#! /bin/sh
# /etc/rc.d/rc.firewall
# This script is used to bring up the various network interfaces.
#
# Parameters:
# rc.firewall start|restart|stop|block <interface-name>
#

IFNAME=$2
IPADDR=`ifconfig $IFNAME | sed -n 's/^.*inet addr.\([^ ]*\).*$/\1/p'`

firewall_start() {
  # Set kernel configuration parameters - safe for everyone
  echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
  echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
  echo 0 > /proc/sys/net/ipv4/conf/all/secure_redirects
  echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
  echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
  echo 0 > /proc/sys/net/ipv4/ip_forward
  #
  # Flush tables and set default policies
  iptables -P INPUT DROP
  iptables -P OUTPUT ACCEPT
  iptables -P FORWARD DROP
  iptables -F
  iptables -X
  iptables -Z
  #
  # Drop known-bad traffic as early as possible
  iptables -A INPUT -p igmp -j DROP
  iptables -A INPUT -s 244.0.0.1 -j DROP
  iptables -A INPUT -m pkttype --pkt-type broadcast -j DROP
  iptables -A INPUT -p icmp -f -j DROP
  iptables -A INPUT -m state --state INVALID -j DROP
  iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
  #
  # Drop the various xmastree scans
  iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
  iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
  iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
  iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
  iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
  iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
  #
  # Drop spoofed traffic (appearing to come from myself but doesnt)
  iptables -A INPUT -i $IFNAME -s $IPADDR -j DROP
  #
  # Set up logic trees for blocking DNS not from ISP DNS
  for i in `cat /etc/resolv.conf | grep "^nameserver" | awk '{print $2}'`
  do
     iptables -A INPUT -p udp --dport 53 --sport 53 \
     -s $i -j ACCEPT
  done
  iptables -A INPUT -p udp --dport 53 --sport 53 \
     -j DROP
  #
  # Set up logic trees for allowing only legal DHCP
  for i in /etc/dhcpc/dhcpcd-*.info
  do
     iptables -A INPUT -p udp --sport 67 --dport 68 \
     -s  `grep DHCPSID $i | sed 's/DHCPSID=//g'` -j ACCEPT
  done
  iptables -A INPUT -p udp --sport 67 --dport 68 -j DROP
  #
  # SSH: stop the script kiddies - only one new connection each 30 seconds
  iptables -A INPUT -p tcp -m state --state NEW --dport 22 -m recent --update --seconds 30 -j DROP
  iptables -A INPUT -p tcp -m state --state NEW --dport 22 -m recent --set -j ACCEPT
  #
  # Peer-to-Peer
  iptables -A INPUT -p tcp --dport 4661:4662 -d $IPADDR -j ACCEPT
  iptables -A INPUT -p tcp --dport 4242:4242 -d $IPADDR -j ACCEPT
  #
  # Allow local traffic - other may want to leave this out! WARNING! MUST TRUST NETWORK
  iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT
  #
  # This is for ICQ/AOL/MSN file transfers
  # Notice they're limited to port, protocol, and syn
  # (since we block state NEW ! --syn)
  iptables -A INPUT -p tcp --dport 5001:5100 \
     --syn -j ACCEPT
  iptables -A INPUT -p tcp --dport 6891:6900 \
     --syn -j ACCEPT
  #
  # Stateful inspection, just like the PIX
  iptables -A INPUT -i lo -j ACCEPT
  iptables -A INPUT -p tcp -m state \
     --state ESTABLISHED,RELATED -j ACCEPT
  iptables -A INPUT -p udp -m state \
     --state ESTABLISHED,RELATED -j ACCEPT
  iptables -A INPUT -p icmp -m state \
     --state ESTABLISHED,RELATED -j ACCEPT
  iptables -A INPUT -p icmp --icmp-type 8 -m limit \
     --limit 1/second -j ACCEPT
}

firewall_stop() {
  # Stopping firewall by opening all ports accepting all packets
  iptables -P INPUT ACCEPT
  iptables -P OUTPUT ACCEPT
  iptables -P FORWARD ACCEPT
  iptables -F
  iptables -X
  iptables -Z
}

firewall_block() {
  # Blocking ALL internet traffic by dropping all packets
  iptables -P INPUT DROP
  iptables -P OUTPUT DROP
  iptables -P FORWARD DROP
  iptables -F
  iptables -X
  iptables -Z
}

firewall_simple() {
  iptables -P INPUT DROP
  iptables -P OUTPUT ACCEPT
  iptables -P FORWARD DROP
  iptables -F
  iptables -X
  iptables -Z
  iptables -A INPUT -i lo -j ACCEPT
  iptables -A INPUT -p igmp -j DROP
  iptables -A INPUT -p icmp -f -j DROP
  iptables -A INPUT -m state --state INVALID -j DROP
  iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
  iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
  iptables -A INPUT -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT
  iptables -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT
  iptables -A INPUT -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT
}

firewall_restart() {
  firewall_block
  sleep 1
  firewall_start
}

case "$1" in
'start')
  echo "Starting Firewall ($IFNAME)..."
  firewall_start
  ;;
'stop')
  echo "Stopping Firewall ($IFNAME)..."
  firewall_stop
  ;;
'block')
  echo "BLOCKING FIREWALL ($IFNAME)..."
  firewall_block
  ;;
'restart')
  echo "Restarting Firewall ($IFNAME)..."
  firewall_restart
  ;;
*)
  echo "usage $0 start|stop|restart|block <ifname>"
esac