o.open/Office_Networks
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
master
Office_Networks/WF/ipt-firewall.WF

1021 lines
30 KiB
Bash
Executable File
Raw Permalink Blame History

#!/bin/sh
### BEGIN INIT INFO
# Provides: ipt-firewall
# Required-Start: $local_fs $remote_fs $syslog $network
# Required-Stop: $local_fs $remote_fs $syslog $network
# Should-Start:
# Should-Stop:
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: IPv4 Firewall
### END INIT INFO
ipt="/sbin/iptables"
## - local interfaces
## -
local_if_1="eth1+"
wlan_if="eth2+"
vdsl_if="eth0"
vdsl_modem_ip="192.168.16.250"
## - extern interfaces
ext_if="ppp+"
#ext_if="eth0"
vpn_if="tun+"
## - besondere ip's
drucker_brother_5890_ip="192.168.52.179"
## - usv
usv_ip=192.168.52.15/32
# unpriviligierte Ports
unprivports="1024:65535"
loopback="127.0.0.0/8"
priv_class_a="10.0.0.0/8"
priv_class_b="172.16.0.0/12"
priv_class_c="192.168.0.0/16"
#Load module for FTP Connection tracking and NAT
modprobe ip_conntrack > /dev/null 2>&1
modprobe ip_nat_ftp > /dev/null 2>&1
modprobe ip_conntrack_ftp > /dev/null 2>&1
modprobe iptable_nat > /dev/null 2>&1
## - IP Forwarding aktivieren
## -
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 5 > /proc/sys/net/ipv4/ip_dynaddr
## - Reduce DoS'ing ability by reducing timeouts
## -
echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_time
echo 1 > /proc/sys/net/ipv4/tcp_window_scaling
echo 0 > /proc/sys/net/ipv4/tcp_sack
echo 1280 > /proc/sys/net/ipv4/tcp_max_syn_backlog
## - SYN COOKIES
## -
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
## - Schutz gegen gefälschte Fehlermeldungen einschalten.
## -
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
## - Ignorieren von broadcast Pings
## -
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
## - NO SOURCE ROUTE
## -
## - Sperren von quellbasierendem Paket-Routing
## -
for asr in /proc/sys/net/ipv4/conf/*/accept_source_route; do
echo 0 > $asr
done
## - Keine ICMP Umleitungspakete akzeptieren.
## -
## - Diese können zur Veränderung der Routing Tables verwendet
## - werden, möglicherweise mit einem böswilligen Ziel.
## -
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
## - ANTISPOOFING
## -
## - Reverse Pfadfilterung aktivieren. Dies hilft durch automatisches Ablehnen
## - von Quelladressen, die nicht mit dem Netzwerkinterface übereinstimmen,
## - sicherzustellen, dass Pakete legitime Quelladressen benutzen. Dies hat
## - Sicherheitsvorteile, da es IP Spoofing verhindert. Wir müssen es für
## - alle net/ipv4/conf/* aktivieren, da sonst die Validierung der Quelle
## - nicht voll funktionsfähig ist.
## -
for rp_filter in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $rp_filter
done
## - NUMBER OF CONNECTIONS TO TRACK
## -
echo "65535" > /proc/sys/net/ipv4/netfilter/ip_conntrack_max
## - Protokollieren von Paketen die gespoofed sind, quellbasierendes
## - Routing verwenden oder Umleitungen sind.
## -
#echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
while read p; do
case $p in
-*) $ipt $p;;
esac
done << EOR
## - default policies
## -
-P INPUT ACCEPT
-P OUTPUT ACCEPT
#-P FORWARD DROP
-P FORWARD ACCEPT
## - flush chains
## -
-F
-F INPUT
-F OUTPUT
-F FORWARD
-F -t mangle
-F -t nat
-X
-Z
-t nat -A POSTROUTING -o $ext_if -j MASQUERADE
#-t nat -A POSTROUTING -o eth0 -j MASQUERADE
#-t nat -A POSTROUTING -o $wlan_if -j MASQUERADE
-I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
EOR
## - owncloud lokales Netz
## -
$ipt -A FORWARD -i $wlan_if -p all -d 192.168.43.10 -j ACCEPT
$ipt -A FORWARD -i $local_if_1 -p all -d 192.168.43.10 -j ACCEPT
$ipt -t nat -A PREROUTING -p tcp --syn \
--dport 8443 -j DNAT --to 192.168.43.10:443
$ipt -t filter -A FORWARD -p tcp --dport 443 -d 192.168.43.10 \
-o $local_if_1 -j ACCEPT
## -
## - Ende: owncloud lokales Netz
## - Protection against syn-flooding
## -
## - chains to DROP too many SYNs
## -
#$ipt -N syn-flood
