Add iptables setup script to repository
This commit is contained in:
parent
78a2416d86
commit
57224747c0
117
iptables/install-iptables-rules.sh
Normal file
117
iptables/install-iptables-rules.sh
Normal file
@ -0,0 +1,117 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Enable debugging, makes it easier to detect faulty commands
|
||||||
|
set -x
|
||||||
|
|
||||||
|
### Clear all old rules
|
||||||
|
iptables -P INPUT ACCEPT
|
||||||
|
iptables -P OUTPUT ACCEPT
|
||||||
|
iptables -P FORWARD ACCEPT
|
||||||
|
|
||||||
|
ip6tables -P INPUT ACCEPT
|
||||||
|
ip6tables -P OUTPUT ACCEPT
|
||||||
|
ip6tables -P FORWARD ACCEPT
|
||||||
|
|
||||||
|
iptables -F
|
||||||
|
iptables -X
|
||||||
|
iptables -t nat -F
|
||||||
|
iptables -t nat -X
|
||||||
|
|
||||||
|
ip6tables -F
|
||||||
|
ip6tables -X
|
||||||
|
|
||||||
|
# Exit in case you only want to clear all existing rules
|
||||||
|
#exit 0;
|
||||||
|
|
||||||
|
|
||||||
|
### New rules start here
|
||||||
|
|
||||||
|
# Default policy ist DROP.
|
||||||
|
iptables -P INPUT DROP
|
||||||
|
iptables -P OUTPUT DROP
|
||||||
|
iptables -P FORWARD DROP
|
||||||
|
|
||||||
|
ip6tables -P INPUT DROP
|
||||||
|
ip6tables -P OUTPUT DROP
|
||||||
|
ip6tables -P FORWARD DROP
|
||||||
|
|
||||||
|
# Install a chain for logging and dropping traffic
|
||||||
|
# This helps with debugging a bit
|
||||||
|
iptables -N log_and_drop
|
||||||
|
iptables -A log_and_drop -j LOG --log-level debug --log-prefix " "
|
||||||
|
iptables -A log_and_drop -j DROP
|
||||||
|
ip6tables -N log_and_drop
|
||||||
|
ip6tables -A log_and_drop -j LOG --log-level debug --log-prefix " "
