решил немного изменить вид цепочек. Пока внешний вид такой:
Код:
#!/bin/sh
EXT_DEV="eth2"
EXT_DEV_IP="ххх.ххх.ххх.ххх"
INT_DEV1="eth0"
INT_DEV1_IP="192.168.1.2"
INT_DEV2="eth1"
INT_DEV2_IP="192.168.2.2"
LO_DEV="lo"
LO_DEV_IP="127.0.0.1"
IPTABLES="/sbin/iptables"
## Needed to initially load modules
/sbin/depmod -a
# Required modules
/sbin/modprobe xt_connlimit
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
/sbin/modprobe ip_conntrack_amanda
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_owner
/sbin/modprobe ipt_MASQUERADE
/sbin/modprobe ipt_geoip
# Required proc configuration
echo "30" > /proc/sys/net/ipv4/tcp_fin_timeout
echo "3600" > /proc/sys/net/ipv4/tcp_keepalive_time
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/tcp_syn_retries
echo "1" > /proc/sys/net/ipv4/tcp_keepalive_probes
echo "2" > /proc/sys/net/ipv4/tcp_synack_retries
# flush all the rules in the filter and nat tables.
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F
# erase all chains that's not default in filter and nat table.
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X
# reset the default policies in the mangle table.
$IPTABLES -t mangle -P PREROUTING ACCEPT
$IPTABLES -t mangle -P INPUT ACCEPT
$IPTABLES -t mangle -P OUTPUT ACCEPT
$IPTABLES -t mangle -P FORWARD ACCEPT
$IPTABLES -t mangle -P POSTROUTING ACCEPT
# reset the default policies in the nat table.
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT
# Set policies
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP
#is open for test
$IPTABLES -A INPUT -p TCP -s 0/0 --dport 22222 -j ACCEPT
#bogons chain
$IPTABLES -N bogons
for host in `cat /etc/sysconfig/ip.deny.bogons`; do
$IPTABLES -A bogons -s $host -j DROP
done
#list banned IP in file ip.deny
$IPTABLES -N black_ip
for host in `cat /etc/sysconfig/ip.deny`; do
$IPTABLES -A black_ip -s $host -i $EXT_DEV -j DROP
done
# ICMP chain
$IPTABLES -N icmp_ddos
$IPTABLES -A icmp_ddos -p ICMP -m hashlimit --hashlimit-name icmp0 --hashlimit 2/s --hashlimit-mode srcip --icmp-type 0 -j ACCEPT
$IPTABLES -A icmp_ddos -p ICMP -m hashlimit --hashlimit-name icmp8 --hashlimit 2/s --hashlimit-mode srcip --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_ddos -p ICMP -m hashlimit --hashlimit-name icmp11 --hashlimit 2/s --hashlimit-mode srcip --icmp-type 11 -j ACCEPT
$IPTABLES -A icmp_ddos -j DROP
# udp_ddos chain
$IPTABLES -N udp_ddos
$IPTABLES -A udp_ddos -p UDP -m hashlimit --hashlimit 15/min --hashlimit-burst 30 --hashlimit-mode srcip --hashlimit-name udp_ddos -j ACCEPT
$IPTABLES -A udp_ddos -p UDP -m connlimit --connlimit-above 15 -j DROP
$IPTABLES -A udp_ddos -p UDP -j DROP
# http_ddos chain
$IPTABLES -N http_ddos
$IPTABLES -A http_ddos -p TCP -m hashlimit --hashlimit 15/min --hashlimit-burst 30 --hashlimit-mode srcip --hashlimit-name httpddos --hashlimit-htable-size 32768 --hashlimit-htable-max 32768 --hashlimit-htable-gcinterval 1000 --hashlimit-htable-expire 100000 -j ACCEPT
$IPTABLES -A http_ddos -p TCP -m connlimit --connlimit-above 15 -j DROP
$IPTABLES -A http_ddos -p TCP -j DROP
# tcp_ddos chain
$IPTABLES -N tcp_ddos
$IPTABLES -A tcp_ddos -p TCP -m hashlimit --hashlimit 15/min --hashlimit-burst 30 --hashlimit-mode srcip --hashlimit-name tcpddos --hashlimit-htable-size 32768 --hashlimit-htable-max 32768 --hashlimit-htable-gcinterval 1000 --hashlimit-htable-expire 100000 -j ACCEPT
$IPTABLES -A tcp_ddos -p TCP -m connlimit --connlimit-above 15 -j DROP
$IPTABLES -A tcp_ddos -p TCP -j DROP
# syn_flood chain
$IPTABLES -N syn_flood
$IPTABLES -A syn_flood -m hashlimit --hashlimit 1/s --hashlimit-burst 4 --hashlimit-mode srcip --hashlimit-name syn_flood -j ACCEPT
# bad_tcp_packets chain
$IPTABLES -N bad_tcp_packets
$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A bad_tcp_packets -p tcp -m state --state INVALID -j DROP
#protocol_filter chain
$IPTABLES -N protocol_filter
$IPTABLES -A protocol_filter -p tcp -j bad_tcp_packets
$IPTABLES -A protocol_filter -p tcp -j syn_flood
$IPTABLES -A protocol_filter -p tcp -m multiport --dport 53,21,22222 -j tcp_ddos
$IPTABLES -A protocol_filter -p tcp -m multiport --dport 80,8080,443 -j http_ddos
$IPTABLES -A protocol_filter -p UDP --dport 53 -j udp_ddos
$IPTABLES -A protocol_filter -p ICMP -j icmp_ddos
$IPTABLES -A protocol_filter -j DROP
#black.country chain
$IPTABLES -N black_country
$IPTABLES -A black_country -m geoip --src-cc UA,RU,PL,BY,MD,NO,NL,LV,US,CA,DE,KZ,EE,GE,LT -j protocol_filter
$IPTABLES -A black_country -m geoip --src-cc IL,IT,UZ,GB,ES,FR,AZ,CZ,CH,SE,RO,FI,AM,TR,AU -j protocol_filter
$IPTABLES -A black_country -j DROP
#input
$IPTABLES -A INPUT -p ALL -i $INT_DEV1 -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $INT_DEV2 -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_DEV -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $EXT_DEV -j black_ip
$IPTABLES -A INPUT -p ALL -i $EXT_DEV -m state --state NEW,RELATED -j bogons
$IPTABLES -A INPUT -p ALL -i $EXT_DEV -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $EXT_DEV -m state --state NEW,RELATED -j black_country
/sbin/iptables-save > /etc/sysconfig/iptables
echo "Firewall started"[
|