#$ipt -A syn-flood -m limit --limit 100/second --limit-burst 150 -j RETURN
#$ipt -A syn-flood -m limit --limit 1/second --limit-burst 3 -j RETURN
#$ipt -A syn-flood -j LOG --log-prefix "SYN flood: " --log-level debug
#$ipt -A syn-flood -j DROP
## - drop new packages without syn flag
## -
## - first log
## -
#$ipt -A INPUT -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New but not SYN: " --log-level debug
#$ipt -A OUTPUT -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New but not SYN: " --log-level debug
#$ipt -A FORWARD -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New but not SYN: " --log-level debug
$ipt -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
$ipt -A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP
$ipt -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
## - drop invalid packages
## -
#$ipt -A INPUT -m state --state INVALID -j LOG --log-prefix "Invalid state: " --log-level debug
#$ipt -A INPUT -m state --state INVALID -j DROP
## - ungewöhnliche Flags verwerfen
## -
#$ipt -A INPUT -i eth0 -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j LOG --log-prefix "Invalid flasg: " --log-level debug
#$ipt -A INPUT -i eth0 -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOG --log-prefix "Invalid flasg: " --log-level debug
#$ipt -A INPUT -i eth0 -p tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "Invalid flasg: " --log-level debug
$ipt -A INPUT -i eth0 -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
$ipt -A INPUT -i eth0 -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$ipt -A INPUT -i eth0 -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
## - private Adressen auf externen interface verwerfen
## -
#$ipt -A INPUT -i $ext_if -s $priv_class_a -j LOG --log-prefix "Private address: " --log-level debug
#$ipt -A INPUT -i $ext_if -s $priv_class_b -j LOG --log-prefix "Private address: " --log-level debug
#$ipt -A INPUT -i $ext_if -s $priv_class_c -j LOG --log-prefix "Private address: " --log-level debug
#$ipt -A INPUT -i $ext_if -s $loopback -j LOG --log-prefix "Private address: " --log-level debug
#$ipt -A OUTPUT -o $ext_if -s $priv_class_a -j LOG --log-prefix "Private address: " --log-level debug
#$ipt -A OUTPUT -o $ext_if -s $priv_class_b -j LOG --log-prefix "Private address: " --log-level debug
#$ipt -A OUTPUT -o $ext_if -s $priv_class_c -j LOG --log-prefix "Private address: " --log-level debug
#$ipt -A OUTPUT -o $ext_if -s $loopback -j LOG --log-prefix "Private address: " --log-level debug
$ipt -A INPUT -i $ext_if -s $priv_class_a -j DROP
$ipt -A INPUT -i $ext_if -s $priv_class_b -j DROP
#$ipt -A INPUT -i $ext_if -s $priv_class_c -j DROP
#$ipt -A INPUT -i $ext_if -s $loopback -j DROP
$ipt -A OUTPUT -o $ext_if -s $priv_class_a -j DROP
$ipt -A OUTPUT -o $ext_if -s $priv_class_b -j DROP
#$ipt -A OUTPUT -o $ext_if -s $priv_class_c -j DROP
$ipt -A OUTPUT -o $ext_if -s $loopback -j DROP
# - Telekom VDSL - Rules for IPTV
# -
#$ipt -I FORWARD -s 217.0.119.0/24 -d 224.0.0.0/4 -j ACCEPT
#$ipt -I FORWARD -s 193.158.35.0/24 -d 224.0.0.0/4 -j ACCEPT
#$ipt -I FORWARD -s 239.35.0.0/16 -d 224.0.0.0/4 -j ACCEPT
#$ipt -I INPUT -d 224.0.0.0/4 -j ACCEPT
#$ipt -I FORWARD -d 224.0.0.0/4 -j ACCEPT
#$ipt -I OUTPUT -d 224.0.0.0/4 -j ACCEPT
## - if called stop, then exit here
## -
case $1 in
sto*) exit 0;;
esac
echo "Starting firewall iptables (IpV4).."
while read r; do
case $r in
-*) $ipt $r;;
esac
done << EOR
# ---------- Allnet VDSL2 Client Modem ALL126AS2 -------------
#
# make Allnet VDSL Modem available on LAN
# ip-adress: 192.168.16.250
#
# prerequisites:
# - on gateway: ifconfig eth1 192.168.16.254
# - NAT for 192.168.16.0/24
#
-t nat -A POSTROUTING -o $vdsl_if -j MASQUERADE
#
# -- Allow from local Network
-A FORWARD -i $local_if_1 -d $vdsl_modem_ip -p ALL -m state --state NEW -j ACCEPT
