#!/bin/sh # # This is automatically generated file. DO NOT MODIFY ! # # Firewall Builder fwb_ipt v3.0.7-1477 # # Generated Mon Apr 12 14:29:52 2010 EDT by wia # # files: * probe-1P-DS-TEST.fw # # # Compiled for iptables (any version) # # # # # PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}" export PATH LSMOD="/sbin/lsmod" MODPROBE="/sbin/modprobe" IPTABLES="/sbin/iptables" IP6TABLES="/sbin/ip6tables" IPTABLES_RESTORE="/sbin/iptables-restore" IP6TABLES_RESTORE="/sbin/ip6tables-restore" IP="/sbin/ip" LOGGER="/usr/bin/logger" log() { echo "$1" test -x "$LOGGER" && $LOGGER -p info "$1" } check_file() { test -r "$2" || { echo "Can not find file $2 referenced by AddressTable object $1" exit 1 } } va_num=1 add_addr() { addr=$1 nm=$2 dev=$3 type="" aadd="" L=`$IP -4 link ls $dev | head -n1` if test -n "$L"; then OIFS=$IFS IFS=" /:,<" set $L type=$4 IFS=$OIFS if test "$type" = "NO-CARRIER"; then type=$5 fi L=`$IP -4 addr ls $dev to $addr | grep inet | grep -v :` if test -n "$L"; then OIFS=$IFS IFS=" /" set $L aadd=$2 IFS=$OIFS fi fi if test -z "$aadd"; then if test "$type" = "POINTOPOINT"; then $IP -4 addr add $addr dev $dev scope global label $dev:FWB${va_num} va_num=`expr $va_num + 1` fi if test "$type" = "BROADCAST"; then $IP -4 addr add $addr/$nm dev $dev brd + scope global label $dev:FWB${va_num} va_num=`expr $va_num + 1` fi fi } getInterfaceVarName() { echo $1 | sed 's/\./_/' } getaddr() { dev=$1 name=$2 L=`$IP -4 addr show dev $dev | grep inet | grep -v :` test -z "$L" && { eval "$name=''" return } OIFS=$IFS IFS=" /" set $L eval "$name=$2" IFS=$OIFS } getaddr6() { dev=$1 name=$2 L=`$IP -6 addr show dev $dev | grep inet6 | grep -v :` test -z "$L" && { eval "$name=''" return } OIFS=$IFS IFS=" /" set $L eval "$name=$2" IFS=$OIFS } getinterfaces() { NAME=$1 $IP link show | grep ": $NAME" | while read L; do OIFS=$IFS IFS=" :" set $L IFS=$OIFS echo $2 done } # increment ip address incaddr() { n1=$4 n2=$3 n3=$2 n4=$1 vn1=`eval "echo \\$$n1"` R=`expr $vn1 \< 255` if test $R = "1"; then eval "$n1=`expr $vn1 + 1`" else eval "$n1=0" incaddr XX $n4 $n3 $n2 fi } prolog_commands() { echo "Running prolog script" } epilog_commands() { echo "Running epilog script" } run_epilog_and_exit() { epilog_commands exit $1 } if $IP link ls >/dev/null 2>&1; then echo; else echo "iproute not found" exit 1 fi prolog_commands MODULES_DIR="/lib/modules/`uname -r`/kernel/net/" MODULES=`find $MODULES_DIR -name '*conntrack*'|sed -e 's/^.*\///' -e 's/\([^\.]\)\..*/\1/'` for module in $MODULES; do if $LSMOD | grep ${module} >/dev/null; then continue; fi $MODPROBE ${module} || exit 1 done # Using 0 address table files INTERFACES="eth0 lo " for i in $INTERFACES ; do $IP link show "$i" > /dev/null 2>&1 || { log "Interface $i does not exist" exit 1 } done # Configure interfaces getaddr eth0 i_eth0 getaddr6 eth0 i_eth0_v6 # Add virtual addresses for NAT rules log 'Activating firewall script generated Mon Apr 12 14:29:52 2010 by wia' # ================ IPv4 # ================ Table 'filter', automatic rules $IPTABLES -P OUTPUT DROP $IPTABLES -P INPUT DROP $IPTABLES -P FORWARD DROP cat /proc/net/ip_tables_names | while read table; do $IPTABLES -t $table -L -n | while read c chain rest; do if test "X$c" = "XChain" ; then $IPTABLES -t $table -F $chain fi done $IPTABLES -t $table -X done $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT # ================ Table 'filter', rule set Policy # Policy compiler errors and warnings: # # # Rule 0 (lo) # echo "Rule 0 (lo)" # # Allow anything on loopback # $IPTABLES -A INPUT -i lo -m state --state NEW -j ACCEPT $IPTABLES -A OUTPUT -o lo -m