178 lines
7.2 KiB
Bash
Executable File
178 lines
7.2 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
echo Flush existing rules
|
|
iptables -F
|
|
iptables -F -t nat
|
|
iptables -F -t mangle
|
|
iptables -F -t filter
|
|
echo Delete all
|
|
iptables -X
|
|
|
|
DELUGE_MODE=false
|
|
|
|
if [ "$1" == "-d" ]; then
|
|
echo Input -d open all traffic
|
|
iptables -P INPUT ACCEPT
|
|
iptables -P FORWARD ACCEPT
|
|
exit 0
|
|
elif [ "$1" == "-deluge-mode" ]; then
|
|
echo "Iptables Deluge Mode"
|
|
DELUGE_MODE=true
|
|
else
|
|
echo "Set up Firewall"
|
|
fi
|
|
|
|
echo Set Variables
|
|
HOST="$(hostname)"
|
|
SSHPORT=$(cat /etc/ssh/sshd_config | grep Port | grep -v "#" | cut -f2 -d' ')
|
|
|
|
echo Make Rules
|
|
|
|
echo Drop incoming traffic and accept outgoing
|
|
iptables -P INPUT DROP
|
|
iptables -P FORWARD DROP
|
|
iptables -P OUTPUT ACCEPT
|
|
|
|
echo "Established Connections"
|
|
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
echo "DHCP"
|
|
iptables -A OUTPUT -p udp --dport 67 --sport 68 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
iptables -A INPUT -p udp --sport 67 --dport 68 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
if [ "${HOST}" == "quiethost" ]; then
|
|
SD_PORT=7860
|
|
echo Incoming SD Port ${SD_PORT}
|
|
iptables -A INPUT -p tcp --dport ${SD_PORT} -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
iptables -A OUTPUT -p tcp --sport ${SD_PORT} -m state --state ESTABLISHED -j ACCEPT
|
|
echo Incoming SD Port 9170
|
|
iptables -A INPUT -p tcp --dport 9170 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
iptables -A OUTPUT -p tcp --sport 9170 -m state --state ESTABLISHED -j ACCEPT
|
|
elif [ "${HOST}" == "serverhost" ]; then
|
|
DELUGE_PORT=58846
|
|
echo Incoming https Port 8123
|
|
iptables -A INPUT -p tcp --dport 8123 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
iptables -A OUTPUT -p tcp --sport 8123 -m state --state ESTABLISHED -j ACCEPT
|
|
echo Incoming https Port 80
|
|
iptables -A INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
iptables -A OUTPUT -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
|
|
echo Incoming https Port 443
|
|
iptables -A INPUT -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
iptables -A OUTPUT -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
|
|
echo Incoming https Port 444
|
|
iptables -A INPUT -p tcp --dport 444 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
iptables -A OUTPUT -p tcp --sport 444 -m state --state ESTABLISHED -j ACCEPT
|
|
echo Deluge Daemon
|
|
iptables -A INPUT -p tcp --dport ${DELUGE_PORT} -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
iptables -A OUTPUT -p tcp --sport ${DELUGE_PORT} -m state --state ESTABLISHED -j ACCEPT
|
|
iptables -A INPUT -p tcp --dport 8096 -j ACCEPT
|
|
iptables -A INPUT -p udp --dport 8096 -j ACCEPT
|
|
iptables -A INPUT -p tcp --dport 4533 -j ACCEPT
|
|
iptables -A INPUT -p udp --dport 4533 -j ACCEPT
|
|
iptables -A INPUT -p tcp --dport 13378 -j ACCEPT
|
|
iptables -A INPUT -p udp --dport 13378 -j ACCEPT
|
|
fi
|
|
echo "Incoming SSH -P $SSHPORT"
|
|
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport $SSHPORT -j ACCEPT
|
|
iptables -A OUTPUT -p tcp --sport $SSHPORT -m state --state ESTABLISHED -j ACCEPT
|
|
echo "Incoming XRDP Port"
|
|
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 3389 -j ACCEPT
|
|
iptables -A OUTPUT -p tcp --sport 3389 -m state --state ESTABLISHED -j ACCEPT
|
|
echo "Ping Reply"
|
|
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
|
|
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
|
|
echo "Send Mail"
|
|
iptables -A INPUT -p 25 -j ACCEPT
|
|
iptables -A OUTPUT -p 25 -j ACCEPT
|
|
echo "loopback"
|
|
iptables -A INPUT -i lo -j ACCEPT
|
|
iptables -A OUTPUT -o lo -j ACCEPT
|
|
if [[ "$(grep -E "no-internet:" /etc/group)" == "" ]]; then
|
|
echo "Add no-internet group"
|
|
sudo addgroup no-internet
|
|
fi
|
|
echo "Add No Internet Group Rule"
|
|
