freedombone-utils-firewall 12KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Firewall functions
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2014-2016 Bob Mottram <bob@robotics.uk.to>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. function save_firewall_settings {
  31. iptables-save > /etc/firewall.conf
  32. ip6tables-save > /etc/firewall6.conf
  33. printf '#!/bin/sh\n' > /etc/network/if-up.d/iptables
  34. printf 'iptables-restore < /etc/firewall.conf\n' >> /etc/network/if-up.d/iptables
  35. printf 'ip6tables-restore < /etc/firewall6.conf\n' >> /etc/network/if-up.d/iptables
  36. chmod +x /etc/network/if-up.d/iptables
  37. }
  38. function enable_ipv6 {
  39. # endure that ipv6 is enabled and can route
  40. sed -i 's/net.ipv6.conf.all.disable_ipv6.*/net.ipv6.conf.all.disable_ipv6 = 0/g' /etc/sysctl.conf
  41. #sed -i "s/net.ipv6.conf.all.accept_redirects.*/net.ipv6.conf.all.accept_redirects = 1/g" /etc/sysctl.conf
  42. #sed -i "s/net.ipv6.conf.all.accept_source_route.*/net.ipv6.conf.all.accept_source_route = 1/g" /etc/sysctl.conf
  43. sed -i "s/net.ipv6.conf.all.forwarding.*/net.ipv6.conf.all.forwarding=1/g" /etc/sysctl.conf
  44. echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
  45. }
  46. function configure_firewall {
  47. if [ $INSTALLING_MESH ]; then
  48. mesh_firewall
  49. return
  50. fi
  51. if grep -q "RELATED" /etc/firewall.conf; then
  52. # recreate the firewall to remove RELATED
  53. sed -i "/firewall/d" $COMPLETION_FILE
  54. fi
  55. if grep -Fxq "configure_firewall" $COMPLETION_FILE; then
  56. return
  57. fi
  58. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  59. # docker does its own firewalling
  60. return
  61. fi
  62. iptables -P INPUT ACCEPT
  63. ip6tables -P INPUT ACCEPT
  64. iptables -F
  65. ip6tables -F
  66. iptables -t nat -F
  67. ip6tables -t nat -F
  68. iptables -X
  69. ip6tables -X
  70. iptables -P INPUT DROP
  71. ip6tables -P INPUT DROP
  72. iptables -A INPUT -i lo -j ACCEPT
  73. iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
  74. # Make sure incoming tcp connections are SYN packets
  75. iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
  76. # Drop packets with incoming fragments
  77. iptables -A INPUT -f -j DROP
  78. # Drop bogons
  79. iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
  80. iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
  81. iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
  82. # Incoming malformed NULL packets:
  83. iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
  84. echo 'configure_firewall' >> $COMPLETION_FILE
  85. }
  86. function configure_firewall_ping {
  87. if grep -Fxq "configure_firewall_ping" $COMPLETION_FILE; then
  88. return
  89. fi
  90. # Only allow ping for mesh installs
  91. if [[ $SYSTEM_TYPE != "$VARIANT_MESH" ]]; then
  92. return
  93. fi
  94. iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
  95. iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
  96. function_check save_firewall_settings
  97. save_firewall_settings
  98. echo 'configure_firewall_ping' >> $COMPLETION_FILE
  99. }
  100. function configure_firewall_for_avahi {
  101. if grep -Fxq "configure_firewall_for_avahi" $COMPLETION_FILE; then
  102. return
  103. fi
  104. iptables -A INPUT -p tcp --dport 548 -j ACCEPT
  105. iptables -A INPUT -p udp --dport 548 -j ACCEPT
  106. iptables -A INPUT -p tcp --dport 5353 -j ACCEPT
  107. iptables -A INPUT -p udp --dport 5353 -j ACCEPT
  108. iptables -A INPUT -p tcp --dport 5354 -j ACCEPT
  109. iptables -A INPUT -p udp --dport 5354 -j ACCEPT
  110. function_check save_firewall_settings
  111. save_firewall_settings
  112. echo 'configure_firewall_for_avahi' >> $COMPLETION_FILE
  113. }
  114. function configure_firewall_for_dns {
  115. if grep -Fxq "configure_firewall_for_dns" $COMPLETION_FILE; then
  116. return
  117. fi
  118. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  119. # docker does its own firewalling
  120. return
  121. fi
  122. iptables -A INPUT -p udp -m udp --dport 1024:65535 --sport 53 -j ACCEPT
