97 lines
3.1 KiB
Bash
Executable File
97 lines
3.1 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
NETIF=$1
|
|
if [ "$1" != "eth0" ] && [ "$1" != "all" ] && [ "$1" != "wlan0" ] && [ "$1" != "bond0" ] && [ "$1" != "IF" ]; then
|
|
printf "Wrong NETIF: $NETIF\neth0, wlan0 or all\n"
|
|
exit 0
|
|
fi
|
|
if [ "$1" == "all" ] || [ "$1" == "bond0" ] || [ "$1" == "IF" ]; then
|
|
NETIF="eth0"
|
|
fi
|
|
if [ "$1" == "wlan0" ] || [ "$1" == "all" ] || [ "$1" == "bond0" ] || [ "$1" == "IF" ]; then
|
|
echo "wlan power & txpower on"
|
|
iwconfig wlan0 power on
|
|
iwconfig wlan0 txpower auto
|
|
if [ "$(ifconfig | grep wlan0)" == "" ]; then
|
|
ifup wlan0
|
|
fi
|
|
elif [ "$1" == "eth0" ]; then
|
|
echo "wlan power & txpower off"
|
|
if [ "$(ifconfig | grep wlan0)" != "" ]; then
|
|
sudo ifdown wlan0
|
|
fi
|
|
iwconfig wlan0 txpower off
|
|
iwconfig wlan0 power off
|
|
fi
|
|
|
|
echo Flush existing rules
|
|
ufw disable
|
|
|
|
echo Flush
|
|
iptables -F
|
|
|
|
echo Delete
|
|
iptables -X
|
|
|
|
echo Make Rules
|
|
|
|
echo Allen verkehr blockieren
|
|
iptables -P INPUT DROP
|
|
iptables -P FORWARD DROP
|
|
iptables -P OUTPUT ACCEPT
|
|
|
|
echo loopback $NETIF
|
|
iptables -A INPUT -i lo -s 127.0.0.1 -j ACCEPT
|
|
iptables -A OUTPUT -o lo -j ACCEPT
|
|
|
|
for i in 1 2 3
|
|
do
|
|
|
|
echo Datenverkehr akzeptieren der zu einer bereits geoeffneten Verbindung gehoert $NETIF
|
|
iptables -A INPUT -i $NETIF -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
#if [ "$NETIF" != "bond0" ]; then
|
|
echo Incoming SSH p1160 $NETIF
|
|
iptables -A INPUT -i $NETIF -p tcp -m state --state NEW -m tcp --dport 1160 -j ACCEPT
|
|
iptables -A OUTPUT -o $NETIF -p tcp --sport 1160 -m state --state ESTABLISHED -j ACCEPT
|
|
#else
|
|
#echo Reject Incoming SSH p1160 $NETIF
|
|
#iptables -A INPUT -i $NETIF -p tcp -m state --state NEW -m tcp --dport 1160 -j REJECT
|
|
#iptables -A OUTPUT -o $NETIF -p tcp --sport 1160 -m state --state ESTABLISHED -j REJECT
|
|
#fi
|
|
#echo Outgoing SSh P1160 $NETIF
|
|
#iptables -A OUTPUT -o $NETIF -p tcp --dport 1160 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
#iptables -A INPUT -i $NETIF -p tcp --sport 1160 -m state --state ESTABLISHED -j ACCEPT
|
|
|
|
#echo Outgoing SSH p3032 $NETIF
|
|
#iptables -A OUTPUT -o $NETIF -p tcp --dport 3032 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
#iptables -A INPUT -i $NETIF -p tcp --sport 3032 -m state --state ESTABLISHED -j ACCEPT
|
|
|
|
#echo Updates - Outgoing Network Traffic $NETIF
|
|
#iptables -A OUTPUT -o $NETIF -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
#iptables -A OUTPUT -o $NETIF -p tcp --dport 80 -m state --state NEW -j ACCEPT
|
|
#iptables -A OUTPUT -o $NETIF -p tcp --dport 53 -m state --state NEW -j ACCEPT
|
|
#iptables -A OUTPUT -o $NETIF -p udp --dport 53 -m state --state NEW -j ACCEPT
|
|
|
|
echo Ping $NETIF
|
|
iptables -A INPUT -i $NETIF -p icmp --icmp-type echo-request -j ACCEPT
|
|
iptables -A OUTPUT -o $NETIF -p icmp --icmp-type echo-reply -j ACCEPT
|
|
iptables -A OUTPUT -o $NETIF -p icmp --icmp-type echo-request -j ACCEPT
|
|
iptables -A INPUT -i $NETIF -p icmp --icmp-type echo-reply -j ACCEPT
|
|
|
|
if [ "$1" == "IF" ] || [ "$1" == "all" ] || [ "$1" == "bond0" ] && [ $i -eq 1 ]; then
|
|
NETIF="wlan0"
|
|
elif [ "$1" == "bond0" ] && [ $i -eq 2 ]; then
|
|
NETIF="bond0"
|
|
else
|
|
break
|
|
fi
|
|
done
|
|
|
|
echo Logging
|
|
iptables -N LOGGING
|
|
iptables -A INPUT -j LOGGING
|
|
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7
|
|
iptables -A LOGGING -j DROP
|
|
|
|
|