#
# -- Allow from VPN
-A FORWARD -i $vpn_if -d $vdsl_modem_ip -p ALL -m state --state NEW -j ACCEPT
#
# ------- Ende: Allnet VDSL2 Client Modem ALL126AS2 ----------
# ----------
# --- SSH (SVN) von php5.warenform.de -- #
#-A FORWARD -i eth1 -o eth2 -s 46.4.129.3 -d 192.168.52.35 -j ACCEPT
#-A FORWARD -i eth2 -o eth1 -s 192.168.52.35 -j ACCEPT
# --- SSH (SVN) vom "junge welt" Server --- #
#-A FORWARD -i eth1 -o eth2 -s 193.96.188.0/24 -d 192.168.52.35 -j ACCEPT
#-A FORWARD -i eth2 -o eth1 -s 192.168.52.35 -j ACCEPT
# --- SSH (SVN) von nd.warenform.de --- #
#-A FORWARD -i eth1 -o eth2 -s 46.4.78.56 -d 192.168.52.35 -j ACCEPT
#-A FORWARD -i eth2 -o eth1 -s 192.168.52.35 -j ACCEPT
# ------------- das loopbackdevice -------------
# alles erlaubt
#
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
#
# ---------- Ende: das loopbackdevice ----------
# ---------- alle Anfragen aus dem internen WLAN-Netz nach draussen -------------
#
-A FORWARD -i $wlan_if -o $ext_if -p ALL -m state --state NEW -j ACCEPT
-A FORWARD -i $local_if_1 -o $ext_if -p all -m state --state NEW -j ACCEPT
#
# ---------- Ende: alle Anfragen aus den internen Netzen nach draussen ----------
# ------------- Drucker Brother 5890 -------------
#
#
# ------------- Ende: Drucker Brother 5890 -------------
# ------------- zwischen lokalen Netzen -------------
#
# Zugriff vom localen Netz ins WLAN-Netz erlauben
-A FORWARD -i $local_if_1 -o $wlan_if -p ALL -m state --state NEW -j ACCEPT
#
#
# Zugriff vom WLAN-Netz auf Drucker erlauben
-A FORWARD -i $wlan_if -o $local_if_1 -d $drucker_brother_5890_ip -j ACCEPT
#
# Zugriff vom WLAN-Netz ins locale Netz verbieten
-A FORWARD -i $wlan_if -o $local_if_1 -p ALL -m state --state NEW -j DROP
#
# - needed because sometimes i add temporarily other networks to tha interface
#
-A FORWARD -i $local_if_1 -o $local_if_1 -p ALL -m state --state NEW -j ACCEPT
#
# vollen Zugriff vom router ins WLAN-Netz
-A OUTPUT -o $wlan_if -j ACCEPT
#
# ---------- Ende: zwischen lokalen Netzen ----------
# ------------- betsehende Verbindungen -------------
# bereits bestehende Verbindungen durchlassen
#
# -- rein --
#
-A INPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# -- raus --
#
-A OUTPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# foreward
#
-A FORWARD -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# ---------- Ende betsehende Verbindungen -----------
# ------------- grundsaetzlich ablehnen -------------
# neue Anfragen ohne das syn-Flag
#
-A INPUT -p tcp ! --syn -m state --state NEW -j DROP
-A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP
-A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
#
# reinlaufenden windows kram
#
-A INPUT -p udp -i $ext_if --dport 137:139 -j DROP
-A INPUT -p tcp -i $ext_if --dport 137:139 -j DROP
-A INPUT -p tcp -i $ext_if --dport 445 -j DROP
#
-A INPUT -p udp -i $local_if_1 --dport 137:139 -j DROP
-A INPUT -p tcp -i $local_if_1 --dport 137:139 -j DROP
-A INPUT -p tcp -i $local_if_1 --dport 445 -j DROP
#
-A INPUT -p udp -i $wlan_if --dport 137:139 -j DROP
-A INPUT -p tcp -i $wlan_if --dport 137:139 -j DROP
-A INPUT -p tcp -i $wlan_if --dport 445 -j DROP
#
# authentication tap ident
#
-A INPUT -p tcp -i $ext_if --dport 113 -j REJECT --reject-with tcp-reset
#
#
# Location Service
#
-A INPUT -p tcp -i $ext_if --dport 135 -j DROP
-A INPUT -p udp -i $ext_if --dport 135 -j DROP
#
# ---------- Ende: grundsaetzlich ablehnen -------------
#############################################################
# ----------------- Konfiguration VPN ------------------ #
# -- initial via internet
#
-A INPUT -p udp -i $ext_if --dport 1194 -m state --state NEW -j ACCEPT
-A INPUT -p udp -i $ext_if --dport 1195 -m state --state NEW -j ACCEPT
#
# -- initial via lan1
-A INPUT -p udp -i $local_if_1 --dport 1194 -m state --state NEW -j ACCEPT
#
# -- initial via lan2
-A INPUT -p udp -i $wlan_if --dport 1194 -m state --state NEW -j ACCEPT
