configure-firewall.sh

#!/bin/bash
temp_ruleset=$(mktemp)
nginx_ruleset="# Generated by iptables-save v1.4.21 on Fri Jan  9 18:21:29 2015
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
COMMIT"

node_ruleset="# Generated by iptables-save v1.4.12 on Tue Oct 21 17:32:08 2014
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -m state --state NEW -j DROP
-A INPUT -p icmp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Tue Oct 21 17:32:08 2014"

db_ruleset="# Generated by iptables-save v1.4.12 on Tue Oct 21 17:32:08 2014
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -m state --state NEW -j DROP
-A INPUT -p icmp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4444 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4567 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4568 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp -m multiport --dports 22,3306,4444,4567,4568 -s 10.132.130.149 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp -m multiport --dports 22,3306,4444,4567,4568 -s 10.132.131.249 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp -m multiport --dports 22,3306,4444,4567,4568 -s 10.132.131.252 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp -m multiport --dports 22,3306,4444,4567,4568 -s 10.132.131.247 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Tue Oct 21 17:32:08 2014"

usage() {
    echo "Usage: $0 -t [nginx|node|db]" > /dev/stderr
    exit
}    

check_uid() {
    if [[ $(id -u) -ne 0 ]]; then
        echo "Must be ran as root" > /dev/stderr 
        exit
    fi
}

import_rules() {
    iptables-restore  "$temp_ruleset"
    
    rc=$?
    if [[ $rc -ne 0 ]]; then
        echo "ERROR: Firwall rules not imported" > /dev/stderr
        if [[ $rc -eq 2 ]]; then
            echo "ERROR: Syntax error in ruleset" > /dev/stderr
        fi
    fi
}    

cleanup() {
    rm -rf "$temp_ruleset"
}

enable_persistence() {
    iptables-save > /etc/sysconfig/iptables 

    grep -qi 'iptables-restore' /etc/rc.local
    rc=$?
    if [[ $rc -ne 0 ]]; then
        echo "iptables-restore < /etc/sysconfig/iptables" >> /etc/rc.local
        chmod +x /etc/rc.local
    fi
}

check_uid

if [[ $# -ne 2 ]]; then
    echo "ERROR: Server type not specified" > /dev/stderr
    usage
fi

while getopts ":t:" opt; do
    case "$opt" in
        t)
            server_type=$OPTARG
            if ! [[ $server_type =~ (nginx|node|db) ]]; then
                echo "ERROR: Server type not recognized" > /dev/stderr
                usage
            fi
            ;;
        *)
            echo "ERROR: use -t to specify server type" > /dev/stderr
            usage
            ;;
    esac
done

if [[ $server_type == "nginx" ]]; then
    echo "$nginx_ruleset" > "$temp_ruleset"
    import_rules
    cleanup
fi
if [[ $server_type == "node" ]]; then
    echo "$node_ruleset" > "$temp_ruleset"
    import_rules
    cleanup
fi
if [[ $server_type == "db" ]]; then
    echo "$db_ruleset" > "$temp_ruleset"
    import_rules
    cleanup
fi

enable_persistence
echo 'Done'