#!/bin/bash
/sbin/modprobe iptable_nat
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_REJECT
/sbin/modprobe ipt_MASQUERADE
### Variaveis ###
iptables=/usr/sbin/iptables
ETH_EXTERNA=eth1
ETH_INTERNA=eth0
### ativa o roteamento dinamico ###
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/conf/all/proxy_arp
####################
# Limpa tabela #
####################
$iptables -F
$iptables -X
$iptables -F -t nat
$iptables -X -t nat
$iptables -F -t mangle
$iptables -X -t mangle
$iptables -F PREROUTING -t mangle
$iptables -F PREROUTING -t nat
$iptables -F POSTROUTING -t nat
echo "Limpando regras de firewall..."
##################
# Fecha tudo #
##################
$iptables -P INPUT DROP
$iptables -P OUTPUT DROP
$iptables -P FORWARD DROP
### Aceita os pacotes que realmente devem entrar ###
$iptables -A INPUT -i ! $ETH_EXTERNA -j ACCEPT
$iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A OUTPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
#$iptables -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
### Dropa pacotes TCP indesejáveis ###
$iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j LOG --log-level 6 --log-prefix "FIREWALL: NEW sem syn: "
$iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
### Pacote mal formado ###
#$iptables -A INPUT -i $ETH_EXTERNA -m unclean -j LOG --log-level 6 --log-prefix "FIREWALL: pacote mal formado: "
$iptables -A INPUT -i $ETH_EXTERNA -m unclean -j DROP
### Proteção contra ping suspeito ###
$iptables -A FORWARD -m unclean -j DROP
### Contra ping ###
$iptables -A FORWARD -p icmp --icmp-type echo-request -j DROP
### Contra ping of death ###
$iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
### Contra syn-floods ###
$iptables -A FORWARD -p tcp -m limit --limit 1/s -j ACCEPT
### Proteção contra port scanners ###
$iptables -N SCANNER
$iptables -A SCANNER -m limit --limit 15/m -j LOG --log-level 6 --log-prefix "FIREWALL: port scanner: "
$iptables -A SCANNER -j DROP
$iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -i $ETH_EXTERNA -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags ALL NONE -i $ETH_EXTERNA -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags ALL ALL -i $ETH_EXTERNA -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags ALL FIN,SYN -i $ETH_EXTERNA -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -i $ETH_EXTERNA -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -i $ETH_EXTERNA -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -i $ETH_EXTERNA -j SCANNER
### Proteção contra trinoo ###
$iptables -N TRINOO
$iptables -A TRINOO -m limit --limit 15/m -j LOG --log-level 6 --log-prefix "FIREWALL: trinoo: "
$iptables -A TRINOO -j DROP
$iptables -A INPUT -p TCP -i $ETH_EXTERNA --dport 27444 -j TRINOO
$iptables -A INPUT -p TCP -i $ETH_EXTERNA --dport 27665 -j TRINOO
$iptables -A INPUT -p TCP -i $ETH_EXTERNA --dport 31335 -j TRINOO
$iptables -A INPUT -p TCP -i $ETH_EXTERNA --dport 34555 -j TRINOO
$iptables -A INPUT -p TCP -i $ETH_EXTERNA --dport 35555 -j TRINOO
### Proteção contra tronjans ###
$iptables -N TROJAN
$iptables -A TROJAN -m limit --limit 15/m -j LOG --log-level 6 --log-prefix "FIREWALL: trojan: "
$iptables -A TROJAN -j DROP
$iptables -A INPUT -p TCP -i $ETH_EXTERNA --dport 666 -j TROJAN
$iptables -A INPUT -p TCP -i $ETH_EXTERNA --dport 666 -j TROJAN
$iptables -A INPUT -p TCP -i $ETH_EXTERNA --dport 4000 -j TROJAN
$iptables -A INPUT -p TCP -i $ETH_EXTERNA --dport 6000 -j TROJAN
