Anything and Nothing

Well this is a simple script that I used to use as my main means of protection in the days before the Linksys WRT54G v3, which currently runs my home network.

#!/bin/sh######################################## Script created by Boris Kurktchiev# techDOTbkurkATgmail.com.	# Thanks to StrIkeR_MaN and Chris for helping me # make the script work properly # strikerUNDERSCOREmanATnaskooskov.org	########################################Setup Variables.IPC=/usr/sbin/iptablesIF=ppp0LOG="iplog -i $IF -w -d -l /var/log/iplogs"

#printf "."

#Turn on source address verification in kernelif [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then  for f in /proc/sys/net/ipv4/conf/*/rp_filter; do    echo 1 > $f  donefi#printf "."

#Turn on syn cookies protection in kernelif [ -e /proc/sys/net/ipv4/tcp_syncookies ] then  echo 1 > /proc/sys/net/ipv4/tcp_syncookiesfi#printf "."

#Set up kernel to handle dynamic IP masqueradingif [ -e /proc/sys/net/ipv4/ip_dynaddr ] then  echo 1 > /proc/sys/net/ipv4/ip_dynaddrfi#printf "."

#Flushing all previsouly created chains.$IPC -F$IPC -X$IPC -t nat -F$IPC -t nat -X#printf "."

#Set the default rules to drop.$IPC -P OUTPUT ACCEPT$IPC -A INPUT -i $IF -j DROP

#Internet Sharing and Firewall starts from this point on$IPC -t nat -A POSTROUTING -o ppp0 -j MASQUERADE$IPC -A FORWARD -i eth0 -j ACCEPT$IPC -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT$IPC -A FORWARD -m limit --limit 60/minute --limit-burst 60#printf "."

#Creating Logs for each chain.$IPC -N LDROP

$IPC -A LDROP -p tcp -j LOG --log-level 3 --log-prefix "DROP"$IPC -A LDROP -p udp -j LOG --log-level 3 --log-prefix "DROP"$IPC -A LDROP -p icmp -j LOG --log-level 3 --log-prefix "DROP"$IPC -A LDROP -f -j LOG --log-level 3 --log-prefix "DROP"$IPC -A LDROP -j DROP$IPC -N LREJECT$IPC -A LREJECT -p tcp -j LOG --log-level 3 --log-prefix "REJECT"$IPC -A LREJECT -p udp -j LOG --log-level 3 --log-prefix "REJECT"$IPC -A LREJECT -p icmp -j LOG --log-level 3 --log-prefix "REJECT"$IPC -A LREJECT -f -j LOG --log-level 3 --log-prefix "REJECT"$IPC -A LREJECT -j REJECT$IPC -N LACCEPT$IPC -A LACCEPT -p tcp -j LOG --log-level 3 --log-prefix "ACCEPT"$IPC -A LACCEPT -p udp -j LOG --log-level 3 --log-prefix "ACCEPT"$IPC -A LACCEPT -p icmp -j LOG --log-level 3 --log-prefix "ACCEPT"$IPC -A LACCEPT -f -j LOG --log-level 3 --log-prefix "ACCEPT"$IPC -A LACCEPT -j ACCEPT$IPC -N TREJECT$IPC -A TREJECT -p tcp -j REJECT --reject-with tcp-reset$IPC -A TREJECT -p ! tcp -j REJECT --reject-with icmp-port-unreachable$IPC -A TREJECT -j REJECT$IPC -N LTREJECT$IPC -A LTREJECT -p tcp -j REJECT --reject-with tcp-reset$IPC -A LTREJECT -p ! tcp -j REJECT --reject-with icmp-port-unreachable$IPC -A LTREJECT -p tcp -j LOG --log-level 3 --log-prefix "REJECT "$IPC -A LTREJECT -p udp -j LOG --log-level 3 --log-prefix "REJECT "$IPC -A LTREJECT -p icmp -j LOG --log-level 3 --log-prefix "REJECT "$IPC -A LTREJECT -f -j LOG --log-level 3 --log-prefix "REJECT "$IPC -A LTREJECT -p tcp -j REJECT --reject-with tcp-reset$IPC -A LTREJECT -p ! tcp -j REJECT --reject-with icmp-port-unreachable$IPC -A LTREJECT -j REJECT#printf "."

#Allowing trafic on the lo (loopback) device$IPC -I INPUT -i lo -j ACCEPT$IPC -I OUTPUT -o lo -j ACCEPT$IPC -I INPUT -i ! lo -s 127.0.0.0/255.0.0.0 -j DROP#printf "."

