Forum Debian Users Gang

#!/bin/bash

#set -x
SSH=`cat /etc/ssh/sshd_config | grep ^Port | cut -d' ' -f2`
INTERNET_ETH="eth0"
LAN_ETH="eth1"
INTERNET_IP="xx.xx.xx.xx"
HPORTS="135:tcp 137:udp 138:udp 139:udp 137:tcp 138:tcp 139:tcp 445:tcp"

iptables -F -t filter
iptables -X -t filter
iptables -F -t nat
iptables -X -t nat
iptables -F -t mangle
iptables -X -t mangle
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT



# Blokowanie polaczen NEW z flaga inna niz syn
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
# Odrzucanie pakietow pofragmentowanych
iptables -A INPUT -f -j DROP
iptables -A FORWARD -f -j DROP
# Odrzucanie polaczen w stanie INVALID
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A FORWARD -m state --state INVALID -j DROP

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#for i in $HPORTS
#      do
#      PORT=`echo $i | cut -d':' -f1`
#      PROTO=`echo $i | cut -d':' -f2`
#
#    iptables -A FORWARD -i $INTERNET_ETH -p $PROTO --dport $PORT -j ACCEPT
#    iptables -A FORWARD -o $INTERNET_ETH -p $PROTO --dport $PORT -j ACCEPT
#done

iptables -A INPUT -i $INTERNET_ETH -s 172.30.31.2/24 -p tcp -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -s 172.30.31.2/24 -p udp -j ACCEPT
for i in $LAN_ETH
do
iptables -A INPUT -p tcp -i $i -j ACCEPT
iptables -A INPUT -p udp -i $i -j ACCEPT
done
iptables -A INPUT -i $INTERNET_ETH -p tcp --dport 9981  -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p udp --dport 9981  -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p tcp --dport 9982  -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p udp --dport 9982  -j ACCEPT

iptables -A INPUT -i $INTERNET_ETH -p tcp --dport 6080  -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p udp --dport 6080  -j ACCEPT

iptables -A INPUT -i $INTERNET_ETH -p tcp --dport 2001:2010 -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p tcp --dport 90 -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p udp --dport 2001:2010 -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p tcp --dport 4000 -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p tcp --dport $SSH -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p tcp --dport 444 -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p tcp --dport 4500:4900 -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p tcp --dport 5418 -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p tcp --dport 993 -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p udp --dport 53 -j ACCEPT
iptables -A INPUT -i $INTERNET_ETH -p tcp --dport 80 -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
iptables -A INPUT -p icmp -j ACCEPT

iptables -t nat -A PREROUTING -d xx.xx.xx.xx -p tcp --dport 6080 -j DNAT --to 172.30.30.60:22
iptables -t nat -A PREROUTING -d xx.xx.xx.xx -p udp --dport 6080 -j DNAT --to 172.30.30.60:22

iptables -A FORWARD -s 172.30.30.0/24 -d 0/0 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -s 172.30.30.0/24 -o eth0 -j MASQUERADE
#####################################################

echo "NAT i Firewall uruchomiony"