IP-Tables (rc.firewall)

Esconder código-fonte

#!/bin/bash

#limpando tabelas
iptables -F &&
iptables -X &&
iptables -t nat -F &&
iptables -t nat -X &&

#liberando acesso interno da rede
iptables -A INPUT -p tcp --syn -s 192.168.1.0/255.255.255.0 -j ACCEPT &&
iptables -A OUTPUT -p tcp --syn -s 192.168.1.0/255.255.255.0 -j ACCEPT &&
iptables -A FORWARD -p tcp --syn -s 192.168.1.0/255.255.255.0 -j ACCEPT &&

#liberando loopback
iptables -A INPUT -s 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -s 127.0.0.1 -j ACCEPT
iptables -A FORWARD -s 127.0.0.1 -j ACCEPT

#compartilhando a web na rede interna
#iptables -t nat -A POSTROUTING -s 192.168.1.0/255.255.255.0 -o eth0 -j MASQUERADE &&
echo 1 > /proc/sys/net/ipv4/ip_forward &&

# Protecao contra port scanners ocultos
iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -s 0.0.0.0/0 -p icmp -j DROP

# Bloqueando tracertroute
iptables -A INPUT -p udp -s 0/0 -i eth0 --dport 33435:33525 -j DROP

#Protecoes contra ataques
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -p tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP

#Ping da morte
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

# Porta Wincrash
iptables -A INPUT -p tcp --dport 5042 -j LOG --log-prefix "Serviço: Wincrash"

#Portas NetBus
iptables -A INPUT -p tcp --dport 12345 -j LOG --log-prefix "Serviço: NetBus"

#Proteção contra Syn-floods
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT

#Regras de Mascaramento

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
iptables -A FORWARD -i ppp0 -j ACCEPT
iptables -A INPUT -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT


#Proteção Contra IP Spoofing
iptables -A INPUT -s 10.0.0.0/8 -i eth0 -j DROP
iptables -A INPUT -s 172.16.0.0/16 -i eth0 -j DROP
iptables -A INPUT -s 192.168.0.0/24 -i eth0 -j DROP 


#Carregando iptables
modprobe ip_tables
modprobe iptable_filter
modprobe iptable_mangle
modprobe iptable_nat
modprobe ipt_MASQUERADE