Firewall script for Linux IPTABLES
The script below is a firewall script for Linux systems. It is a bash script, it is very effective and has many built in...
Network Tips and Tricks In Linux
Hey AllThis are just some tips and tricks about ports and processes in linux, I might turn this into a FAQ once I have e...
XMPP/Jingle To SIP Conversion
Hey there Heard about jingle, the add on for XMPP that enables point to point audio between to XMPP clients. No server c...
Yakuake: Best SSH Shell Ever
Read this article about yakuake, great tool with nice themes and a hot key
| Firewall script for Linux IPTABLES |
|
|
|
| Written by Administrator | |
| Saturday, 26 April 2008 | |
|
The script below is a firewall script for Linux systems. It is a bash script, it is very effective and has many built in options, including the following amongst others
#Firewall script created by Ali Jawad #alijawad1 [at] gmail [dot] com 2008 #Read Instructions and contact me if more help #is needed ################################################# #!/bin/bash #1-You can stop the script and remove ALL firewall rules by #calling the script with the stop paramter. Example ./firewall.sh stop #To add this script to startup on a Red Hat system use chkconfig on firewall.sh and to remove it chkconfig off firewall.sh #!!!!I checked your system it is FC6 it does not have chkconfig to add it to startup add the script to /etc/rc.local add an entry such as # /bin/bash/ /path/to/firewall.sh #To make it executable by root do chmod u+x firewall.sh do this as root. #Load Required Modules /sbin/modprobe ip_conntrack /sbin/modprobe ip_tables /sbin/modprobe iptable_filter echo "Setting Variables For The Script" #Variables Below Change As Needed #This is the iptables binary usually it is either /sbin/iptables or /usr/sbin/iptables. You can get it using whereis iptables IPTABLES=/sbin/iptables #The network interface on which the server is receiving and sending traffic NIC=eth0 #The list of ports that are publicly accessible to the Internet, to add other ports simply seperate by spaces. Ex VAR=(X Y Z Q W) #The 22 is here for testing PUBLIC_PORTS=(21 22) WS_LIST_PORTS=(80 443) MYSQL_LIST_PORTS=(3306) ##Note: It is better to limit the services developers can access. Open access is never a good idea. The problem is #not about spoofing TCP based services are immune to IP spoofing. The problem is that the developers computer might be compromised DEVEL_LIST_PORTS=(22 80 3306 21) TESTING_LIST_PORTS=(22 80 3306 21) #The Lists of IPs accessible per Port list, Iptables does not accept hostnames so #please only put IPs here, you can also put whole IP classes WS_LIST=(10.10.10.10 11.11.11.11 4.4.4.4 192.168.10.0/24) MYSQL_LIST=(10.10.10.10 11.11.11.11 4.4.4.4 192.168.10.0/24) DEVEL_LIST=(10.10.10.10 11.11.11.11 4.4.4.4 192.168.10.0/24) TESTING_LIST=(10.10.10.10 11.11.11.11 4.4.4.4 192.168.10.0/24) #Enable or disable any of the lists defined above WS_LIST_ALLOW=no; MYSQL_LIST_ALLOW=yes; DEVEL_LIST_ALLOW=yes; TESTING_LIST_ALLOW=yes; #Enable Ping From Internet ENABLE_PING=yes #Block Everything Else #!!!!!!! do not change this to yes before testing that you can access your panel, and allow ssh access to all untill tested BLOCK_OTHERS=no if [[ $1 == stop ]] ; then echo "Erasing All Firewall Rules" iptables -F iptables -F -t nat iptables -F -t mangle iptables -X -t nat iptables -X -t mangle iptables -X else echo "Starting To Apply Firewall Rules By Erasing Old Rules" iptables -F iptables -F -t nat iptables -F -t mangle iptables -X -t nat iptables -X -t mangle iptables -X ########Opening Public Access echo "Opening Public Access Ports" i=0 while (($i < ${#PUBLIC_PORTS[@]} )) do PORT= ${PUBLIC_PORTS[i++]} echo "Opening Port $PORT For Public Access On Interface $NIC" $IPTABLES -A INPUT -p tcp --dport $PORT -j ACCEPT done ########Opening WS List Ports if [[ $WS_LIST_ALLOW==yes ]] ; then echo "Web Services List Is Enabled" i=0 while (($i < ${#WS_LIST_PORTS[@]} )) do j=0 PORT=${WS_LIST_PORTS[i++]} while (($j < ${#WS_LIST[@]} )) do IP=${WS_LIST[j++]} echo "Opening Port $PORT For IP $IP On Interface $NIC" $IPTABLES -A INPUT --source $IP -p tcp --dport $PORT -j ACCEPT done done fi ########Opening Testing List Ports if [[ $TESTING_LIST_ALLOW==yes ]] ; then echo "TESTING Services List Is Enabled" i=0 while (($i < ${#TESTING_LIST_PORTS[@]} )) do j=0 PORT=${TESTING_LIST_PORTS[i++]} while (($j < ${#TESTING_LIST[@]} )) do IP=${TESTING_LIST[j++]} echo "Opening Port $PORT For IP $IP On Interface $NIC" $IPTABLES -A INPUT --source $IP -p tcp --dport $PORT -j ACCEPT done done fi ########Opening Devel List Ports if [[ $DEVEL_LIST_ALLOW==yes ]] ; then echo "Developer Services List Is Enabled" i=0 while (($i < ${#DEVEL_LIST_PORTS[@]} )) do j=0 PORT=${DEVEL_LIST_PORTS[i++]} while (($j < ${#DEVEL_LIST[@]} )) do IP=${DEVEL_LIST[j++]} echo "Opening Port $PORT For IP $IP On Interface $NIC" $IPTABLES -A INPUT --source $IP -p tcp --dport $PORT -j ACCEPT done done fi ########Opening MYSQL List Ports if [[ $MYSQL_LIST_ALLOW==yes ]] ; then echo "MYSQL Services List Is Enabled" i=0 while (($i < ${#MYSQL_LIST_PORTS[@]} )) do j=0 PORT=${MYSQL_LIST_PORTS[i++]} while (($j < ${#MYSQL_LIST[@]} )) do IP=${MYSQL_LIST[j++]} echo "Opening Port $PORT For IP $IP On Interface $NIC" $IPTABLES -A INPUT --source $IP -p tcp --dport $PORT -j ACCEPT done done fi ########Setup Statefull Firewall echo "Applying Statefull Firewall Rules" $IPTABLES -A INPUT -i $NIC -m state --state ESTABLISHED,RELATED -j ACCEPT ########Set Ping Policy echo "Apply Ping Policy Only Accept type 8,11 This protects from Ping Attachs SMURF, Ping of Death ..etc" if [[ $ENABLE_PING==yes ]] ; then $IPTABLES -A INPUT -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT $IPTABLES -A INPUT -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT fi ########Set Default Policy echo "Set Default Policy" if [[ $BLOCK_OTHERS==yes ]] ; then $IPTABLES -A INPUT -i $NIC -j DROP fi fi echo "End Of Script" Only registered users can write comments. Powered by AkoComment 2.0! |
|
| Last Updated ( Tuesday, 29 April 2008 ) |
| Next > |
|---|
Main Menu
| Home |
| Articles |
| Links |
| Search |
| Chat Box |
| Contact Us |
| Me Myself and AJ |
The first step to getting the things you want out of life is this: Decide what you want.
5 Newest Users
 |
EsofPruff(EsofPruff) |
|
Maymbonmola(Maymbonmola) |
|
Adatoerar(Adatoerar) |
|
PolimohJoM(PolimohJoM) |
|
Excetetle(Excetetle) |
53,690Visitors:
15Visitors today:
48Visitors yesterday:
73,411Page views:
15Page views today:
54Page views yesterday:
1,088Page views this page:
max.
42Max. online:
2010-07-28, 23:00:03at (date):
317Max. visitors per day:
2008-11-03at (date):
656Max. page views per day:
2010-05-14at (date):
Autologin to site backend
Copyright © 2005 - 2010 Ali Jawad's Portal Site.
Designed by JoomlArt.com
Joomla! is Free Software released under the GNU/GPL License.
Joomla! is Free Software released under the GNU/GPL License.