Forum Debian Users Gang

#!/bin/bash

# iptables setup on a local pc
# dropping all traffic not going trough vpn
# allowes traffic in local area network
FW="/sbin/iptables"
LCL="192.168.0.0/24"
#all interfaces from which we will be able to connect to VPN
local_interfaces=(eth0 wlan0)
virtual_interface="tun0"
#BolehVPN fully routed servers
servers=(
    212.117.176.2 #BR4 (LUX)
    94.242.213.5 #BRLU01 (LUX)
    94.242.213.5 #BRLU02 (LUX)
    94.242.213.6 #BRLU03 (LUX)
    62.212.85.79 #Netherlands
    62.212.73.132 #Netherlands
    46.29.250.191 #Sweden
    46.19.137.130 #Switzerland
    46.19.137.131 #Switzerland
    217.168.16.25 #UK
    91.216.197.26 #UK
    204.12.215.234 #USA
)


#---------------------------------------------------------------
# Remove old rules and tables
#---------------------------------------------------------------
echo "Deleting old iptables rules..."
#deleting all previous rules for all tables
iptables -F
#delete all previous user defined rules for all tables
iptables -X
#deleting all previous rules for nat table
iptables -t nat -F
#delete all previous user defined rules for nat table
iptables -t nat -X
#deleting all previous rules for mangle table
iptables -t mangle -F
#delete all previous user defined rules for mangle table
iptables -t mangle -X

echo "Setting up new rules..."
#---------------------------------------------------------------
# Default Policy - Drop anything!
#---------------------------------------------------------------
#drop all packeges that come in PC
$FW -P INPUT DROP
#drop all packeges that are routed using PC
$FW -P FORWARD DROP
#drop all packeges that from PC
$FW -P OUTPUT DROP

#---------------------------------------------------------------
# Allow all local connections via loopback.
#---------------------------------------------------------------
$FW -A INPUT  -i lo  -j ACCEPT
$FW -A OUTPUT -o lo  -j ACCEPT

#---------------------------------------------------------------
# Allow Multicast for local network. what this is for?
#---------------------------------------------------------------
for interface in ${local_interfaces[*]}
do
    $FW -A INPUT  -j ACCEPT -p igmp -s $LCL -d 224.0.0.0/4 -i $interface
    $FW -A OUTPUT -j ACCEPT -p igmp -s $LCL -d 224.0.0.0/4 -o $interface
done

#---------------------------------------------------------------
# Allow all bidirectional traffic from your firewall to the
# local area network
#---------------------------------------------------------------
for interface in ${local_interfaces[*]}
do
    $FW -A INPUT  -j ACCEPT -s $LCL -i $interface
    $FW -A OUTPUT -j ACCEPT -d $LCL -o $interface
done
#---------------------------------------------------------------
# Allow all bidirectional traffic from your firewall to the
# virtual privat network
#---------------------------------------------------------------
$FW -A INPUT  -j ACCEPT -i $virtual_interface
$FW -A OUTPUT -j ACCEPT -o $virtual_interface

#---------------------------------------------------------------
# Connection to BolehVPN servers (UDP 443) through all interfaces
#---------------------------------------------------------------
server_count=${#servers[@]}
for (( c = 0; c < $server_count; c++ ))
do
    for interface in ${local_interfaces[*]}
    do
        $FW -A INPUT  -j ACCEPT -p udp -s ${servers[c]} --sport 443 -i $interface
        $FW -A OUTPUT -j ACCEPT -p udp -d ${servers[c]} --dport 443 -o $interface
    done
done

#---------------------------------------------------------------
# Log all dropped packages, debug only.
# View in /var/log/syslog or /var/log/messages
#---------------------------------------------------------------
#iptables -N logging
#iptables -A INPUT -j logging
#iptables -A OUTPUT -j logging
#iptables -A logging -m limit --limit 2/min -j LOG --log-prefix "IPTables general: " --log-level 7
#iptables -A logging -j DROP