iptables.bash

#!/bin/bash

# In case for whatever reason the paths change...
IPTABLES=/sbin/iptables
IP6TABLES=/sbin/ip6tables

# RULE CREATION ORDER
#       ALL rules are added as created here
#       V4      rules are added as created here
#       V6      rules are added as created here

# Try and always create new chains in the ALL ruleset
# Try and always create chains - then you can do need things like graph them

# You can use chains to get arround the fact that v4/v6 only rules are added late - see the ssh_restricted chains as an example

# By Default OUTPUT is ACCEPT
# By Default INPUT is DROP unless they have STATE ESTABLISHED or STATE RELATED
# By Default FORWARD is DROP
# By Default lo is ACCEPT

# To make easier managment, we will add all the rules to arrays, then process those later
# This also allows us to create IPv4 and IPv6 rules at the same time
declare -a ALL  # both IPv4 and IPv6 rules added
declare -a V4   # ONLY IPv4 rules added
declare -a V6   # ONLY IPv6 rules added

# Flush the tables - its easier to work with a blank slate
ALL[${#ALL[@]}]="-F"

# Dont accept incomming connections
ALL[${#ALL[@]}]="-P INPUT DROP"
ALL[${#ALL[@]}]="-P FORWARD DROP"
# Out going connects are ok though
ALL[${#ALL[@]}]="-P OUTPUT ACCEPT"

# Accept anythin on the loopback interface
ALL[${#ALL[@]}]="-A INPUT -i lo -j ACCEPT"

###########################
###### Some basic ip address and ranges to help secure SSH access
###########################
ALL[${#ALL[@]}]="-N ssh_restrict"
V4[${#V4[@]}]='-A ssh_restrict -s 192.168.0.0/16 -j ACCEPT -m comment --comment "LCC Internal Network"'
V4[${#V4[@]}]='-A ssh_restrict -s 203.122.251.73 -j ACCEPT -m comment --comment "LCA SA/NT District Office"'


###########################
###### SSH
###########################
ALL[${#ALL[@]}]="-N SSH"
ALL[${#ALL[@]}]="-A SSH -m state --state NEW -j ssh_restrict"
ALL[${#ALL[@]}]="-A INPUT -m tcp -p tcp --dport 22 -j SSH"

ALL[${#ALL[@]}]="-N SSH_OUT"
ALL[${#ALL[@]}]="-A OUTPUT -m tcp -p tcp --sport 22 -m state --state ESTABLISHED -j SSH_OUT"

###########################
###### FTP
###########################
ALL[${#ALL[@]}]="-N FTP"
ALL[${#ALL[@]}]="-A FTP -m state --state NEW -j ACCEPT"
ALL[${#ALL[@]}]="-A INPUT -m tcp -p tcp --dport 20 -j FTP"
ALL[${#ALL[@]}]="-A INPUT -m tcp -p tcp --dport 21 -j FTP"
ALL[${#ALL[@]}]="-A INPUT -m tcp -p tcp --dport 41000:41100 -j FTP"

ALL[${#ALL[@]}]="-N FTP_OUT"
ALL[${#ALL[@]}]="-A OUTPUT -m tcp -p tcp --sport 20 -m state --state ESTABLISHED -j FTP_OUT"
ALL[${#ALL[@]}]="-A OUTPUT -m tcp -p tcp --sport 21 -m state --state ESTABLISHED -j FTP_OUT"
ALL[${#ALL[@]}]="-A OUTPUT -m tcp -p tcp --sport 41000:41100 -m state --state ESTABLISHED -j FTP_OUT"

###########################
###### SMTP
###########################
ALL[${#ALL[@]}]='-N SMTP'
ALL[${#ALL[@]}]="-A SMTP -m state --state NEW -j ACCEPT"
ALL[${#ALL[@]}]="-A INPUT -m tcp -p tcp --dport 25 -j SMTP"

ALL[${#ALL[@]}]='-N SNMP_OUT'
ALL[${#ALL[@]}]="-A OUTPUT -p tcp -m tcp --sport 25 -m state --state ESTABLISHED -j SNMP_OUT"