#Allow connections with the ack bit set.#(They are from an established connections)#This is a problematic area since it can lead to#ack floood, so if anyone knows how to enable this in a#more secure fasion drop me an e-mail at techstuff@gmx.net$IPC -A INPUT -p tcp ! --syn -i $IF -j ACCEPT#printf "."

#Block nonroutable IPs$IPC -A INPUT -j DROP -s 10.0.0.0/8 -i $IF$IPC -A INPUT -j DROP -s 127.0.0.0/8 -i $IF$IPC -A INPUT -j DROP -s 172.16.0.0/12 -i $IF$IPC -A INPUT -j DROP -s 192.168.1.0/16 -i $IF#printf "."

#Block Multicast$IPC -A INPUT -s 224.0.0.0/8 -d 0/0 -j DROP$IPC -A INPUT -s 0/0 -d 224.0.0.0/8 -j DROP#printf "."

#Block Back Orifice$IPC -A INPUT -p tcp -i $IF --dport 31337 -j LDROP$IPC -A INPUT -p udp -i $IF --dport 31337 -j LDROP#printf "."

#Block NetBus$IPC -A INPUT -p tcp -i $IF --dport 12345:12346 -j LDROP$IPC -A INPUT -p udp -i $IF --dport 12345:12346 -j LDROP#printf "."

#Block Trin00$IPC -A INPUT -p tcp -i $IF --dport 1524 -j LDROP$IPC -A INPUT -p tcp -i $IF --dport 27665 -j LDROP$IPC -A INPUT -p udp -i $IF --dport 27444 -j LDROP$IPC -A INPUT -p udp -i $IF --dport 31335 -j LDROP#printf "."

#If you can send me ports to more backdoors and things like that #I will include them here.

#Rejecting (not denying) ident requests.$IPC -A INPUT -p tcp -i $IF --dport 113 -j TREJECT$IPC -A INPUT -p udp -i $IF --dport 113 -j TREJECT#printf "."

#Blocking access to the X Server ports.$IPC -A INPUT -p tcp -i $IF --dport 5999:6003 -j LDROP$IPC -A INPUT -p udp -i $IF --dport 5999:6003 -j LDROP$IPC -A INPUT -p tcp -i $IF --dport 7100 -j LDROP#printf "."

#Set telnet, www, smtp, pop3 and FTP for minimum delay$IPC -t mangle -A OUTPUT -p tcp --dport 22 -j TOS --set-tos Minimize-Delay$IPC -t mangle -A OUTPUT -p tcp --dport 23 -j TOS --set-tos Minimize-Delay$IPC -t mangle -A OUTPUT -p tcp --dport 110 -j TOS --set-tos Minimize-Delay#printf "."

#Open ports for established connections#This might be a bit obsolute so if you think I should delete it please#feel free to e-mail me at techstuff@gmx.net$IPC -A INPUT -m state --state ESTABLISHED -j ACCEPT$IPC -A INPUT -m state --state RELATED -j ACCEPT$IPC -A INPUT -p tcp -i $IF --dport 1023:65535 -j ACCEPT$IPC -A INPUT -p udp -i $IF --dport 1023:65535 -j ACCEPT#printf "."

#Allow ICMP to go out and not in(before enableing this see the below icmp rules).#$IPC -A INPUT -p icmp -i $IF -j LDROP#if you do enable it tought you are going to have to comment in the lines below..# ICMP rules, allow the bare essential types of ICMP only. Ping# request is blocked, ie we won't respond to someone else's pings,# but can still ping out.$IPC -A INPUT  -p icmp  --icmp-type echo-reply -s 0/0 -i $IF -j ACCEPT$IPC -A INPUT  -p icmp  --icmp-type destination-unreachable -s 0/0 -i $IF -j ACCEPT$IPC -A INPUT  -p icmp  --icmp-type time-exceeded -s 0/0 -i $IF -j ACCEPT$IPC -A OUTPUT -p icmp -o $IF -j ACCEPT#Block incoming traceroute calls (the machine cannot be tracerouted).$IPC -A INPUT -p udp -s 0/0 -i $IF --dport 33435:33525 -j DROP#printf "."

#Turn On Iplog (you need to install this in order for it to work for you)#go to www.freshmeat.net and search for iplog.#this might not work on slack 8.1 and 9.0beta* because of updated tcp#lib and since iplog has not been updated in a while it does not#support the new feautures the lib has... if anyone can tell me of a good replacement#for it send me and e-mail at techDOTbkurkATgmail.com#$LOG#printf ".\n"

#printf "Your Internet Connection is up and running. IP logs can be #found in /var/log/iplogs.\n"

#BTW, all the logs that we created in the beginning can be found in#/var/log/messages , iplog was a fancier way to extract them and view#them.