freedombone/src/freedombone-utils-firewall

#!/bin/bash
#
# .---.                  .              .
# |                      |              |
# |--- .--. .-.  .-.  .-.|  .-. .--.--. |.-.  .-. .--.  .-.
# |    |   (.-' (.-' (   | (   )|  |  | |   )(   )|  | (.-'
# '    '     --'  --'  -' -  -' '  '   -' -'   -' '   -  --'
#
#                    Freedom in the Cloud
#
# Firewall functions
#
# License
# =======
#
# Copyright (C) 2014-2016 Bob Mottram <bob@robotics.uk.to>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

function save_firewall_settings {
	iptables-save > /etc/firewall.conf
	ip6tables-save > /etc/firewall6.conf
	printf '#!/bin/sh\n' > /etc/network/if-up.d/iptables
	printf 'iptables-restore < /etc/firewall.conf\n' >> /etc/network/if-up.d/iptables
	printf 'ip6tables-restore < /etc/firewall6.conf\n' >> /etc/network/if-up.d/iptables
	chmod +x /etc/network/if-up.d/iptables
}

function enable_ipv6 {
	# endure that ipv6 is enabled and can route
	sed -i 's/net.ipv6.conf.all.disable_ipv6.*/net.ipv6.conf.all.disable_ipv6 = 0/g' /etc/sysctl.conf
	#sed -i "s/net.ipv6.conf.all.accept_redirects.*/net.ipv6.conf.all.accept_redirects = 1/g" /etc/sysctl.conf
	#sed -i "s/net.ipv6.conf.all.accept_source_route.*/net.ipv6.conf.all.accept_source_route = 1/g" /etc/sysctl.conf
	sed -i "s/net.ipv6.conf.all.forwarding.*/net.ipv6.conf.all.forwarding=1/g" /etc/sysctl.conf
	echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
}

function configure_firewall {
	if grep -q "RELATED" /etc/firewall.conf; then
		# recreate the firewall to remove RELATED
		sed -i "/firewall/d" $COMPLETION_FILE
	fi
	if grep -Fxq "configure_firewall" $COMPLETION_FILE; then
		return
	fi
	if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
		# docker does its own firewalling
		return
	fi
	iptables -P INPUT ACCEPT
	ip6tables -P INPUT ACCEPT
	iptables -F
	ip6tables -F
	iptables -t nat -F
	ip6tables -t nat -F
	iptables -X
	ip6tables -X
	iptables -P INPUT DROP
	ip6tables -P INPUT DROP
	iptables -A INPUT -i lo -j ACCEPT
	iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT

	# Make sure incoming tcp connections are SYN packets
	iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

	# Drop packets with incoming fragments
	iptables -A INPUT -f -j DROP

	# Drop bogons
	iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
	iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
	iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

	# Incoming malformed NULL packets:
	iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

	echo 'configure_firewall' >> $COMPLETION_FILE
}

function configure_firewall_ping {
	if grep -Fxq "configure_firewall_ping" $COMPLETION_FILE; then
		return
	fi
	# Only allow ping for mesh installs
	if [[ $SYSTEM_TYPE != "$VARIANT_MESH" ]]; then
		return
	fi
	iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
	iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings
	echo 'configure_firewall_ping' >> $COMPLETION_FILE
}

function configure_firewall_for_voip {
	if [[ $SYSTEM_TYPE == "$VARIANT_WRITER" || $SYSTEM_TYPE == "$VARIANT_MAILBOX" || $SYSTEM_TYPE == "$VARIANT_CLOUD" || $SYSTEM_TYPE == "$VARIANT_SOCIAL" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_DEVELOPER" ]]; then
		return
	fi
	if grep -Fxq "configure_firewall_for_voip" $COMPLETION_FILE; then
		return
	fi
	if [[ $ONION_ONLY != "no" ]]; then
		return
	fi
	iptables -A INPUT -p udp --dport $VOIP_PORT -j ACCEPT
	iptables -A INPUT -p tcp --dport $VOIP_PORT -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings

