#!/bin/sh #04/04/1999 #example rc.firewall script for the 2.0 kernels using ipfwadm #I cant take full credit for this script. I had found it a few #years ago and made slight modifications. #Send questions or comments to [email protected]. #--------------------------------------------------------------------- #Variables #--------------------------------------------------------------------- #local ethernet interface localip= localif=eth0 #static ethernet interface staticip= staticif=eth1 PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin" #--------------------------------------------------------------------- #Incoming Firewall Policies #--------------------------------------------------------------------- #flush incoming firewall policies /sbin/ipfwadm -I -f #set incoming firewall policy default to deny /sbin/ipfwadm -I -p deny #--------------------------------------------------------------------- #local interface, local machines, going anywhere is valid /sbin/ipfwadm -I -a accept -V $localip -S $localip/24 -D 0.0.0.0/0 #remote interface, claiming to be local machines (IP spoofing) deny and log /sbin/ipfwadm -I -a deny -V $staticip -S $localip/24 -D 0.0.0.0/0 -o #remote interface, any source, going to staticip address is valid /sbin/ipfwadm -I -a accept -V $staticip -S 0.0.0.0/0 -D $staticip/32 #loopback interface is valid /sbin/ipfwadm -I -a accept -V 127.0.0.1 -S 0.0.0.0/0 -D 0.0.0.0/0 #all other incoming is denied and logged /sbin/ipfwadm -I -a deny -S 0.0.0.0/0 -D 0.0.0.0/0 -o #--------------------------------------------------------------------- #Outgoing Firewall Policies #--------------------------------------------------------------------- #flush outgoing firewall policies /sbin/ipfwadm -O -f #set outgoing firewall policy default to deny /sbin/ipfwadm -O -p deny #--------------------------------------------------------------------- #local interface, any source going to local net is valid /sbin/ipfwadm -O -a accept -V $localip -S 0.0.0.0/0 -D $localip/24 #outgoing to localnet on static interface, stuffed routing, deny /sbin/ipfwadm -O -a deny -V $staticip -S 0.0.0.0/0 -D $localip/24 -o #outgoing from localnet on static interface, stuffed masquerading, deny /sbin/ipfwadm -O -a deny -V $staticip -S $localip/24 -D 0.0.0.0/0 -o #outgoing to localnet on static interface, stuffed masquerading, deny /sbin/ipfwadm -O -a deny -V $staticip -S 0.0.0.0/0 -D $localip/24 -o #anything else outgoing on remote interface is valid /sbin/ipfwadm -O -a accept -V $staticip -S $staticip/32 -D 0.0.0.0/0 #loopback interface is valid /sbin/ipfwadm -O -a accept -V 127.0.0.1 -S 0.0.0.0/0 -D 0.0.0.0/0 #all other outgoing is denied and logged /sbin/ipfwadm -O -a deny -S 0.0.0.0/0 -D 0.0.0.0/0 -o #-------------------------------------------------------------------------- #Forwarding firewall policies #-------------------------------------------------------------------------- #flush forwarding policies /sbin/ipfwadm -F -f #set forwarding policy default to deny /sbin/ipfwadm -F -p deny #masquerade from localnet on local interface to anywhere /sbin/ipfwadm -F -a masquerade -W $staticif -S $localip/24 -D 0.0.0.0/0 #all other forwarding is denied /sbin/ipfwadm -F -a deny -S 0.0.0.0/0 -D 0.0.0.0/0 exit 0
#!/bin/sh #04/04/1999 #example rc.firewall script for the newer 2.1/2.2 kernels using ipchains #that creates user defined chains for each interface. There are firewall #rules for spoofing protection which may be unnecessary since the newer #kernels can have kernel spoofing protection enabled. You might say it's #super paranoid checking. #Send questions or comments to [email protected]. #--------------------------------------------------------------------- #Variables #--------------------------------------------------------------------- #local ethernet interface localip= localif=eth0 #static ethernet interface staticip= staticif=eth1 #loopback interface loopback=lo PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin" #--------------------------------------------------------------------- #Flush built-in input, output, and forward ipchains; set default policy #Good policy to deny all packets especially while setting up chains #--------------------------------------------------------------------- #set incoming firewall policy default to deny ipchains -P input DENY #flush incoming firewall policies ipchains -F input #--------------------------------------------------------------------- #set outgoing firewall policy default to deny ipchains -P output DENY #flush outgoing firewall policies ipchains -F output #--------------------------------------------------------------------- #set forwarding firewall policy default to deny ipchains -P forward DENY #flush forwarding firewall policies ipchains -F forward #--------------------------------------------------------------------- #flush all policies -redundant for main policies, but also flushes user #defined policies #ipchains -F #remove all user defined policies - you may or may not want to enable this #ipchains -X #--------------------------------------------------------------------- #Incoming Firewall Policies #--------------------------------------------------------------------- #create new input chain for static ethernet interface ipchains -N $staticif"-i" #flush all rules in chain (sanity flush) ipchains -F $staticif"-i" #block incoming tcp SYN packets to all ports on staticif and log #this may be a little harsh but its a nice feature #ipchains -A $staticif"-i" -j DENY -p tcp -y -i $staticif -s 0/0 \ #-d $staticip : -l #remote interface, claiming to be local machines (IP spoofing) deny and log ipchains -A $staticif"-i" -j DENY -i $staticif -s $localip/16 -d 0/0 -l #remote interface, any source, going to staticip address is