#
# ausgehende Anfragen
#
-A OUTPUT -o $ext_if -p udp --dport 1194 -m state --state NEW -j ACCEPT
#
# forward
#
-A FORWARD -o $ext_if -p udp --dport 1194 -m state --state NEW -j ACCEPT
#
# -- alles via vpn device zulassen/durchrouten
#
-A INPUT -i $vpn_if -j ACCEPT
-A OUTPUT -o $vpn_if -j ACCEPT
-A FORWARD -i $vpn_if -j ACCEPT
-A FORWARD -o $vpn_if -j ACCEPT
# ------------ Ende Konfiguration VPN -------------------- #
#############################################################
# ------------- PowerChute Shutdown APC -------------
#
-A INPUT -p ALL -i $local_if_1 -s 192.168.52.15 -j ACCEPT
-A OUTPUT -p ALL -o $local_if_1 -d 192.168.52.15 -j ACCEPT
#
#-A INPUT -i $local_if_1 -p tcp --dport 3052 -m state --state NEW -j ACCEPT
#-A INPUT -i $local_if_1 -p udp --dport 3052 -m state --state NEW -j ACCEPT
#-A INPUT -i $local_if_1 -p tcp --dport 6547 -m state --state NEW -j ACCEPT
#
-A OUTPUT -o $local_if_1 -p tcp --dport 80 -m state --state NEW -j ACCEPT
#
#
# ---------- Ende PowerChute Shutdown APC -----------
# ------------- DNS -------------
#
# nameserver
#
# -- rein --
#
-A INPUT -i $local_if_1 -p udp --dport 53 -m state --state NEW -j ACCEPT
-A INPUT -i $local_if_1 -p tcp --dport 53 -m state --state NEW -j ACCEPT
-A INPUT -i $wlan_if -p udp --dport 53 -m state --state NEW -j ACCEPT
-A INPUT -i $wlan_if -p tcp --dport 53 -m state --state NEW -j ACCEPT
#
# -- raus --
#
-A OUTPUT -o $ext_if -p udp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -o $ext_if -p tcp --dport 53 -m state --state NEW -j ACCEPT
#
# -- forward --
#
-A FORWARD -o $ext_if -p udp --dport 53 -m state --state NEW -j ACCEPT
-A FORWARD -o $ext_if -p tcp --dport 53 -m state --state NEW -j ACCEPT
#
# ---------- Ende DNS -----------
# ------------- SSH -------------
# reingehende Anfragen
#
-A INPUT -i $ext_if -p tcp --syn --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -i $local_if_1 -p tcp --syn --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -i $wlan_if -p tcp --syn --dport 22 -m state --state NEW -j ACCEPT
#
# ausgehende Anfragen
#
-A OUTPUT -o $ext_if -p tcp --syn --dport 22 -m state --state NEW -j ACCEPT
-A OUTPUT -o $local_if_1 -p tcp --dport 22 -m state --state NEW -j ACCEPT
-A OUTPUT -o $wlan_if -p tcp --dport 22 -m state --state NEW -j ACCEPT
#
-A FORWARD -o $ext_if -p tcp --syn --dport 22 -m state --state NEW -j ACCEPT
-A FORWARD -o $local_if_1 -p tcp --syn --dport 22 -m state --state NEW -j ACCEPT
-A FORWARD -o $wlan_if -p tcp --syn --dport 22 -m state --state NEW -j ACCEPT
#
# ---------- Ende SSH ------------
# ------------- DHCP -------------
# reingehende Anfragen
#
-A INPUT -p udp -i $local_if_1 -s 0/0 --sport 68 -d 255.255.255.255 --dport 67 -j ACCEPT
-A INPUT -p udp -i $wlan_if -s 0/0 --sport 68 -d 255.255.255.255 --dport 67 -j ACCEPT
#
# ausgehende Anfragen
#
-A OUTPUT -p udp -o $local_if_1 --sport 67 -d 0/0 --dport 68 -j ACCEPT
-A OUTPUT -p udp -o $wlan_if --sport 67 -d 0/0 --dport 68 -j ACCEPT
#
# ---------- Ende DHCP ------------
# ------------- MAIL -------------
# rausgehende SMTP-Verbindungen akzeptieren
#
-A OUTPUT -p tcp -o $ext_if --dport 25 -m state --state NEW -j ACCEPT
#
# ansonsten nur forward
#
# smtp
-A FORWARD -p tcp --syn -o $ext_if --dport 25 -m state --state NEW -j ACCEPT
-A FORWARD -p tcp --syn -o $ext_if --dport 587 -m state --state NEW -j ACCEPT
#
# smtps
-A FORWARD -p tcp --syn -o $ext_if --dport 465 -m state --state NEW -j ACCEPT
#
# pop
-A FORWARD -p tcp --syn -o $ext_if --dport 110 -m state --state NEW -j ACCEPT
#
# pop/ssl
-A FORWARD -p tcp --syn -o $ext_if --dport 995 -m state --state NEW -j ACCEPT
#
# imap
-A FORWARD -p tcp --syn -o $ext_if --dport 143 -m state --state NEW -j ACCEPT
#
# imap/ssl
-A FORWARD -p tcp --syn -o $ext_if --dport 993 -m state --state NEW -j ACCEPT