sudo iptables -A OUTPUT -m owner --gid-owner no-internet -j DROP
|
|
# On Fail:
|
|
# sudo addgroup no-internet
|
|
# sudo adduser lucas no-internet
|
|
|
|
|
|
if [ "${HOST}" == "raspberry" ]; then
|
|
iptables -A FORWARD -i ${NETIF} -o wlan0 -j ACCEPT
|
|
iptables -A FORWARD -i wlan0 -o ${NETIF} -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
sysctl -w net.ipv4.ip_forward=1
|
|
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
|
|
fi
|
|
if [ "$(cat /etc/passwd | grep -E "deluge-user:x:[0-9]{4}:[0-9]{4}")" != "" ]; then
|
|
echo "deluge-user Settings"
|
|
if [ "${VPNUSER}" == "" ]; then
|
|
VPNUSER="deluge-user"
|
|
fi
|
|
if [ "${LOCALIP}" == "" ]; then
|
|
NETIF="$(lshw -class network | grep -A6 "Ethernet interface" | grep name | awk -F': ' '{print $2}')"
|
|
LOCALIP=$(ip addr show ${NETIF} | grep -Po '(?<= inet )([0-9\.]+)')
|
|
fi
|
|
if [ "${MARK_ID}" == "" ]; then
|
|
MARK_ID="0x32"
|
|
fi
|
|
|
|
if [[ $(ip rule list | grep -c $MARK_ID) == 0 ]]; then
|
|
ip rule add from all fwmark $MARK_ID lookup $VPNUSER
|
|
fi
|
|
|
|
echo Interface $NETIF
|
|
echo IP: $LOCALIP
|
|
echo "mark packets from ${VPNUSER} to ${LOCALIP} with ${MARK_ID}"
|
|
iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
|
|
iptables -t mangle -A OUTPUT ! --dest ${LOCALIP} -m owner --uid-owner ${VPNUSER} -j MARK --set-mark ${MARK_ID}
|
|
iptables -t mangle -A OUTPUT --dest ${LOCALIP} -p udp --dport 53 -m owner --uid-owner ${VPNUSER} -j MARK --set-mark ${MARK_ID}
|
|
iptables -t mangle -A OUTPUT --dest ${LOCALIP} -p tcp --dport 53 -m owner --uid-owner ${VPNUSER} -j MARK --set-mark ${MARK_ID}
|
|
iptables -t mangle -A OUTPUT ! --src ${LOCALIP} -j MARK --set-mark ${MARK_ID}
|
|
iptables -t mangle -A OUTPUT -j CONNMARK --save-mark
|
|
|
|
echo "Set DNS for ${VPNUSER}"
|
|
iptables -t nat -A OUTPUT --dest ${LOCALIP} -p udp --dport 53 -m owner --uid-owner ${VPNUSER} -j DNAT --to-destination 8.8.4.4
|
|
iptables -t nat -A OUTPUT --dest ${LOCALIP} -p tcp --dport 53 -m owner --uid-owner ${VPNUSER} -j DNAT --to-destination 8.8.8.8
|
|
|
|
echo "let ${VPNUSER} access lo"
|
|
iptables -A OUTPUT -o lo -m owner --uid-owner ${VPNUSER} -j ACCEPT
|
|
|
|
iptables -A INPUT -i ${NETIF} -s 192.168.0.0/24 -p udp --dport 137:138 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
iptables -A OUTPUT -o ${NETIF} -d 192.168.0.0/24 -p udp --sport 137:138 -m state --state ESTABLISHED -j ACCEPT
|
|
iptables -A INPUT -i ${NETIF} -s 192.168.0.0/24 -p tcp --dport 139 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
iptables -A OUTPUT -o ${NETIF} -d 192.168.0.0/24 -p tcp --sport 139 -m state --state ESTABLISHED -j ACCEPT
|
|
iptables -A INPUT -i ${NETIF} -s 192.168.0.0/24 -p tcp --dport 445 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
# qbittorrent
|
|
iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
|
|
# nfs to radarr/sonarr
|
|
iptables -A INPUT -p tcp -s 192.168.0.4 --dport 2049 -j ACCEPT
|
|
|
|
if [ "${DELUGE_MODE}" == "true" ]; then
|
|
printf "Local IP: ${LOCALIP}\nInterface: $NETIF\nVPN IP: $VPNIP\nVPN Interface: $VPNIF\nP2P IP: $P2PIP\nVPN User: ${VPNUSER}\nMarkID: ${MARK_ID}\n"
|
|
echo "Deluge and VPN Settings"
|
|
|
|
echo Established VPN connections
|
|
iptables -A INPUT -i $VPNIF -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
|
|
|
echo "block everything incoming on $VPNIF"
|
|
iptables -A INPUT -i $VPNIF -j REJECT
|
|
|
|
echo "let ${VPNUSER} access $VPNIF"
|
|
iptables -A OUTPUT -o $VPNIF -m owner --uid-owner ${VPNUSER} -j ACCEPT
|
|
|
|
echo all packets on $VPNIF needs to be masqueraded
|
|
iptables -t nat -A POSTROUTING -o $VPNIF -j MASQUERADE
|
|
|
|
echo "reject connections from predator IP going over $NETIF"
|
|
iptables -A OUTPUT ! --src ${LOCALIP} -o $NETIF -j REJECT
|
|
fi
|
|
fi
|
|
LOG=false
|
|
if $LOG; then
|
|
echo Logging
|
|
iptables -N LOGGING
|
|
iptables -A INPUT -j LOGGING
|
|
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7
|
|
iptables -A LOGGING -j DROP
|
|
fi
|