7 ############# Define variables
8 set IFCONFIG "/sbin/ifconfig"
14 set MASK "29" # Our netmask is /29 = 255.255.255.248
15 set IPS "64.20.38.170"
17 set IPSPEC "64.20.38.170/%MASK"
19 set NSIP `%CAT /etc/resolv.conf | %GREP nameserver | %AWK '{print $2}'`
20 #set NTPIP `%CAT /etc/ntp.conf | %GREP server | %AWK '{print $2}'`
22 ############# Port/protocol combinations we allow in and out
23 set TCP_IN "ssh,smtp,auth,www,ssmtp,https,imap,imaps,pop3,pop3s"
24 set TCP_OUT_DELAY "ssh,ftp"
25 set TCP_OUT_RELIABILITY "http,nntp,smtp,pop3,auth,domain"
26 set TCP_OUT_THROUGHPUT "ftp-data,napster,napserv"
32 set ICMP_IN "ping,pong,destination-unreachable,source-quench,time-exceeded,parameter-problem"
33 set ICMP_OUT "ping,pong,fragmentation-needed,source-quench,parameter-problem"
36 # Make us insensitive to the environment
38 table filter chain (INPUT FORWARD);
39 table mangle chain (PREROUTING);
40 table nat chain (PREROUTING POSTROUTING);
43 table filter chain (OUTPUT);
44 table mangle chain (OUTPUT);
45 table nat chain (OUTPUT);
49 ######################################################################
50 # Built-in chains that jump to our custom ones
54 state INVALID goto UNUSUAL DROP;
55 fragment goto UNUSUAL DROP;
61 state (ESTABLISHED,RELATED) ACCEPT;
63 if lo saddr 127.0.0.1/8 daddr 127.0.0.1/8 ACCEPT;
64 if lo goto UNUSUAL DROP;
66 #incoming traffic, seperate by interface
69 protocol tcp goto fw_tcp;
70 protocol udp goto fw_udp;
71 protocol icmp goto fw_icmp;
77 state INVALID goto UNUSUAL DENY;
78 fragment goto UNUSUAL DENY;
80 state (ESTABLISHED,RELATED) ACCEPT;
82 of lo saddr 127.0.0.1/8 daddr 127.0.0.1/8 ACCEPT;
83 of lo goto UNUSUAL DENY;
85 saddr !%IPSPEC goto UNUSUAL DENY;
87 # again uncomment for trojan horses protection and inside out
89 proto (tcp,udp) sport 14000: goto LDENY;
91 # queueing goes here, maybe some special fw rules as well
92 proto tcp goto tosqueue; # ACCEPT must be handled here
94 proto udp dport %UDP_OUT ACCEPT;
95 proto icmp icmptype %ICMP_OUT ACCEPT;
98 #####################################################################
99 # Deal with known offenders right away
100 # Make difference between notorious ones and unusual ones
102 #saddr spammer.net.com DROP; # you may specify computer names as well
103 saddr 10/8 DROP; # or network addresses like this impossible one
104 daddr 10/8 DROP; # maybe even from guys fooling you around
105 saddr 123.45.6.78 DROP; # a single machine, very bad
106 saddr 123.45.6/24 DROP; # better to include the entire subnet
109 # Mailbombing nion's email
114 # Executed nion's CGI script 400,000 times
117 # docelic, Wed Aug 3 04:18:56 EDT 2005
118 # Trying out new server with all kinds of usernames on ssh
119 # (All of those seem to be from the same "mastermind")
126 # Log says reverse mapping failed for this address
127 # (hundreds of entries)
134 #####################################################################
136 chain fw_tcp proto tcp {
138 # Standard allowances
139 syn dport %TCP_IN sport 1024: {
141 limit 5/m LOG log-prefix "SYN flood attack:" LOG;
145 # drop all syns: (incoming connections)
147 log-prefix "tcp SYN Dropped" LOG;
152 log-prefix "TCP packet not syn std port" LOG;
156 # deny scanning via DNS port
162 # special case to allow active ftp transfers to our machine!
163 sport ftp-data dport 1024: {
167 # awkward incoming connections
177 # want to deny inside-out fake stuff? uncomment this:
178 # (see /proc/sys/net/ipv4/ip_local_port_range ): Tune the file to 13999 !
184 #####################################################################
186 chain fw_udp proto udp {
188 # Standard allowances
189 dport %UDP_IN sport 1024: {
193 # again no dns fumbling around
194 sport domain dport domain saddr %NSIP {
201 #####################################################################
203 chain fw_icmp proto icmp {
205 # Standard allowances
210 #icmp-type echo-request limit 1/s ACCEPT;
211 #icmptype ( ping pong destination-unreachable time-exceeded) {
214 # never seen hits on this one:
219 #####################################################################
220 # TOS (Type-of-service) adjustments
223 protocol tcp reverse {
224 # rapid response protocols
225 dport %TCP_OUT_DELAY settos min-delay ACCEPT;
226 # keep these from timing out
227 dport %TCP_OUT_RELIABILITY settos max-reliability ACCEPT;
229 dport %TCP_OUT_THROUGHPUT settos max-throughput ACCEPT;
230 dport (ftp-data,8888,6699) settos max-throughput ACCEPT;
233 proto tcp dport %TCP_OUT_COST settos min-cost ACCEPT;
236 #####################################################################
240 log-level info logprefix "Dropped";
241 log-level warn fragment log-prefix "FRAGMENT Dropped";
247 LOG { log-level info logprefix "Unusual"; }
252 log-level info proto tcp logprefix "Denied";
253 log-level warn fragment log-prefix "FRAGMENT Denied";
260 syn limit 100/s ACCEPT;
263 logprefix "Mismatch in TCPACCEPT" LOG;
269 logprefix "Mismatch in UDPACCEPT" LOG;
276 # saddr %IANA_BANS DROP;
280 # saddr %LOCAL_BANS DROP;
285 tcp-flags FIN:SYN:RST:PSH:ACK:URG NONE {
286 limit 5/min log-prefix "NULL SCAN:" log-level 5
287 log-tcp-options log-ip-options LOG;
290 tcp-flags FIN:SYN:RST:PSH:ACK:URG FIN:PSH:URG {
291 limit 5/min log-prefix "NMAP-XMAS Portscan:" log-level 5 LOG;
294 tcp-flags SYN:RST SYN:RST {
295 limit 5/min log-prefix "SYN/RST Portscan:" log-level 5 LOG;
298 tcp-flags FIN:SYN FIN:SYN {
299 limit 5/min log-prefix "SYN/FIN Portscan:" log-level 5 LOG;