	OPEN_PORTS+=("Mumble   $VOIP_PORT")
	echo 'configure_firewall_for_voip' >> $COMPLETION_FILE
}

function configure_firewall_for_syncthing {
	if grep -Fxq "configure_firewall_for_syncthing" $COMPLETION_FILE; then
		return
	fi
	iptables -A INPUT -p udp --dport $SYNCTHING_PORT -j ACCEPT
	iptables -A INPUT -p tcp --dport $SYNCTHING_PORT -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings

	OPEN_PORTS+=("Syncthing $SYNCTHING_PORT")
	echo 'configure_firewall_for_syncthing' >> $COMPLETION_FILE
}

function configure_firewall_for_voip_turn {
	if [[ $SYSTEM_TYPE == "$VARIANT_WRITER" || $SYSTEM_TYPE == "$VARIANT_MAILBOX" || $SYSTEM_TYPE == "$VARIANT_CLOUD" || $SYSTEM_TYPE == "$VARIANT_SOCIAL" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_DEVELOPER" ]]; then
		return
	fi
	if grep -Fxq "configure_firewall_for_voip_turn" $COMPLETION_FILE; then
		return
	fi
	if [[ $ONION_ONLY != "no" ]]; then
		return
	fi
	iptables -A INPUT -p udp --dport $VOIP_TURN_PORT -j ACCEPT
	iptables -A INPUT -p tcp --dport $VOIP_TURN_PORT -j ACCEPT
	iptables -A INPUT -p tcp --dport $VOIP_TURN_TLS_PORT -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings

	OPEN_PORTS+=("TURN     $VOIP_TURN_PORT")
	OPEN_PORTS+=("TURN TLS $VOIP_TURN_TLS_PORT")
	echo 'configure_firewall_for_voip_turn' >> $COMPLETION_FILE
}


function configure_firewall_for_sip4 {
	if [[ $SYSTEM_TYPE == "$VARIANT_WRITER" || $SYSTEM_TYPE == "$VARIANT_MAILBOX" || $SYSTEM_TYPE == "$VARIANT_CLOUD" || $SYSTEM_TYPE == "$VARIANT_SOCIAL" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_DEVELOPER" ]]; then
		return
	fi
	if grep -Fxq "configure_firewall_for_sip4" $COMPLETION_FILE; then
		return
	fi
	if [[ $ONION_ONLY != "no" ]]; then
		return
	fi
	iptables -A INPUT -p udp --dport $SIP_PORT -j ACCEPT
	iptables -A INPUT -p tcp --dport $SIP_PORT -j ACCEPT
	iptables -A INPUT -p udp --dport $SIP_TLS_PORT -j ACCEPT
	iptables -A INPUT -p tcp --dport $SIP_TLS_PORT -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings

	OPEN_PORTS+=("SIP      $SIP_PORT")
	OPEN_PORTS+=("SIP TLS  $SIP_TLS_PORT")
	echo 'configure_firewall_for_sip4' >> $COMPLETION_FILE
}

function configure_firewall_for_ipfs {
	if [[ $SYSTEM_TYPE == "$VARIANT_MAILBOX" || $SYSTEM_TYPE == "$VARIANT_CHAT" ]]; then
		return
	fi
	if grep -Fxq "configure_firewall_for_ipfs" $COMPLETION_FILE; then
		return
	fi
	if [[ $ONION_ONLY != "no" ]]; then
		return
	fi
	iptables -A INPUT -p tcp --dport $IPFS_PORT -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings

	OPEN_PORTS+=("IPFS     $IPFS_PORT")
	echo 'configure_firewall_for_ipfs' >> $COMPLETION_FILE
}

function configure_firewall_for_avahi {
	if grep -Fxq "configure_firewall_for_avahi" $COMPLETION_FILE; then
		return
	fi
	iptables -A INPUT -p tcp --dport 548 -j ACCEPT
	iptables -A INPUT -p udp --dport 548 -j ACCEPT
	iptables -A INPUT -p tcp --dport 5353 -j ACCEPT
	iptables -A INPUT -p udp --dport 5353 -j ACCEPT
	iptables -A INPUT -p tcp --dport 5354 -j ACCEPT
	iptables -A INPUT -p udp --dport 5354 -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings
	echo 'configure_firewall_for_avahi' >> $COMPLETION_FILE
}

function configure_firewall_for_cjdns {
	if grep -Fxq "configure_firewall_for_cjdns" $COMPLETION_FILE; then
		return
	fi
	if [[ $ENABLE_CJDNS != "yes" ]]; then
		return
	fi
	ip6tables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
	ip6tables -A FORWARD -i tun0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings
	echo 'configure_firewall_for_cjdns' >> $COMPLETION_FILE
}

function configure_firewall_for_batman {
	if grep -Fxq "configure_firewall_for_batman" $COMPLETION_FILE; then
		return
	fi
	if [[ $ENABLE_BATMAN != "yes" ]]; then
		return
	fi

	function_check save_firewall_settings
	save_firewall_settings
	echo 'configure_firewall_for_batman' >> $COMPLETION_FILE
}

function configure_firewall_for_babel {
	if grep -Fxq "configure_firewall_for_babel" $COMPLETION_FILE; then
		return
	fi
	if [[ $ENABLE_BABEL != "yes" ]]; then
		return
	fi
	iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport $BABEL_PORT -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings

	OPEN_PORTS+=("Babel    $BABEL_PORT")
	echo 'configure_firewall_for_babel' >> $COMPLETION_FILE
}

function configure_firewall_for_zeronet {
	if grep -Fxq "configure_firewall_for_zeronet" $COMPLETION_FILE; then
		return
	fi
	if [[ $SYSTEM_TYPE != "$VARIANT_MESH" ]]; then
		return
	fi
	iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport $ZERONET_PORT -j ACCEPT
	iptables -A INPUT -i $WIFI_INTERFACE -p tcp --dport $ZERONET_PORT -j ACCEPT
	iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport $TRACKER_PORT -j ACCEPT
	iptables -A INPUT -i $WIFI_INTERFACE -p tcp --dport $TRACKER_PORT -j ACCEPT
	iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport 1900 -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings

	OPEN_PORTS+=("ZeroNet  $ZERONET_PORT")
	OPEN_PORTS+=("Tracker  $TRACKER_PORT")
	echo 'configure_firewall_for_zeronet' >> $COMPLETION_FILE
}

function configure_firewall_for_dlna {
	if grep -Fxq "configure_firewall_for_dlna" $COMPLETION_FILE; then
		return
	fi
	if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
		# docker does its own firewalling
		return
	fi
	if [[ $SYSTEM_TYPE == "$VARIANT_CLOUD" || $SYSTEM_TYPE == "$VARIANT_MAILBOX" || $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_WRITER" || $SYSTEM_TYPE == "$VARIANT_SOCIAL" ]]; then
		return
	fi
	iptables -A INPUT -p udp --dport 1900 -j ACCEPT
	iptables -A INPUT -p tcp --dport 8200 -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings

	OPEN_PORTS+=('DLNA     1900')
	OPEN_PORTS+=('DLNA     8200')
	echo 'configure_firewall_for_dlna' >> $COMPLETION_FILE
}

function configure_firewall_for_dns {
	if grep -Fxq "configure_firewall_for_dns" $COMPLETION_FILE; then
		return
	fi
	if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
		# docker does its own firewalling
		return
	fi
	iptables -A INPUT -p udp -m udp --dport 1024:65535 --sport 53 -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings
	echo 'configure_firewall_for_dns' >> $COMPLETION_FILE
}

function configure_firewall_for_xmpp {
	if [ ! -d /etc/prosody ]; then
		return
	fi
	if grep -Fxq "configure_firewall_for_xmpp" $COMPLETION_FILE; then
		return
	fi
	if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
		# docker does its own firewalling
		return
	fi
	if [[ $ONION_ONLY != "no" ]]; then
		return
	fi
	iptables -A INPUT -p tcp --dport 5222:5223 -j ACCEPT
	iptables -A INPUT -p tcp --dport 5269 -j ACCEPT
	iptables -A INPUT -p tcp --dport 5280:5281 -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings

	OPEN_PORTS+=('XMPP     5222-5223')
	OPEN_PORTS+=('XMPP     5269')
	OPEN_PORTS+=('XMPP     5280-5281')
	echo 'configure_firewall_for_xmpp' >> $COMPLETION_FILE
}

function configure_firewall_for_irc {
	if [ ! -d /etc/ngircd ]; then
		return
	fi
	if grep -Fxq "configure_firewall_for_irc" $COMPLETION_FILE; then
		return
	fi
	if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
		# docker does its own firewalling
		return
	fi
	if [[ $ONION_ONLY != "no" ]]; then
		return
	fi
	iptables -A INPUT -p tcp --dport $IRC_PORT  -j ACCEPT
	iptables -I INPUT -p tcp --dport 1024:65535 --sport $IRC_PORT -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings

	OPEN_PORTS+=("IRC      $IRC_PORT")
	echo 'configure_firewall_for_irc' >> $COMPLETION_FILE
}

function configure_firewall_for_web_access {
	if grep -Fxq "configure_firewall_for_web_access" $COMPLETION_FILE; then
		return
	fi
	if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
		# docker does its own firewalling
		return
	fi
	if [[ $ONION_ONLY != "no" ]]; then
		return
	fi
	iptables -A INPUT -p tcp --dport 32768:61000 --sport 80 -j ACCEPT
	iptables -A INPUT -p tcp --dport 32768:61000 --sport 443 -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings

	echo 'configure_firewall_for_web_access' >> $COMPLETION_FILE
}

function configure_firewall_for_web_server {
	if grep -Fxq "configure_firewall_for_web_server" $COMPLETION_FILE; then
		return
	fi
	if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
		# docker does its own firewalling
		return
	fi
	if [[ $ONION_ONLY != "no" ]]; then
		return
	fi
	iptables -A INPUT -p tcp --dport 80 -j ACCEPT
	iptables -A INPUT -p tcp --dport 443 -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings

	OPEN_PORTS+=('HTTP     80')
	OPEN_PORTS+=('HTTPS    443')
	echo 'configure_firewall_for_web_server' >> $COMPLETION_FILE
}

function configure_firewall_for_tox {
	if grep -Fxq "configure_firewall_for_tox" $COMPLETION_FILE; then
		return
	fi
	if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
		# docker does its own firewalling
		return
	fi
	if [[ $ONION_ONLY != "no" ]]; then
		return
	fi
	iptables -A INPUT -p tcp --dport $TOX_PORT -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings

	OPEN_PORTS+=("Tox      $TOX_PORT")
	echo 'configure_firewall_for_tox' >> $COMPLETION_FILE
}

function configure_firewall_for_ssh {
	if grep -Fxq "configure_firewall_for_ssh" $COMPLETION_FILE; then
		return
	fi
	if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
		# docker does its own firewalling
		return
	fi
	iptables -A INPUT -p tcp --dport 22 -j ACCEPT
	iptables -A INPUT -p tcp --dport $SSH_PORT -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings

	OPEN_PORTS+=("SSH      $SSH_PORT")
	echo 'configure_firewall_for_ssh' >> $COMPLETION_FILE
}

function configure_firewall_for_git {
	if grep -Fxq "configure_firewall_for_git" $COMPLETION_FILE; then
		return
	fi
	if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
		# docker does its own firewalling
		return
	fi
	if [[ $ONION_ONLY != "no" ]]; then
		return
	fi
	iptables -A INPUT -p tcp --dport 9418 -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings

	OPEN_PORTS+=("Git      9418")
	echo 'configure_firewall_for_git' >> $COMPLETION_FILE
}

function configure_firewall_for_email {
	if [[ $SYSTEM_TYPE == "$VARIANT_WRITER" || $SYSTEM_TYPE == "$VARIANT_CLOUD" || $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_SOCIAL" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_DEVELOPER" || $SYSTEM_TYPE == "$VARIANT_MESH" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" ]]; then
		return
	fi
	if grep -Fxq "configure_firewall_for_email" $COMPLETION_FILE; then
		return
	fi
	if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
		# docker does its own firewalling
		return
	fi
	if [[ $ONION_ONLY != "no" ]]; then
		return
	fi
	iptables -A INPUT -p tcp --dport 25 -j ACCEPT
	iptables -A INPUT -p tcp --dport 587 -j ACCEPT
	iptables -A INPUT -p tcp --dport 465 -j ACCEPT
	iptables -A INPUT -p tcp --dport 993 -j ACCEPT
	function_check save_firewall_settings
	save_firewall_settings

	OPEN_PORTS+=('Email    25')
	OPEN_PORTS+=('Email    587')
	OPEN_PORTS+=('Email    465')
	OPEN_PORTS+=('Email    993')
	echo 'configure_firewall_for_email' >> $COMPLETION_FILE
}

function configure_internet_protocol {
	if grep -Fxq "configure_internet_protocol" $COMPLETION_FILE; then
		return
	fi
	if [[ $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
		return
	fi
	sed -i "s/#net.ipv4.tcp_syncookies=1/net.ipv4.tcp_syncookies=1/g" /etc/sysctl.conf
	sed -i "s/#net.ipv4.conf.all.accept_redirects = 0/net.ipv4.conf.all.accept_redirects = 0/g" /etc/sysctl.conf
	sed -i "s/#net.ipv6.conf.all.accept_redirects = 0/net.ipv6.conf.all.accept_redirects = 0/g" /etc/sysctl.conf
	sed -i "s/#net.ipv4.conf.all.send_redirects = 0/net.ipv4.conf.all.send_redirects = 0/g" /etc/sysctl.conf
	sed -i "s/#net.ipv4.conf.all.accept_source_route = 0/net.ipv4.conf.all.accept_source_route = 0/g" /etc/sysctl.conf
	sed -i "s/#net.ipv6.conf.all.accept_source_route = 0/net.ipv6.conf.all.accept_source_route = 0/g" /etc/sysctl.conf
	sed -i "s/#net.ipv4.conf.default.rp_filter=1/net.ipv4.conf.default.rp_filter=1/g" /etc/sysctl.conf
	sed -i "s/#net.ipv4.conf.all.rp_filter=1/net.ipv4.conf.all.rp_filter=1/g" /etc/sysctl.conf
	sed -i "s/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=0/g" /etc/sysctl.conf
	sed -i "s/#net.ipv6.conf.all.forwarding=1/net.ipv6.conf.all.forwarding=0/g" /etc/sysctl.conf
	if ! grep -q "ignore pings" /etc/sysctl.conf; then
		echo '# ignore pings' >> /etc/sysctl.conf
		echo 'net.ipv4.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf
		echo 'net.ipv6.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf
	fi
	if ! grep -q "disable ipv6" /etc/sysctl.conf; then
		echo '# disable ipv6' >> /etc/sysctl.conf
		echo 'net.ipv6.conf.all.disable_ipv6 = 1' >> /etc/sysctl.conf
	fi
	if ! grep -q "net.ipv4.tcp_synack_retries" /etc/sysctl.conf; then
		echo 'net.ipv4.tcp_synack_retries = 2' >> /etc/sysctl.conf
		echo 'net.ipv4.tcp_syn_retries = 1' >> /etc/sysctl.conf
	fi
	if ! grep -q "keepalive" /etc/sysctl.conf; then
		echo '# keepalive' >> /etc/sysctl.conf
		echo 'net.ipv4.tcp_keepalive_probes = 9' >> /etc/sysctl.conf
		echo 'net.ipv4.tcp_keepalive_intvl = 75' >> /etc/sysctl.conf
		echo 'net.ipv4.tcp_keepalive_time = 7200' >> /etc/sysctl.conf
	fi
	echo 'configure_internet_protocol' >> $COMPLETION_FILE
}