A question on my firewall script...

trist007 · 01-29-2009, 01:21 PM

I'm running Slackware 12.0 and I'm trying to block some IPs from accessing my apache web server.

My rc.FireWall script looks like this. I've put several IPs in there that I want to block. Yet, I still get http requests from these IPs...
Also, what's the difference from rc.FireWall and rc.FireWall~ ?
Which one gets used. Anyhow I usually start the script with

rc.FireWall stop
rc.FireWall start

Code:

#!/bin/bash
#
# usage: rc.firewall start|stop|status
#
# Simple firewall disallowing all incomming connections
# but allowing all traffic on localhost (lo device)
# and allowing all outgoing traffic for $ALLOWED_PORTS
# (you can set the variable below)
#
# Author: Tomas M. <http://slax.linux-live.org/>
#
ALLOWED_PORTS="20 21 22 25 80 110 143 443"
#-----------------------------------------------------------

if [ "$1" = "start" ]; then

   SYSCTLW="/sbin/sysctl -q -w"
   IPTABLES="/usr/sbin/iptables"

   # Disable routing triangulation. Respond to queries out
   # the same interface, not another. Helps to maintain state
   # Also protects against IP spoofing

   $SYSCTLW net.ipv4.conf.all.rp_filter=1

   # Enable logging of packets with malformed IP addresses,
   # Disable redirects,
   # Disable source routed packets,
   # Disable acceptance of ICMP redirects,
   # Turn on protection from Denial of Service (DOS) attacks,
   # Disable responding to ping broadcasts,
   # Enable IP routing. Required if your firewall is protecting a network, NAT included

   $SYSCTLW net.ipv4.conf.all.log_martians=1
   $SYSCTLW net.ipv4.conf.all.send_redirects=0
   $SYSCTLW net.ipv4.conf.all.accept_source_route=0
   $SYSCTLW net.ipv4.conf.all.accept_redirects=0
   $SYSCTLW net.ipv4.tcp_syncookies=1
   $SYSCTLW net.ipv4.icmp_echo_ignore_broadcasts=1
   $SYSCTLW net.ipv4.ip_forward=1

   # Firewall initialization, remove everything, start with clean tables
   $IPTABLES -F      # remove all rules
   $IPTABLES -X      # delete all user-defined chains

   # allow everything for loop device
   $IPTABLES -A INPUT -i lo -j ACCEPT
   $IPTABLES -A OUTPUT -j ACCEPT

   # allow DNS in all directions
   $IPTABLES -A INPUT -p udp --dport 53 -j ACCEPT
   $IPTABLES -A INPUT -p udp --sport 53 -j ACCEPT

   # Allow previously established connections
   $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

   for PORT in $ALLOWED_PORTS; do
      $IPTABLES -A INPUT -p tcp --dport $PORT -j ACCEPT
   done

   # Create a chain for logging all dropped packets
   $IPTABLES -N LOG_DROP
#  $IPTABLES -A LOG_DROP -j LOG --log-prefix "Attack log: "
   $IPTABLES -A LOG_DROP -j DROP

   $IPTABLES -A INPUT -j LOG_DROP    # drop all incomming
   
   # Drop packets coming from specific IP addresses
   $IPTABLES -I INPUT -s 222.187.221.88 -j DROP
   $IPTABLES -I INPUT -s 82.98.141.7 -j DROP
   $IPTABLES -I INPUT -s 8.11.254.248 -j DROP
   $IPTABLES -I INPUT -s 66.154.97.57 -j DROP
   $IPTABLES -I INPUT -s 74.95.163.5 -j DROP
   $IPTABLES -I INPUT -s 195.140.202.142 -j DROP
   $IPTABLES -I INPUT -s 67.29.139.234 -j DROP
   $IPTABLES -I INPUT -s 78.109.19.178 -j DROP
   $IPTABLES -I INPUT -s 85.204.12.16 -j DROP



   $IPTABLES -A FORWARD -j LOG_DROP  # drop all forwarded

elif [ "$1" = "stop" ]; then
   iptables -F
   iptables -X
   iptables -P OUTPUT ACCEPT
   iptables -P FORWARD ACCEPT
   iptables -P INPUT ACCEPT

elif [ "$1" = "status" ]; then
   iptables -L -v

else
   echo "usage: $0 start|stop|status"
fi