#
# ---------- Ende MAIL -----------
# ------------- HTTP -------------
# rausgehende Verbindungen vom Gateway akzeptieren
# ( update clamav/freshclam, dyndns )
#
-A OUTPUT -p tcp --syn -o $ext_if --dport 80 -m state --state NEW -j ACCEPT
#
# ansonsten nur forward
#
-A FORWARD -p tcp --syn -o $ext_if --dport 80 -m state --state NEW -j ACCEPT
-A FORWARD -p tcp --syn -o $ext_if --dport 443 -m state --state NEW -j ACCEPT
#
-A FORWARD -p tcp --syn -o $ext_if --dport 8000:8180 -m state --state NEW -j ACCEPT
-A FORWARD -p tcp --syn -o $ext_if --dport 8443 -m state --state NEW -j ACCEPT
#
# ---------- Ende HTTP -----------
# ------------- FTP -------------
#
# ftp ( lokaler Client remote ftp-Server )
#
# (Datenkanal aktiv)
-A INPUT -i $ext_if -p tcp --sport 20 -m state --state NEW -j ACCEPT
-A FORWARD -i $ext_if -p tcp --sport 20 -m state --state NEW -j ACCEPT
#
# (Datenkanal passiv)
-A OUTPUT -o $ext_if -p tcp --sport $unprivports --dport $unprivports -m state --state NEW -j ACCEPT
-A FORWARD -o $ext_if -p tcp --sport $unprivports --dport $unprivports -m state --state NEW -j ACCEPT
#
# (Kontrollverbindung)
-A OUTPUT -o $ext_if -p tcp --dport 21 -m state --state NEW -j ACCEPT
-A FORWARD -o $ext_if -p tcp --dport 21 -m state --state NEW -j ACCEPT
#
# ftp (Server)
#
# Datenkanal (aktiver modus)
#-A OUTPUT -o $ext_if -p tcp --sport 20 -m state --state NEW -j ACCEPT
#
# Datenkanal (passiver modus)
#-A INPUT -i $ext_if -p tcp --dport $unprivports --sport $unprivports -m state --state NEW -j ACCEPT
#
# - Kontrollverbindung
#-A INPUT -i $ext_if -p tcp --dport 21 --sport $unprivports -m state --state NEW -j ACCEPT
#
# ftp-tls ? ( keine Ahnung warum )
#
-A OUTPUT -p tcp --sport $unprivports -o $ext_if -m state --state NEW -j ACCEPT
-A FORWARD -p tcp --sport $unprivports -i $ext_if -o $ext_if -m state --state NEW -j ACCEPT
#
# ---------- Ende FTP -----------
# ------------- NTP -------------
# (network time protokoll)
#
# rein
#
-A INPUT -i $local_if_1 -p udp --sport 123 -m state --state NEW -j ACCEPT
-A INPUT -i $wlan_if -p udp --sport 123 -m state --state NEW -j ACCEPT
#
# raus
#
-A OUTPUT -o $ext_if -p udp --dport 123 -m state --state NEW -j ACCEPT
#
# forward
#
-A FORWARD -o $ext_if -p udp --dport 123 -m state --state NEW -j ACCEPT
#
# ---------- Ende NTP -----------
# ------------- pgpkeyserver -------------
#
#
-A OUTPUT -p tcp -o $ext_if --dport 11371 -m state --state NEW -j ACCEPT
-A FORWARD -p tcp -o $ext_if --dport 11371 -m state --state NEW -j ACCEPT
#
# ---------- Ende pgpkeyserver ------------
# ------------- ldap / (z.Bsp. einige pgpkeyserver) -------------
#
# Forward -- nur Anfragen nach draussen
#
-A FORWARD -p tcp --syn -o $ext_if --dport 389 -m state --state NEW -j ACCEPT
-A FORWARD -p udp -o $ext_if --dport 389 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp --syn -o $ext_if --dport 389 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -o $ext_if --dport 389 -m state --state NEW -j ACCEPT
#
# ldaps LDAP over SSL
#
-A FORWARD -p tcp --syn -o $ext_if --dport 636 -m state --state NEW -j ACCEPT
-A FORWARD -p udp -o $ext_if --dport 636 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp --syn -o $ext_if --dport 636 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -o $ext_if --dport 636 -m state --state NEW -j ACCEPT
#
# ---------- Ende ldap ------------
# ------------- Newsserver nntp -------------
#
# Forward -- nur Anfragen nach draussen
#
-A FORWARD -p tcp --syn -o $ext_if --dport 119 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp --syn -o $ext_if --dport 119 -m state --state NEW -j ACCEPT
#
# ---------- Ende Newsserver nntp ------------
# ------------- Whois -------------
# nur ausgehende Anfragen und forward
#
#
-A OUTPUT -o $ext_if -p tcp --dport 43 -m state --state NEW -j ACCEPT
-A FORWARD -o $ext_if -p tcp --dport 43 -m state --state NEW -j ACCEPT