###########################
###### IMAP/POP3
###########################
ALL[${#ALL[@]}]='-N MAIL'
ALL[${#ALL[@]}]="-A MAIL -m state --state NEW -j ACCEPT"
ALL[${#ALL[@]}]="-A INPUT -m tcp -p tcp --dport 110 -j MAIL"
ALL[${#ALL[@]}]="-A INPUT -m tcp -p tcp --dport 143 -j MAIL"
ALL[${#ALL[@]}]="-A INPUT -m tcp -p tcp --dport 993 -j MAIL"
ALL[${#ALL[@]}]="-A INPUT -m tcp -p tcp --dport 995 -j MAIL"

ALL[${#ALL[@]}]='-N MAIL_OUT'
ALL[${#ALL[@]}]="-A OUTPUT -m tcp -p tcp --sport 110 -m state --state ESTABLISHED -j MAIL_OUT"
ALL[${#ALL[@]}]="-A OUTPUT -m tcp -p tcp --sport 143 -m state --state ESTABLISHED -j MAIL_OUT"
ALL[${#ALL[@]}]="-A OUTPUT -m tcp -p tcp --sport 993 -m state --state ESTABLISHED -j MAIL_OUT"
ALL[${#ALL[@]}]="-A OUTPUT -m tcp -p tcp --sport 995 -m state --state ESTABLISHED -j MAIL_OUT"

###########################
###### HTTP
###########################
ALL[${#ALL[@]}]='-N HTTP'
ALL[${#ALL[@]}]="-A HTTP -m state --state NEW -j ACCEPT"
ALL[${#ALL[@]}]="-A INPUT -p tcp -m tcp --dport 80 -j HTTP"
ALL[${#ALL[@]}]="-A INPUT -p tcp -m tcp --dport 443 -j HTTP"

ALL[${#ALL[@]}]='-N HTTP_OUT'
ALL[${#ALL[@]}]="-A OUTPUT -p tcp -m tcp --sport 80 -m state --state ESTABLISHED -j HTTP_OUT"
ALL[${#ALL[@]}]="-A OUTPUT -p tcp -m tcp --sport 443 -m state --state ESTABLISHED -j HTTP_OUT"

###########################
###### SNMP
###########################
ALL[${#ALL[@]}]='-N SNMP'
ALL[${#ALL[@]}]="-A SNMP -m state --state NEW -j ssh_restrict"
ALL[${#ALL[@]}]="-A INPUT -p tcp -m tcp --dport 161 -j SNMP"
ALL[${#ALL[@]}]="-A INPUT -p udp -m udp --dport 161 -j SNMP"

ALL[${#ALL[@]}]='-N SNMP_OUT'
ALL[${#ALL[@]}]="-A OUTPUT -p tcp -m tcp --sport 161 -m state --state ESTABLISHED -j SNMP_OUT"
ALL[${#ALL[@]}]="-A OUTPUT -p udp -m udp --sport 161 -m state --state ESTABLISHED -j SNMP_OUT"

###########################
###### MySQL
###########################
ALL[${#ALL[@]}]='-N MySQL'
ALL[${#ALL[@]}]="-A MySQL -m state --state NEW -j ssh_restrict"
ALL[${#ALL[@]}]="-A INPUT -p tcp -m tcp --dport 3306 -j MySQL"

ALL[${#ALL[@]}]='-N MySQL_OUT'
ALL[${#ALL[@]}]="-A OUTPUT -p tcp -m tcp --sport 3306 -m state --state ESTABLISHED -j MySQL_OUT"

###########################
###### CORE
###########################
ALL[${#ALL[@]}]="-A INPUT -p icmp -m state --state NEW -j ACCEPT"
ALL[${#ALL[@]}]="-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT"
ALL[${#ALL[@]}]='-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7'
ALL[${#ALL[@]}]="-A INPUT -j DROP"

echo "#!/bin/bash" > ./iptables.run.bash

for rule in "${ALL[@]}"; do
  echo $IPTABLES $rule >> ./iptables.run.bash
  echo $IP6TABLES $rule >> ./iptables.run.bash
done

for rule in "${V4[@]}"; do
  echo $IPTABLES $rule >> ./iptables.run.bash
done

for rule in "${V6[@]}"; do
  echo $IP6TABLES $rule >> ./iptables.run.bash
done

echo >> ./iptables.run.bash
chmod u+x ./iptables.run.bash