state --state NEW -j ACCEPT # # Rule 1 (global) # echo "Rule 1 (global)" # # Anti-spoofing rule # $IPTABLES -N In_RULE_1 test -n "$i_eth0" && $IPTABLES -A INPUT -s $i_eth0 -j In_RULE_1 test -n "$i_eth0" && $IPTABLES -A FORWARD -i + -s $i_eth0 -j In_RULE_1 $IPTABLES -A In_RULE_1 -j LOG --log-level warning --log-prefix "FW-RULE 1 -- DENY " --log-tcp-options --log-ip-options $IPTABLES -A In_RULE_1 -j DROP # # Rule 2 (global) # echo "Rule 2 (global)" # # Allow services in # $IPTABLES -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT # # Rule 3 (global) # echo "Rule 3 (global)" # # Allow services in # $IPTABLES -N Cid8747X28505.0 $IPTABLES -A INPUT -p icmp -m icmp --icmp-type 11/0 -m state --state NEW -j Cid8747X28505.0 $IPTABLES -A INPUT -p icmp -m icmp --icmp-type 11/1 -m state --state NEW -j Cid8747X28505.0 $IPTABLES -A INPUT -p icmp -m icmp --icmp-type 0/0 -m state --state NEW -j Cid8747X28505.0 $IPTABLES -A INPUT -p icmp -m icmp --icmp-type 3 -m state --state NEW -j Cid8747X28505.0 $IPTABLES -A INPUT -p icmp -m icmp --icmp-type 8/0 -m state --state NEW -j Cid8747X28505.0 $IPTABLES -A INPUT -p tcp -m tcp --dport 7 -m state --state NEW -j Cid8747X28505.0 $IPTABLES -A INPUT -p udp -m udp -m multiport --dports 162,514,161 -m state --state NEW -j Cid8747X28505.0 $IPTABLES -A Cid8747X28505.0 -s 192.168.176.0/24 -j ACCEPT $IPTABLES -A Cid8747X28505.0 -s 192.168.175.0/24 -j ACCEPT $IPTABLES -A Cid8747X28505.0 -s 192.168.177.0/24 -j ACCEPT $IPTABLES -A Cid8747X28505.0 -s 70.62.110.170/31 -j ACCEPT $IPTABLES -A Cid8747X28505.0 -s 70.62.110.172/31 -j ACCEPT $IPTABLES -A Cid8747X28505.0 -s 70.62.110.174 -j ACCEPT $IPTABLES -A Cid8747X28505.0 -s 216.134.202.52/30 -j ACCEPT $IPTABLES -A Cid8747X28505.0 -s 216.134.202.56/30 -j ACCEPT $IPTABLES -A Cid8747X28505.0 -s 216.134.202.60/31 -j ACCEPT $IPTABLES -A Cid8747X28505.0 -s 216.134.202.62 -j ACCEPT $IPTABLES -A Cid8747X28505.0 -s 74.239.167.170/31 -j ACCEPT $IPTABLES -A Cid8747X28505.0 -s 74.239.167.172/31 -j ACCEPT $IPTABLES -A Cid8747X28505.0 -s 74.239.167.174 -j ACCEPT # # Rule 4 (global) # echo "Rule 4 (global)" # # Allow services out # $IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 11/0 -m state --state NEW -j ACCEPT $IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 11/1 -m state --state NEW -j ACCEPT $IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 0/0 -m state --state NEW -j ACCEPT $IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 3 -m state --state NEW -j ACCEPT $IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 8/0 -m state --state NEW -j ACCEPT $IPTABLES -A OUTPUT -p tcp -m tcp --dport 1:9999 -m state --state NEW -j ACCEPT $IPTABLES -A OUTPUT -p udp -m udp --dport 1:9999 -m state --state NEW -j ACCEPT $IPTABLES -A OUTPUT -p udp -m udp --dport 33434:33524 -m state --state NEW -j ACCEPT # # Rule 5 (global) # echo "Rule 5 (global)" # # Ignore customer incoming broadcasts # $IPTABLES -A INPUT -d 255.255.255.255 -j DROP # # Rule 6 (global) # echo "Rule 6 (global)" # # Ignore chatty stuff # $IPTABLES -A INPUT -p tcp -m tcp --dport 139 -j DROP $IPTABLES -A INPUT -p udp -m udp -m multiport --dports 138,137,6157,68,5757,67 -j DROP # # Rule 7 (global) # echo "Rule 7 (global)" # # Ignore multicast # $IPTABLES -A INPUT -d 224.0.0.0/4 -j DROP # # Rule 8 (global) # echo "Rule 8 (global)" # # Deny and log catch all # $IPTABLES -N RULE_8 $IPTABLES -A OUTPUT -j RULE_8 $IPTABLES -A INPUT -j RULE_8 $IPTABLES -A FORWARD -j RULE_8 $IPTABLES -A RULE_8 -j LOG --log-level info --log-prefix "FW-RULE 8 -- DENY " --log-tcp-options --log-ip-options $IPTABLES -A RULE_8 -j DROP epilog_commands