#
# ---------- Ende Whois -----------
# ------------- CPAN Wait - Server -------------
# nur ausgehende Anfragen und forward
#
#
-A OUTPUT -o $ext_if -p tcp --dport 1404 -m state --state NEW -j ACCEPT
-A FORWARD -o $ext_if -p tcp --dport 1404 -m state --state NEW -j ACCEPT
#
# ---------- CPAN Wait - Server -----------
# ------------- CVS -------------
# nur ausgehende Anfragen und forward
#
-A OUTPUT -o $ext_if -p udp --dport 2401 -m state --state NEW -j ACCEPT
-A FORWARD -o $ext_if -p udp --dport 2401 -m state --state NEW -j ACCEPT
-A FORWARD -i $ext_if -p udp --dport 2401 -m state --state NEW -j ACCEPT
#
# und weils auch manchmal übers tcp-Prozokoll geht
#
-A OUTPUT -o $ext_if -p tcp --dport 2401 -m state --state NEW -j ACCEPT
-A FORWARD -o $ext_if -p tcp --dport 2401 -m state --state NEW -j ACCEPT
-A FORWARD -i $ext_if -p tcp --dport 2401 -m state --state NEW -j ACCEPT
#
# ---------- Ende CVS -----------
# ------------- ICP (icpcon raid-control util) -------------
#
# reingehende Anfragen
#
#-A INPUT -p tcp --syn -i $ext_if --dport 11798 -m state --state NEW -j ACCEPT
#
# rausgehende Anfragen
#
#-A OUTPUT -p tcp -o $ext_if --dport 11798 -m state --state NEW -j ACCEPT
#-A FORWARD -p tcp -o $ext_if --dport 11798 -m state --state NEW -j ACCEPT
#
# ---------- ENDE: ICP (icpcon raid-control util) ----------
# ------------- Chat -------------
# --- silc ---
#
# Forward und Anfragen nach draussen
#
-A FORWARD -p tcp --syn -o $ext_if --dport 706 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp --syn -o $ext_if --dport 706 -m state --state NEW -j ACCEPT
#
# --- irc ---
#
# forward und Anfragen nach draussen
#
-A FORWARD -p tcp --syn -o $ext_if --dport 194 -m state --state NEW -j ACCEPT
-A FORWARD -p udp -o $ext_if --dport 194 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp --syn -o $ext_if --dport 194 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -o $ext_if --dport 194 -m state --state NEW -j ACCEPT
#
# --- jabber ---
#
-A FORWARD -p tcp --syn -o $ext_if --dport 5222 -m state --state NEW -j ACCEPT
-A FORWARD -p tcp --syn -o $ext_if --dport 5223 -m state --state NEW -j ACCEPT
#
# ---------- Ende chat ------------
# ------------- HBCI -------------
# hbci - port 3000/tcp
#
-A FORWARD -o $ext_if -p tcp --syn --dport 3000 -m state --state NEW -j ACCEPT
#
# ---------- Ende HBCI -----------
# ------------- Hylafax (Port 4559) -------------
# reingehende Verbindungen zum Hylafax-Server
#
-A INPUT -i $local_if_1 -p tcp --dport 4559 -m state --state NEW -j ACCEPT
-A INPUT -i $wlan_if -p tcp --dport 4559 -m state --state NEW -j ACCEPT
#
# ---------- Ende Hylafax -----------
# ------------- CUPS -------------
# (cupssys printer system)
#
-A FORWARD -i $local_if_1 -p tcp --dport 631 -m state --state NEW -j ACCEPT
-A FORWARD -i $wlan_if -p tcp --dport 631 -m state --state NEW -j ACCEPT
#
# ---------- Ende CUPS -----------
# ------------- Drucken Port 9100 -------------
#
-A FORWARD -i $local_if_1 -p tcp --dport 9100 -m state --state NEW -j ACCEPT
-A FORWARD -i $wlan_if -p tcp --dport 9100 -m state --state NEW -j ACCEPT
#
# ---------- Ende Drucken Port 9100 -----------
# ---------- SNMP ----------
#
#-A FORWARD -i $local_if_1 -p tcp --dport 161 -m state --state NEW -j ACCEPT
#-A FORWARD -i $wlan_if -p tcp --dport 161 -m state --state NEW -j ACCEPT
#
# ---------- SNMP ----------
# ------------- VOIP -------------
#
# SIP
#
# Standard:
# Port: 5060 / UDP (SIP-Signalisierung)
# Port: 5004 / UDP (RTP, Sprache)
# Port: 10000 UDP (STUN)
#
# X-Lite:
# Port 5060 / UDP
# Port 8000 - 8019 / UDP
# Port 10000 /UDP
# reingehende Anfragen
#
-A INPUT -p tcp --syn -i $ext_if --dport 5060 -j ACCEPT
-A INPUT -p udp -i $ext_if --dport 5060 -j ACCEPT
#
# ausgehende Anfragen
#
-A OUTPUT -p tcp --syn -o $ext_if --dport 5060 -j ACCEPT
-A OUTPUT -p udp -o $ext_if --dport 5060 -j ACCEPT
#
# Forward -- nur Anfragen nach draussen
#
-A FORWARD -p tcp --syn -o $ext_if --dport 5060 -j ACCEPT
