Raspberry Pi Firewall/IPS/DNS-RPZ

loginscript.sh

#!/bin/bash
# Kevin Law
# prepare iptables and start snort based on wlan0 address
# Used for portable raspi firewall/ips

# Get ip in CIDR notation for wlan0 interface
LOCALIP=`ip addr show |grep -w inet |grep -v 127.0.0.1|grep -v 10.11.12.13|awk '{ print $2}'`

# Edit the snort conf to have that ip
sed -i '/DEBIAN_SNORT_HOME_NET/d' /etc/snort/snort.debian.conf
echo "DEBIAN_SNORT_HOME_NET=$LOCALIP" >> /etc/snort/snort.debian.conf
service snort start

# Define network interfaces
EXTIF="wlan0"
INTIF="eth0"
#
# Flushing out existing iptables entries
iptables -P INPUT ACCEPT
iptables -F INPUT
iptables -P OUTPUT ACCEPT
iptables -F OUTPUT
iptables -P FORWARD DROP
iptables -F FORWARD
iptables -t nat -F
#
# Allow all outbound traffic and only allow established and related connections back in
iptables -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
iptables -A FORWARD -j LOG
#
# Masquerade NAT functionality on $EXTIF
iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
#
# Allows ssh inbound connections
iptables -A INPUT -p tcp --dport ssh -j ACCEPT
#
# Allows lo interface to work
iptables -A INPUT -i lo -j ACCEPT
#
# Default DROP
#iptables -A INPUT -i $EXTIF -j DROP