#!/bin/bash # (using bashism: arrays) user="root" reset_all_netdevs=true preferred_default_route_iface="if" extif="if" ext_open_tcp="22 80 88" # space-separated # Make ourself one-shot sv o . # Debug #date '+%Y-%m-%d %H:%M:%S' >>"$0.log" service=`basename $PWD` rundir="/var/run/service/$service" ### filter This is the default table (if no -t option is passed). It contains ### the built-in chains INPUT (for packets coming into the box itself), ### FORWARD (for packets being routed through the box), and OUTPUT (for ### locally-generated packets). ### ### nat This table is consulted when a packet that creates a new connection ### is encountered. It consists of three built-ins: PREROUTING (for ### altering packets as soon as they come in), OUTPUT (for altering ### locally-generated packets before routing), and POSTROUTING (for ### altering packets as they are about to go out). ### ### mangle It had two built-in chains: PREROUTING (for altering incoming ### packets before routing) and OUTPUT (for altering locally-generated ### packets before routing). Recently three other built-in ### chains are added: INPUT (for packets coming into the box ### itself), FORWARD (for altering packets being routed through the ### box), and POSTROUTING (for altering packets as they are about to go ### out). ### ### ...iface... ...iface... ### | ^ ### v | ### -mangle,NAT- -mangle,filter- -mangle,NAT-- ### |PREROUTING|-->[Routing]-->|FORWARD |-->|POSTROUTING| ### ------------ | ^ --------------- ------------- ### | | ^ ### | +--if NATed------------+ | ### v | | ### -mangle,filter- -mangle,NAT,filter- ### |INPUT | +->[Routing]->|OUTPUT | ### --------------- | ------------------- ### | | ### v | ### ... Local Process... doit() { echo "# $*" "$@" } #exec >/dev/null exec >"$0.out" exec 2>&1 exec </dev/null umask 077 # Make sure rundir/ exists mkdir -p "$rundir" 2>/dev/null chown -R "$user": "$rundir" chmod -R a=rX "$rundir" rm -rf rundir 2>/dev/null ln -s "$rundir" rundir # Timestamping date '+%Y-%m-%d %H:%M:%S' echo; echo "* Reading IP config" cfg=-1 # static cfg dhcp,zeroconf etc for ipconf in conf/*.ipconf "$rundir"/*.ipconf; do if test -f "$ipconf"; then echo "+ $ipconf" . "$ipconf" fi done echo; echo "* Configuring hardware" #doit ethtool -s if autoneg off speed 100 duplex full #doit ethtool -K if rx off tx off sg off tso off echo; echo "* Resetting address and routing info" if $reset_all_netdevs; then devs=`sed -n 's/ //g;s/:.*$//p' </proc/net/dev` for iface in $devs; do doit ip a f dev "$iface" doit ip r f dev "$iface" root 0/0 done else doit ip a f dev lo i=0; while test "${if[$i]}"; do doit ip a f dev "${if[$i]}" doit ip r f dev "${if[$i]}" root 0/0 let i++; done fi echo; echo "* Configuring addresses" doit ip a a dev lo 127.0.0.1/8 scope host doit ip a a dev lo ::1/128 scope host i=0; while test "${if[$i]}"; do if test "${ipmask[$i]}"; then doit ip a a dev "${if[$i]}" "${ipmask[$i]}" brd + doit ip l set dev "${if[$i]}" up fi let i++; done echo; echo "* Configuring routes" # If several ifaces are configured via DHCP, they often both have 0/0 route. # They have no way of knowing that this route is offered on more than one iface. # Often, it's desirable to prefer one iface: say, wired eth over wireless. # if preferred_default_route_iface is not set, 0/0 route will be assigned randomly. if test "$preferred_default_route_iface"; then i=0; while test "${if[$i]}"; do if test "${if[$i]}" = "$preferred_default_route_iface" \ && test "${net[$i]}" = "0/0" \ && test "${gw[$i]}"; then echo "+ default route through ${if[$i]}, ${gw[$i]}:" doit ip r a "${net[$i]}" via "${gw[$i]}" fi let i++; done fi i=0; while test "${if[$i]}"; do #echo $i:"${if[$i]}" if test "${net[$i]}" && test "${gw[$i]}"; then doit ip r a "${net[$i]}" via "${gw[$i]}" fi let i++; done echo; echo "* Recreating /etc/* files reflecting new network configuration:" for i in etc/*; do n=`basename "$i"` echo "+ $n" (. "$i") >"/etc/$n" chmod 644 "/etc/$n" done # Usage: new_chain <chain> [<table>] new_chain() { local t="" test x"$2" != x"" && t="-t $2" doit iptables $t -N $1 ipt="iptables $t -A $1" } echo; echo "* Reset iptables" doit iptables --flush doit iptables --delete-chain doit iptables --zero doit iptables -t nat --flush doit iptables -t nat --delete-chain doit iptables -t nat --zero doit iptables -t mangle --flush doit iptables -t mangle --delete-chain doit iptables -t mangle --zero echo; echo "* Configure iptables" doit modprobe nf_nat_ftp doit modprobe nf_nat_tftp doit modprobe nf_conntrack_ftp doit modprobe nf_conntrack_tftp # *** nat *** # INCOMING TRAFFIC ipt="iptables -t nat -A PREROUTING" # nothing here # LOCALLY ORIGINATED TRAFFIC ipt="iptables -t nat -A OUTPUT" # nothing here # OUTGOING TRAFFIC ipt="iptables -t nat -A POSTROUTING" # Masquerade boxes on my private net doit $ipt -s 192.168.0.0/24 -o $extif -j MASQUERADE # *** mangle *** ### DEBUG ### ipt="iptables -t mangle -A PREROUTING" ### doit $ipt -s 192.168.0.0/24 -j RETURN ### ipt="iptables -t mangle -A FORWARD" ### doit $ipt -s 192.168.0.0/24 -j RETURN ### ipt="iptables -t mangle -A POSTROUTING" ### doit $ipt -s 192.168.0.0/24 -j RETURN # nothing here # *** filter *** # new_chain iext filter #doit $ipt -s 203.177.104.72 -j DROP # Some idiot probes my ssh #doit $ipt -d 203.177.104.72 -j DROP # Some idiot probes my ssh doit $ipt -m state --state ESTABLISHED,RELATED -j RETURN # FTP data etc is ok if test "$ext_open_tcp"; then portlist="${ext_open_tcp// /,}" doit $ipt -p tcp -m multiport --dports $portlist -j RETURN fi doit $ipt -p tcp -j REJECT # Anything else isn't ok. REJECT = irc opens faster # (it probes proxy ports, DROP will incur timeout delays) ipt="iptables -t filter -A INPUT" doit $ipt -i $extif -j iext echo; echo "* Enabling forwarding" echo 1 >/proc/sys/net/ipv4/ip_forward echo "/proc/sys/net/ipv4/ip_forward: `cat /proc/sys/net/ipv4/ip_forward`" # Signal everybody that firewall is up date '+%Y-%m-%d %H:%M:%S' >"$rundir/up" # Ok, spew out gobs of info and disable ourself echo; echo "* IP:" ip a l echo; echo "* Routing:" ip r l echo; echo "* Firewall:" { echo '---FILTER--'; iptables -v -L -x -n; echo '---NAT-----'; iptables -t nat -v -L -x -n; echo '---MANGLE--'; iptables -t mangle -v -L -x -n; } \ | grep -v '^$' | grep -Fv 'bytes target' echo echo "* End of firewall configuration"