-A FORWARD -p udp -o $ext_if --dport 5060 -j ACCEPT
-A FORWARD -p udp -i $ext_if --dport 5060 -j ACCEPT
-A FORWARD -p udp -o $ext_if --dport 5004 -j ACCEPT
-A FORWARD -p udp -i $ext_if --dport 5004 -j ACCEPT
-A FORWARD -p tcp --syn -o $ext_if --dport 10000 -j ACCEPT
-A FORWARD -p udp -o $ext_if --dport 10000 -j ACCEPT
-A FORWARD -p udp -i $ext_if --dport 10000 -j ACCEPT
-A FORWARD -p udp -o $ext_if --sport 8000:8019 -j ACCEPT
-A FORWARD -p udp -i $ext_if --sport 8000:8019 -j ACCEPT
-A FORWARD -p udp -o $ext_if --sport 32700:32799 -j ACCEPT
#
# Skype
#
# reingehende Anfragen
#
# -A INPUT -p tcp --syn -i $ext_if --dport 54196 -j ACCEPT
# -A INPUT -p udp -i $ext_if --dport 54196 -j ACCEPT
#
# ausgehende Anfragen
#
#
# Forward -- Anfragen von draussen
#
# -- Linux
-A FORWARD -p tcp --syn -i $ext_if --dport 34957 -j ACCEPT
-A FORWARD -p tcp --syn -o $ext_if --sport 34957 -j ACCEPT
-A FORWARD -p udp -i $ext_if --dport 34957 -j ACCEPT
-A FORWARD -p udp -o $ext_if --sport 34957 -j ACCEPT
# -- Windows --
-A FORWARD -p tcp --syn -i $ext_if --dport 54196 -j ACCEPT
-A FORWARD -p tcp --syn -o $ext_if --dport 54196 -j ACCEPT
-A FORWARD -p udp -i $ext_if --dport 54196 -j ACCEPT
-A FORWARD -p udp -o $ext_if --sport 54196 -j ACCEPT
#
# ---------- Ende VOIP ------------
# ------------- Traceroute -------------
#
# rein
-A OUTPUT -p udp --dport 33434:33530 -o $local_if_1 -j ACCEPT
-A OUTPUT -p udp --dport 33434:33530 -o $wlan_if -j ACCEPT
-A OUTPUT -p udp --dport 33434:33530 -o $ext_if -j ACCEPT
#
# raus
-A INPUT -p udp --dport 33434:33530 -i $local_if_1 -j ACCEPT
-A INPUT -p udp --dport 33434:33530 -i $wlan_if -j ACCEPT
# forward
-A FORWARD -p udp --dport 33434:33530 -o $ext_if -j ACCEPT
#
# -------- Ende Traceroute -------------
# ------------ ICMP (u.a. Ping) ------------
# alle ICMP Pakete zulassen
#
-A OUTPUT -o $local_if_1 -p icmp -j ACCEPT
-A OUTPUT -o $wlan_if -p icmp -j ACCEPT
-A OUTPUT -o $ext_if -p icmp -j ACCEPT
-A OUTPUT -o $vdsl_if -p icmp -j ACCEPT
#
-A INPUT -i $local_if_1 -p icmp -j ACCEPT
-A INPUT -i $wlan_if -p icmp -j ACCEPT
-A INPUT -i $ext_if -p icmp -j ACCEPT
-A INPUT -i $vdsl_if -p icmp -j ACCEPT
#
-A FORWARD -p icmp -o $ext_if -j ACCEPT
-A FORWARD -p icmp -i $local_if_1 -j ACCEPT
-A FORWARD -p icmp -i $wlan_if -j ACCEPT
-A FORWARD -p icmp -o $vdsl_if -j ACCEPT
#
# ------- Ende Ping ------------
# ------------- portmapper (mountd und NFS) -------------
#
# -- portmapper ( udp/tcp port 111 )
#
# tcp
-A INPUT ! -i $ext_if -p tcp --dport 111 -j ACCEPT
-A FORWARD ! -i $ext_if -p tcp --dport 111 -j ACCEPT
# udp
-A INPUT ! -i $ext_if -p udp --dport 111 -j ACCEPT
-A FORWARD ! -i $ext_if -p udp --dport 111 -j ACCEPT
#
# -- mountd
# - normaly a random port number is assigned by
# the portmapper, but if you start the rpc.mountd
# (see the startscript at (/etc/init.d/nfs-kernel with
# option -p 1105 you can use the following rules:
#
# tcp
-A INPUT ! -i $ext_if -p tcp --dport 1105 -j ACCEPT
-A FORWARD ! -i $ext_if -p tcp --dport 1105 -j ACCEPT
# udp
-A INPUT ! -i $ext_if -p udp --dport 1105 -j ACCEPT
-A FORWARD ! -i $ext_if -p udp --dport 1105 -j ACCEPT
#
# -- nfs
#
-A INPUT ! -i $ext_if -p udp --dport 2049 -j ACCEPT
-A FORWARD ! -i $ext_if -p udp --dport 2049 -j ACCEPT
#
# NFS depends on ICMP on much of its communication, more detailed:
# NFS depends on ICMP Packets of type 3
#
-A INPUT ! -i $ext_if -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A FORWARD ! -i $ext_if -p icmp -m icmp --icmp-type 3 -j ACCEPT
#
-A OUTPUT ! -o $ext_if -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A FORWARD ! -i $ext_if -p icmp -m icmp --icmp-type 3 -j ACCEPT
#
# ---------- Ende: portmapper (mountd und NFS) -----------
# ------------ Portforwarding ------------- #
#
## - Schott ins interne WARENFOM Netz
#
# --- webrick - eingerichtet für vs-bdb-fe.wf.netz:3000 NUR aus ---
# -- den Schott netzen ---
#
#-t nat -A PREROUTING -i $ext_if -p tcp --syn -s 80.156.4.0/22 \