|
||||||
|
ip6tables -A log_and_drop -j DROP
|
||||||
|
|
||||||
|
# Datenverkehr über Loopback-Interface ist immer erlaubt.
|
||||||
|
iptables -A INPUT -i lo -j ACCEPT
|
||||||
|
iptables -A OUTPUT -o lo -j ACCEPT
|
||||||
|
ip6tables -A INPUT -i lo -j ACCEPT
|
||||||
|
ip6tables -A OUTPUT -o lo -j ACCEPT
|
||||||
|
|
||||||
|
# Die Protokolle ICMP und ICPMv6 sind immer erlaubt.
|
||||||
|
iptables -A INPUT -p icmp -j ACCEPT
|
||||||
|
iptables -A OUTPUT -p icmp -j ACCEPT
|
||||||
|
iptables -A FORWARD -p icmp -j ACCEPT
|
||||||
|
ip6tables -A INPUT -p icmpv6 -j ACCEPT
|
||||||
|
ip6tables -A OUTPUT -p icmpv6 -j ACCEPT
|
||||||
|
ip6tables -A FORWARD -p icmpv6 -j ACCEPT
|
||||||
|
|
||||||
|
# Zugriffe auf den VPN-Server sind für Dienste SSH und OpenVPN erlaubt.
|
||||||
|
iptables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
|
||||||
|
ip6tables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
|
||||||
|
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
|
||||||
|
ip6tables -A INPUT -p udp --dport 1194 -j ACCEPT
|
||||||
|
|
||||||
|
# Antwortpakete auf eingehende Pakete für SSH und OpenVPN sind erlaubt.
|
||||||
|
iptables -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
|
||||||
|
ip6tables -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
|
||||||
|
iptables -A OUTPUT -p udp --sport 1194 -j ACCEPT
|
||||||
|
ip6tables -A OUTPUT -p udp --sport 1194 -j ACCEPT
|
||||||
|
|
||||||
|
# Vom VPN-Server ausgehende Pakete sind grundsätzlich erlaubt.
|
||||||
|
iptables -A OUTPUT -m state --state NEW,ESTABLISHED -j ACCEPT
|
||||||
|
ip6tables -A OUTPUT -m state --state NEW,ESTABLISHED -j ACCEPT
|
||||||
|
|
||||||
|
# Zum VPN-Server eingehende Pakete sind als Antwort auf ausgehende Pakete erlaubt.
|
||||||
|
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||||
|
ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||||
|
|
||||||
|
# Für IPv4-Verkehr aus dem VPN in andere Netze soll NAT mit Absender-IP 141.71.38.7 durchgeführt werden.
|
||||||
|
iptables -t nat -A POSTROUTING -s 10.2.0.0/16 ! -d 10.2.0.0/16 -j SNAT --to 141.71.38.7
|
||||||
|
|
||||||
|
# Datenverkehr zwischen VPN-Clients ist verboten und wird verworfen.
|
||||||
|
iptables -A FORWARD -s 10.2.0.0/16 -d 10.2.0.0/16 -j log_and_drop
|
||||||
|
ip6tables -A FORWARD -s 2001:638:614:1750::/64 -d 2001:683:614:1750::/64 -j log_and_drop
|
||||||
|
|
||||||
|
# Datenverkehr aus dem VPN zu Hosts in der DMZ ist verboten.
|
||||||
|
#iptables -A FORWARD -s 10.2.0.0/16 -d 141.71.38.0/24 -j log_and_drop
|
||||||
|
#ip6tables -A FORWARD -s 2001:638:614:1750::/64 -d 2001:638:614:1780::/64 -j log_and_drop
|
||||||
|
|
||||||
|
# Datenverkehr aus dem VPN zu NFS (Port 2049) ist verboten.
|
||||||
|
iptables -A FORWARD -s 10.2.0.0/16 -p tcp --dport 2049 -j log_and_drop
|
||||||
|
iptables -A FORWARD -s 10.2.0.0/16 -p udp --dport 2049 -j log_and_drop
|
||||||
|
ip6tables -A FORWARD -s 2001:638:614:1750::/64 -p tcp --dport 2049 -j log_and_drop
|
||||||
|
ip6tables -A FORWARD -s 2001:638:614:1750::/64 -p udp --dport 2049 -j log_and_drop
|
||||||
|
|
||||||
|
# Jeglicher weiterer Datenverkehr aus dem VPN ist erlaubt.
|
||||||
|
iptables -A FORWARD -s 10.2.0.0/16 -m state --state NEW,ESTABLISHED -j ACCEPT
|
||||||
|
ip6tables -A FORWARD -s 2001:638:614:1750::/64 -m state --state NEW,ESTABLISHED -j ACCEPT
|
||||||
|
|
||||||
|
# In das VPN eingehender Verkehr ist nur als Antwort auf ausgehende Pakete erlaubt.
|
||||||
|
iptables -A FORWARD -d 10.2.0.0/16 -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||||
|
ip6tables -A FORWARD -d 2001:638:614:1750::/64 -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||||
|
|
||||||
|
# Log everything else that is supposed to get dropped by default
|
||||||
|
iptables -A INPUT -j log_and_drop
|
||||||
|
iptables -A OUTPUT -j log_and_drop
|
||||||
|
iptables -A FORWARD -j log_and_drop
|
||||||
|
|
||||||
|
ip6tables -A INPUT -j log_and_drop
|
||||||
|
ip6tables -A OUTPUT -j log_and_drop
|
||||||
|
ip6tables -A FORWARD -j log_and_drop
|
||||||
|
|
||||||
|
### Save the new rules to disk
|
||||||
|
iptables-save > /etc/iptables/rules.v4
|
||||||
|
ip6tables-save > /etc/iptables/rules.v6
|
||||||
Loading…
Reference in New Issue
Block a user