valid ipchains -A $staticif"-i" -j ACCEPT -i $staticif -s 0/0 -d $staticip/32 #all other incoming is denied and logged ipchains -A $staticif"-i" -j DENY -s 0/0 -d 0/0 -l #--------------------------------------------------------------------- #create new input chain for local ethernet interface ipchains -N $localif"-i" #flush all rules in chain (sanity flush) ipchains -F $localif"-i" #local interface, local machines, going anywhere is valid ipchains -A $localif"-i" -j ACCEPT -i $localif -s $localip/24 -d 0/0 #all other incoming is denied and logged ipchains -A $localif"-i" -j DENY -s 0/0 -d 0/0 -l #--------------------------------------------------------------------- #create new input chain for loopback interface ipchains -N $loopback"-i" #flush all rules in chain (sanity flush) ipchains -F $loopback"-i" #loopback interface is valid ipchains -A $loopback"-i" -j ACCEPT -i $loopback -s 0/0 -d 0/0 #all other incoming is denied and logged ipchains -A $loopback"-i" -j DENY -s 0/0 -d 0/0 -l #-------------------------------------------------------------------------- #Forwarding firewall policies #-------------------------------------------------------------------------- #create new forward chain for static ethernet interface ipchains -N $staticif"-f" #flush all rules in chain (sanity flush) ipchains -F $staticif"-f" #masquerade from localnet on static interface to anywhere ipchains -A $staticif"-f" -j MASQ -i $staticif -s $localip/24 -d 0/0 #all other forwarding is denied and logged ipchains -A $staticif"-f" -j DENY -s 0/0 -d 0/0 -l #--------------------------------------------------------------------- #create new forward chain for local ethernet interface ipchains -N $localif"-f" #flush all rules in chain (sanity flush) ipchains -F $localif"-f" #all other forwarding is denied and logged ipchains -A $localif"-f" -j DENY -s 0/0 -d 0/0 -l #--------------------------------------------------------------------- #create new forward chain for loopback interface ipchains -N $loopback"-f" #flush all rules in chain (sanity flush) ipchains -F $loopback"-f" #all other forwarding is denied and logged ipchains -A $loopback"-f" -j DENY -s 0/0 -d 0/0 -l #--------------------------------------------------------------------- #Outgoing Firewall Policies #--------------------------------------------------------------------- #create new output chain for static ethernet interface ipchains -N $staticif"-o" #flush all rules in chain (sanity flush) ipchains -F $staticif"-o" #outgoing to localnet on remote interface(stuffed routing) deny & log ipchains -A $staticif"-o" -j DENY -i $staticif -s 0/0 -d $localip/24 -l #outgoing from local net on remote interface, stuffed masquerading, deny ipchains -A $staticif"-o" -j DENY -i $staticif -s $localip/24 -d 0/0 -l #anything else outgoing on remote interface is valid ipchains -A $staticif"-o" -j ACCEPT -i $staticif -s $staticip/32 -d 0/0 #all other outgoing is denied and logged ipchains -A $staticif"-o" -j DENY -s 0/0 -d 0/0 -l #--------------------------------------------------------------------- #create new output chain for local ethernet interface ipchains -N $localif"-o" #flush all rules in chain (sanity flush) ipchains -F $localif"-o" #local interface, any source going to local net is valid ipchains -A $localif"-o" -j ACCEPT -i $localif -s 0/0 -d $localip/24 #all other outgoing is denied and logged ipchains -A $localif"-o" -j DENY -s 0/0 -d 0/0 -l #--------------------------------------------------------------------- #create new output chain for loopback interface ipchains -N $loopback"-o" #flush all rules in chain (sanity flush) ipchains -F $loopback"-o" #loopback interface is valid ipchains -A $loopback"-o" -j ACCEPT -i $loopback -s 0/0 -d 0/0 #all other outgoing is denied and logged ipchains -A $loopback"-o" -j DENY -s 0/0 -d 0/0 -l #-------------------------------------------------------------------------- #make sure forwarding is enabled in the kernel #-------------------------------------------------------------------------- /bin/echo 1 > /proc/sys/net/ipv4/ip_forward #-------------------------------------------------------------------------- #Add pointers to built-in chains to enable user defined chains #change the order in each chain to optimize filtering for an interface #-------------------------------------------------------------------------- #add local interface input chain ipchains -A input -i $localif -j $localif"-i" #add static interface input chain ipchains -A input -i $staticif -j $staticif"-i" #add loopback interface input chain ipchains -A input -i $loopback -j $loopback"-i" #------------------------------------------------------------------------- #add local interface output chain ipchains -A output -i $localif -j $localif"-o" #add static interface output chain ipchains -A output -i $staticif -j $staticif"-o" #add loopback interface output chain ipchains -A output -i $loopback -j $loopback"-o" #------------------------------------------------------------------------- #add local interface forward chain ipchains -A forward -i $localif -j $localif"-f" #add static interface forward chain ipchains -A forward -i $staticif -j $staticif"-f" #add loopback interface forward chain ipchains -A forward -i $loopback -j $loopback"-f" #--------------------------------------------------------------------- #Super Paranoid check --- even though default policy is set for deny, #block all packets on any interface #--------------------------------------------------------------------- #all other incoming is denied and logged ipchains -A input -j DENY -s 0/0 -d 0/0 -l #all other output is denied and logged ipchains -A output -j DENY -s 0/0 -d 0/0 -l #all other forwarding is denied and logged ipchains -A forward -j DENY -s 0/0 -d 0/0 -l exit 0