# --dport 80 -j DNAT --to 192.168.52.47:3000
#-t filter -A FORWARD -p tcp -s 80.156.4.0/22 --dport 3000 -d 192.168.52.47 \
# -i $ext_if -o $local_if_1 -j ACCEPT
#-t nat -A PREROUTING -i $ext_if -p tcp --syn -s 194.175.223.0/23 \
# --dport 80 -j DNAT --to 192.168.52.47:3000
#-t filter -A FORWARD -p tcp -s 194.175.223.0/23 --dport 3000 -d 192.168.52.47 \
# -i $ext_if -o $local_if_1 -j ACCEPT
#-t nat -A PREROUTING -i $ext_if -p tcp --syn -s 213.68.175.0/25 \
# --dport 80 -j DNAT --to 192.168.52.47:3000
#-t filter -A FORWARD -p tcp -s 213.68.175.0/25 --dport 3000 -d 192.168.52.47 \
# -i $ext_if -o $local_if_1 -j ACCEPT
#
# --- schott-demo.warenform.de:443 -> vs-bdb-fe.wf.netz:9000 ---
# -- NUR aus den Schott netzen ---
#
#-t nat -A PREROUTING -i $ext_if -p tcp --syn -s 80.156.4.0/22 \
# --dport 443 -j DNAT --to 192.168.52.46:9000
#-t filter -A FORWARD -p tcp -s 80.156.4.0/22 --dport 9000 -d 192.168.52.46 \
# -i $ext_if -o $local_if_1 -j ACCEPT
#-t nat -A PREROUTING -i $ext_if -p tcp --syn -s 194.175.223.0/23 \
# --dport 443 -j DNAT --to 192.168.52.46:9000
#-t filter -A FORWARD -p tcp -s 194.175.223.0/23 --dport 9000 -d 192.168.52.46 \
# -i $ext_if -o $local_if_1 -j ACCEPT
#-t nat -A PREROUTING -i $ext_if -p tcp --syn -s 213.68.175.0/25 \
# --dport 443 -j DNAT --to 192.168.52.46:9000
#-t filter -A FORWARD -p tcp -s 213.68.175.0/25 --dport 9000 -d 192.168.52.46 \
# -i $ext_if -o $local_if_1 -j ACCEPT
#
# --- Etherpad Intranet
# --
#
-t nat -A PREROUTING -i $ext_if -p tcp --syn \
--dport 9080 -j DNAT --to 192.168.52.24:9080
-t filter -A FORWARD -p tcp --dport 9080 -d 192.168.52.24 \
-i $ext_if -o $local_if_1 -j ACCEPT
#
-t nat -A PREROUTING -i $ext_if -p tcp --syn \
--dport 9443 -j DNAT --to 192.168.52.24:9443
-t filter -A FORWARD -p tcp --dport 9443 -d 192.168.52.24 \
-i $ext_if -o $local_if_1 -j ACCEPT
#
# --- ENDE: Etherpad Intranet
#
#
# --- HTTP ---
#
#-t nat -A PREROUTING -i $ext_if -p tcp --syn \
# --dport 8080 -j DNAT --to 192.168.52.25:8080
#-t filter -A FORWARD -p tcp --dport 8080 -d 192.168.52.35 \
# -i $ext_if -o $local_if_1 -j ACCEPT
#
# --- HTTPS ---
#
#-t nat -A PREROUTING -i $ext_if -p tcp --syn \
# --dport 8443 -j DNAT --to 192.168.42.25:443
#-t filter -A FORWARD -p tcp --dport 443 -d 192.168.42.35 \
# -i $ext_if -o $local_if_1 -j ACCEPT
#
#
# --- PPPTP ( VPN auf den NAS Server wf-nas ) --
#
#-t nat -A PREROUTING -i $ext_if -p tcp --syn \
# --dport 1723 -j DNAT --to 192.168.52.80:1723
#-t filter -A FORWARD -p tcp --dport 1723 -d 192.168.52.80 \
# -i $ext_if -o $local_if_1 -j ACCEPT
#
#
# --- SSH ( auf devel )
#
-t nat -A PREROUTING -i $ext_if -p tcp --dport 9997 -m state --state NEW -j DNAT --to 192.168.52.25:22
-t filter -A FORWARD -p tcp --dport 22 -d 192.168.52.35 -i $ext_if -o $local_if_1 -m state --state NEW -j ACCEPT
#
#
# --- SSH ( auf repos )
#
-t nat -A PREROUTING -i $ext_if -p tcp --dport 9998 -m state --state NEW -j DNAT --to 192.168.52.25:22
-t filter -A FORWARD -p tcp --dport 22 -d 192.168.52.35 -i $ext_if -o $local_if_1 -m state --state NEW -j ACCEPT
#
#
# --- SSH ( auf den Fileserver anita ) --
#
-t nat -A PREROUTING -i $ext_if -p tcp --dport 9999 -m state --state NEW -j DNAT --to 192.168.52.60:22
-t filter -A FORWARD -p tcp --dport 22 -d 192.168.52.60 -i $ext_if -o $local_if_1 -m state --state NEW -j ACCEPT
#
# ---------- Ende Portforwarding ---------- #
# ------------- Loggen -------------
#
# alles loggen was nicht durchgeht
#
#-A OUTPUT -j LOG --log-level debug
#-A INPUT -j LOG --log-level debug
#-A FORWARD -j LOG --log-level debug
# -
# ------------- Ende Loggen -------------
# ------------- DROP -------------
# drop all other for all interfaces..
#
-A INPUT -j DROP
-A OUTPUT -j DROP
-A FORWARD -j DROP
#
# ---------- Ende: DROP ----------
EOR
exit 0
Reference in New Issue View Git Blame Copy Permalink