$iptables -A INPUT -p TCP -i $ETH_EXTERNA --dport 6006 -j TROJAN
$iptables -A INPUT -p TCP -i $ETH_EXTERNA --dport 16660 -j TROJAN
### Proteção contra worms ###
$iptables -A FORWARD -p tcp --dport 135 -i $ETH_INTERNA -j REJECT
### Loga tentativa de acesso a determinadas portas ###
$iptables -A INPUT -p tcp --dport 21 -i $ETH_EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: ftp: "
$iptables -A INPUT -p tcp --dport 23 -i $ETH_EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: telnet: "
$iptables -A INPUT -p tcp --dport 25 -i $ETH_EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: smtp: "
$iptables -A INPUT -p tcp --dport 80 -i $ETH_EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: http: "
$iptables -A INPUT -p tcp --dport 110 -i $ETH_EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: pop3: "
$iptables -A INPUT -p udp --dport 111 -i $ETH_EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: rpc: "
$iptables -A INPUT -p tcp --dport 113 -i $ETH_EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: identd: "
$iptables -A INPUT -p tcp --dport 137:139 -i $ETH_EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: samba: "
$iptables -A INPUT -p udp --dport 137:139 -i $ETH_EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: samba: "
$iptables -A INPUT -p tcp --dport 161:162 -i $ETH_EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: snmp: "
$iptables -A INPUT -p tcp --dport 6667:6668 -i $ETH_EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: irc: "
$iptables -A INPUT -p tcp --dport 3128 -i $ETH_EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: squid: "
#################################
# Libera portas especificas #
#################################
$iptables -A INPUT -p TCP -s 192.168.1.0/24 -m multiport --dport 8,11,21,22,3128,25,110,1041,1863,443,80,2222,10000,9024,35000 -j ACCEPT
$iptables -A OUTPUT -p TCP -d 192.168.1.0/24 -m multiport --sport 8,11,21,22,3128,25,110,1041,1863,443,80,2222,10000,9024,35000 -j ACCEPT
$iptables -A FORWARD -p TCP -s 192.168.1.0/24 -m multiport --dport 8,11,21,22,3128,80,25,110,443,1041,1863,10000,9024,35000 -j ACCEPT
$iptables -A FORWARD -p TCP -d 192.168.1.0/24 -m multiport --sport 8,11,21,22,3128,80,25,110,443,1041,1863,10000,9024,35000 -j ACCEPT
$iptables -A INPUT -p TCP -s 200.xxx.xxx.x/25 -m multiport --dport 8,11,21,22,3128,25,110,1041,8080,2222,10000,9024,35000 -j ACCEPT
$iptables -A OUTPUT -p TCP -d 200.xxx.xxx.x/25 -m multiport --sport 8,11,21,22,3128,25,110,1041,8080,2222,10000,9024,35000 -j ACCEPT
$iptables -A INPUT -p TCP -s 200.xxx.xx.xxx/29 -m multiport --dport 8,11,2121,22,3128,25,110,1041,80,2222,10000,9024 -j ACCEPT
$iptables -A OUTPUT -p TCP -d 200.xxx.xx.xxx/29 -m multiport --sport 8,11,2121,22,3128,25,110,1041,80,2222,1000,9024 -j ACCEPT
####################
# Mascaramento #
####################
$iptables -t nat -A POSTROUTING -p tcp -s 192.168.1.0/24 -d 0/0 --dport 80 -j MASQUERADE
$iptables -t nat -A POSTROUTING -p tcp -s 192.168.1.0/24 -d 0/0 --dport 25 -j MASQUERADE
$iptables -t nat -A POSTROUTING -p tcp -s 192.168.1.0/24 -d 0/0 --dport 110 -j MASQUERADE
$iptables -t nat -A POSTROUTING -p tcp -s 192.168.1.0/24 -d 0/0 --dport 35000 -j MASQUERADE
$iptables -t nat -A POSTROUTING -p tcp -s 192.168.1.0/24 -d 0/0 --dport 1863 -j MASQUERADE
$iptables -t nat -A POSTROUTING -p tcp -s 192.168.1.0/24 -d 0/0 --dport 443 -j MASQUERADE
echo "Firewall ativo!!"