Linux Filrewall Script

#!/bin/bash

#This Scripte is Firewall

#Version 1.0 at 2012-07-27

#writer pellok.he

#

####################################

#Setting Port and IP

IN_TCP_PORTALLOWED="ssh"

IN_UDP_PORTALLOWED="domain"

IN_ICMP_ALLOWED="0 3 8 11"

OUT_TCP_PORTALLOWED="ssh"

OUT_UDP_PORTALLOWED=""

OUT_ICMP_ALLOWED="0 3 8 11"

###################################

#Load modual

modprobe ip_conntrack

modprobe ip_conntrack_ftp

modprobe ip_conntrack_irc

#claer role

iptables -t filter -F

iptables -t nat -F

iptables -t filter -X

iptables -t nat -X

#procity

iptables -P INPUT DROP

iptables -P OUTPUT DROP

iptables -P FORWARD DROP

#lo

iptables -A INPUT -i lo -j ACCEPT

iptables -A OUTPUT -o lo -j ACCEPT

iptables -A INPUT -i ! lo -s 127.0.0.0/8 -j DROP

iptables -A OUTPUT -o ! lo -d 127.0.0.0/8 -j DROP

#domain --lynx need use

iptables -A OUTPUT -p udp -m state --state NEW --dport 53 -j ACCEPT

#

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#allow yum and http --lynx need use

iptables -A OUTPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT

#create bad pocket

iptables -N BADPKT

iptables -A BADPKT -j LOG --log-prefix "** Fireall BADPKT **"

iptables -A BADPKT -j DROP

iptables -A INPUT -m state --state INVALID -j BADPKT

iptables -A INPUT -p tcp ! --syn -m state --state NEW -j BADPKT

iptables -A INPUT -p tcp --tcp-flags ALL NONE -j BADPKT

iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j BADPKT

iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j BADPKT

iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j BADPKT

iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j BADPKT

iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j BADPKT

iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j BADPKT

iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j BADPKT

iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j BADPKT

iptables -A INPUT -p tcp --tcp-flags ALL ALL -j BADPKT

iptables -A INPUT -p tcp --tcp-flags ALL FIN -j BADPKT

#create bad ip

iptables -N BADIP

iptables -A BADIP -j LOG --log-prefix "*** Firewall BADIP ****"

iptables -A BADIP -j DROP

BADIPS="`lynx --dump http://feeds.dshield.org/block.txt | awk '/^[1-9]/ {print $1 "/" $3}'`"

for ip in $BADIPS;

do

    iptables -A INPUT -s $ip -j BADIP

done

#allow in tcp port and ip

for i in $IN_TCP_PORTALLOWED ;

do

    IFS=','

    set $i

    unset IFS ipt_option

    port="$1"

    [ -n "$2" ] && ipt_option=" -s `echo $2 | sed 's/^!/! /'`"

    iptables -A INPUT -p tcp $ipt_option --dport $port --syn -m state --state NEW -j ACCEPT

done

#allow in udp port and ip

for i in $IN_UDP_PORTALLOWED ;

do

    IFS=','

    set $i

    unset IFS ipt_option

    port="$1"

    [ -n "$2" ] && ipt_option=" -s `echo $2 | sed 's/^!/! /'`"

    iptables -A INPUT -p udp $ipt_option --dport $port -m state --state NEW -j ACCEPT

done

#allow in icmp

for i in $IN_ICMP_ALLOWED ;

do

    IFS=','

    set $i

    unset IFS ipt_option

    type="$1"

    [ -n "$2" ] && ipt_option=" -s `echo $2 | sed 's/^!/! /'`"

    iptables -A INPUT -p icmp $ipt_option --icmp-type $type -m state --state NEW -j ACCEPT

done

#allow out tcp port and ip

for i in $OUT_TCP_PORTALLOWED ;

do

    IFS=','

    set $i

    unset IFS ipt_option

    port="$1"

    [ -n "$2" ] && ipt_option=" -d `echo $2 | sed 's/^!/! /'`"

    [ -n "$3" ] && ipt_option="$ipt_option -m owner `echo $3 |sed 's/\([^!])/ --uid-owner \1/'`"

    iptables -A OUTPUT -p tcp $ipt_option --dport $port --syn -m state --state NEW -j ACCEPT

done

#allow out udp port and ip

for i in $OUT_UDP_PORTALLOWED ;

do

    IFS=','

    set $i

    unset IFS ipt_option

    port="$1"

    [ -n "$2" ] && ipt_option=" -d `echo $2 | sed 's/^!/! /'`"

    [ -n "$3" ] && ipt_option="$ipt_option -m owner `echo $3 |sed 's/\([^!])/ --uid-owner \1/'`"

    iptables -A OUTPUT -p udp $ipt_option --dport $port -m state --state NEW -j ACCEPT

done

#allow out icmp

for i in $OUT_ICMP_ALLOWED ;

do

    IFS=','

    set $i

    unset IFS ipt_option

    type="$1"

    [ -n "$2" ] && ipt_option=" -d `echo $2 | sed 's/^!/! /'`"

    [ -n "$3" ] && ipt_option="$ipt_option -m owner `echo $3 |sed 's/\([^!])/ --uid-owner \1/'`"

    iptables -A OUTPUT -p icmp $ipt_option --icmp-type $type -m state --state NEW -j ACCEPT

done

#allow connect out

iptables -A OUTPUT -m state --state NEW -j ACCEPT

#all the packet need log

iptables -A INPUT -j LOG --log-prefix "** Firewall INPUT  DROP**"

iptables -A OUTPUT -j LOG --log-prefix "** Firewall OUTPUT DROP**"

iptables -A FORWARD -j LOG --log-prefix "** Firewall FORWARD DROP**"

/etc/init.d/iptables save