs e FR  Repocop 

#!/bin/sh
#
# firewall-masq-iptables        This script sets up firewall rules for a machine
#                               acting as a masquerading gateway
#
#                               üÔÏÔ ÓËÒÉÐÔ ÕÓÔÁÎÁ×ÌÉ×ÁÅÔ ÐÒÁ×ÉÌÁ ÆÉÌØÔÁÃÉÉ ÐÁËÅÔÏ×
#                               ÄÌÑ ÍÁÛÉÎÙ ×ÙÓÔÕÐÁÀÝÅÊ × ÒÏÌÉ ÍÁÒÛÒÕÔÉÚÁÔÏÒÁ
#
# Copyright (C) 2002 ALT Linux Team.  This software may be distributed under the terms
# of the GNU General Public License, version 2 or any later version.

# Interface to Internet

EXTIF=ppp+

ANY=0.0.0.0/0

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD

# Syn-flood protection.
# úÁÝÉÔÁ ÏÔ Syn-flood.
iptables -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
 
# Furtive port scanner.
# úÁÝÉÔÁ ÏÔ ÓËÒÙÔÏÇÏ ÓËÁÎÉÒÏ×ÁÎÉÑ ÐÏÒÔÏ×.
iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
 
# Ping of death.
# úÁÝÉÔÁ ÏÔ Ping of death.
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

# Deny NEW end INVALID incoming or required routings packets from ppp0.
# úÁÐÒÅÝÁÅÍ NEW É INVALID ×ÈÏÄÑÝÉÅ ÉÌÉ ÔÒÅÂÕÀÝÉÅ ÍÁÒÛÒÕÔÉÚÁÃÉÉ ÐÁËÅÔÙ Ó ppp0.
iptables -A INPUT -i $EXTIF -m state --state NEW,INVALID -j DROP
iptables -A FORWARD -i $EXTIF -m state --state NEW,INVALID -j DROP

# Allow a packets which is related to, and part of an existing connection.
# òÁÚÒÅÛÁÅÍ ÐÁËÅÔÙ ÐÒÉÎÁÄÌÅÖÁÝÉÅ É ÏÔÎÏÓÑÝÉÅÓÑ Ë ÕÖÅ ÕÓÔÁÎÏ×ÌÅÎÎÏÍÕ ÓÏÅÄÉÎÅÎÉÀ.
iptables -N block
iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A block -m state --state NEW -i ! $EXTIF -j ACCEPT
iptables -A block -j DROP

iptables -A INPUT -j block
iptables -A FORWARD -j block

# Do masquerading.
# íÁÓËÁÒÁÄÉÍ ppp0.
iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

# ÷ËÌÀÞÁÅÍ ÍÁÒÛÒÕÔÉÚÁÃÉÀ ÐÁËÅÔÏ×.
echo 1 > /proc/sys/net/ipv4/ip_forward