  123. function_check save_firewall_settings
  124. save_firewall_settings
  125. echo 'configure_firewall_for_dns' >> $COMPLETION_FILE
  126. }
  127. function configure_firewall_for_web_access {
  128. if grep -Fxq "configure_firewall_for_web_access" $COMPLETION_FILE; then
  129. return
  130. fi
  131. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  132. # docker does its own firewalling
  133. return
  134. fi
  135. if [[ $ONION_ONLY != "no" ]]; then
  136. return
  137. fi
  138. iptables -A INPUT -p tcp --dport 32768:61000 --sport 80 -j ACCEPT
  139. iptables -A INPUT -p tcp --dport 32768:61000 --sport 443 -j ACCEPT
  140. function_check save_firewall_settings
  141. save_firewall_settings
  142. echo 'configure_firewall_for_web_access' >> $COMPLETION_FILE
  143. }
  144. function configure_firewall_for_web_server {
  145. if grep -Fxq "configure_firewall_for_web_server" $COMPLETION_FILE; then
  146. return
  147. fi
  148. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  149. # docker does its own firewalling
  150. return
  151. fi
  152. if [[ $ONION_ONLY != "no" ]]; then
  153. return
  154. fi
  155. iptables -A INPUT -p tcp --dport 80 -j ACCEPT
  156. iptables -A INPUT -p tcp --dport 443 -j ACCEPT
  157. function_check save_firewall_settings
  158. save_firewall_settings
  159. OPEN_PORTS+=('HTTP 80')
  160. OPEN_PORTS+=('HTTPS 443')
  161. echo 'configure_firewall_for_web_server' >> $COMPLETION_FILE
  162. }
  163. function configure_firewall_for_ssh {
  164. if grep -Fxq "configure_firewall_for_ssh" $COMPLETION_FILE; then
  165. return
  166. fi
  167. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  168. # docker does its own firewalling
  169. return
  170. fi
  171. iptables -A INPUT -p tcp --dport 22 -j ACCEPT
  172. iptables -A INPUT -p tcp --dport $SSH_PORT -j ACCEPT
  173. function_check save_firewall_settings
  174. save_firewall_settings
  175. OPEN_PORTS+=("SSH $SSH_PORT")
  176. echo 'configure_firewall_for_ssh' >> $COMPLETION_FILE
  177. }
  178. function configure_firewall_for_git {
  179. if grep -Fxq "configure_firewall_for_git" $COMPLETION_FILE; then
  180. return
  181. fi
  182. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  183. # docker does its own firewalling
  184. return
  185. fi
  186. if [[ $ONION_ONLY != "no" ]]; then
  187. return
  188. fi
  189. iptables -A INPUT -p tcp --dport 9418 -j ACCEPT
  190. function_check save_firewall_settings
  191. save_firewall_settings
  192. OPEN_PORTS+=("Git 9418")
  193. echo 'configure_firewall_for_git' >> $COMPLETION_FILE
  194. }
  195. function configure_internet_protocol {
  196. if grep -Fxq "configure_internet_protocol" $COMPLETION_FILE; then
  197. return
  198. fi
  199. if [[ $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  200. return
  201. fi
  202. sed -i "s/#net.ipv4.tcp_syncookies=1/net.ipv4.tcp_syncookies=1/g" /etc/sysctl.conf
  203. sed -i "s/#net.ipv4.conf.all.accept_redirects = 0/net.ipv4.conf.all.accept_redirects = 0/g" /etc/sysctl.conf
  204. sed -i "s/#net.ipv6.conf.all.accept_redirects = 0/net.ipv6.conf.all.accept_redirects = 0/g" /etc/sysctl.conf
  205. sed -i "s/#net.ipv4.conf.all.send_redirects = 0/net.ipv4.conf.all.send_redirects = 0/g" /etc/sysctl.conf
  206. sed -i "s/#net.ipv4.conf.all.accept_source_route = 0/net.ipv4.conf.all.accept_source_route = 0/g" /etc/sysctl.conf
  207. sed -i "s/#net.ipv6.conf.all.accept_source_route = 0/net.ipv6.conf.all.accept_source_route = 0/g" /etc/sysctl.conf
  208. sed -i "s/#net.ipv4.conf.default.rp_filter=1/net.ipv4.conf.default.rp_filter=1/g" /etc/sysctl.conf
  209. sed -i "s/#net.ipv4.conf.all.rp_filter=1/net.ipv4.conf.all.rp_filter=1/g" /etc/sysctl.conf
  210. sed -i "s/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=0/g" /etc/sysctl.conf
  211. sed -i "s/#net.ipv6.conf.all.forwarding=1/net.ipv6.conf.all.forwarding=0/g" /etc/sysctl.conf
  212. if ! grep -q "ignore pings" /etc/sysctl.conf; then
  213. echo '# ignore pings' >> /etc/sysctl.conf
  214. echo 'net.ipv4.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf
  215. echo 'net.ipv6.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf
  216. fi
  217. if ! grep -q "disable ipv6" /etc/sysctl.conf; then
  218. echo '# disable ipv6' >> /etc/sysctl.conf
  219. echo 'net.ipv6.conf.all.disable_ipv6 = 1' >> /etc/sysctl.conf
  220. fi
  221. if ! grep -q "net.ipv4.tcp_synack_retries" /etc/sysctl.conf; then
  222. echo 'net.ipv4.tcp_synack_retries = 2' >> /etc/sysctl.conf
  223. echo 'net.ipv4.tcp_syn_retries = 1' >> /etc/sysctl.conf
  224. fi
  225. if ! grep -q "keepalive" /etc/sysctl.conf; then
  226. echo '# keepalive' >> /etc/sysctl.conf
  227. echo 'net.ipv4.tcp_keepalive_probes = 9' >> /etc/sysctl.conf
  228. echo 'net.ipv4.tcp_keepalive_intvl = 75' >> /etc/sysctl.conf
  229. echo 'net.ipv4.tcp_keepalive_time = 7200' >> /etc/sysctl.conf
  230. fi
  231. echo 'configure_internet_protocol' >> $COMPLETION_FILE
  232. }
  233. function mesh_firewall {
  234. FIREWALL_FILENAME=${rootdir}/etc/systemd/system/meshfirewall.service
  235. MESH_FIREWALL_SCRIPT=${rootdir}/usr/bin/mesh-firewall
  236. echo '#!/bin/bash' > $MESH_FIREWALL_SCRIPT
  237. echo 'iptables -P INPUT ACCEPT' >> $MESH_FIREWALL_SCRIPT
  238. echo 'ip6tables -P INPUT ACCEPT' >> $MESH_FIREWALL_SCRIPT
  239. echo 'iptables -F' >> $MESH_FIREWALL_SCRIPT
  240. echo 'ip6tables -F' >> $MESH_FIREWALL_SCRIPT
  241. echo 'iptables -t nat -F' >> $MESH_FIREWALL_SCRIPT
  242. echo 'ip6tables -t nat -F' >> $MESH_FIREWALL_SCRIPT
  243. echo 'iptables -X' >> $MESH_FIREWALL_SCRIPT
  244. echo 'ip6tables -X' >> $MESH_FIREWALL_SCRIPT
  245. echo 'iptables -P INPUT DROP' >> $MESH_FIREWALL_SCRIPT
  246. echo 'ip6tables -P INPUT DROP' >> $MESH_FIREWALL_SCRIPT
  247. echo 'iptables -A INPUT -i lo -j ACCEPT' >> $MESH_FIREWALL_SCRIPT
  248. echo 'iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT' >> $MESH_FIREWALL_SCRIPT
  249. echo '' >> $MESH_FIREWALL_SCRIPT
  250. echo '# Make sure incoming tcp connections are SYN packets' >> $MESH_FIREWALL_SCRIPT
  251. echo 'iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP' >> $MESH_FIREWALL_SCRIPT
  252. echo '' >> $MESH_FIREWALL_SCRIPT
  253. echo '# Drop packets with incoming fragments' >> $MESH_FIREWALL_SCRIPT
  254. echo 'iptables -A INPUT -f -j DROP' >> $MESH_FIREWALL_SCRIPT
  255. echo '' >> $MESH_FIREWALL_SCRIPT
  256. echo '# Drop bogons' >> $MESH_FIREWALL_SCRIPT
  257. echo 'iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP' >> $MESH_FIREWALL_SCRIPT
  258. echo 'iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP' >> $MESH_FIREWALL_SCRIPT
  259. echo 'iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP' >> $MESH_FIREWALL_SCRIPT
  260. echo '' >> $MESH_FIREWALL_SCRIPT
  261. echo '# Incoming malformed NULL packets:' >> $MESH_FIREWALL_SCRIPT
  262. echo 'iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP' >> $MESH_FIREWALL_SCRIPT
  263. echo '' >> $MESH_FIREWALL_SCRIPT
  264. echo "iptables -A INPUT -p tcp --dport $TOX_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  265. echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport $ZERONET_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  266. echo "iptables -A INPUT -i $WIFI_INTERFACE -p tcp --dport $ZERONET_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  267. echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport $TRACKER_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  268. echo "iptables -A INPUT -i $WIFI_INTERFACE -p tcp --dport $TRACKER_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  269. echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport 1900 -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  270. chmod +x $MESH_FIREWALL_SCRIPT
  271. echo '[Unit]' > $FIREWALL_FILENAME
  272. echo 'Description=Mesh Firewall' >> $FIREWALL_FILENAME
  273. echo '' >> $FIREWALL_FILENAME
  274. echo '[Service]' >> $FIREWALL_FILENAME
  275. echo 'Type=oneshot' >> $FIREWALL_FILENAME
  276. echo 'ExecStart=/usr/bin/mesh-firewall' >> $FIREWALL_FILENAME
  277. echo 'RemainAfterExit=no' >> $FIREWALL_FILENAME
  278. echo '' >> $FIREWALL_FILENAME
  279. echo 'TimeoutSec=30' >> $FIREWALL_FILENAME
  280. echo '' >> $FIREWALL_FILENAME
  281. echo '[Install]' >> $FIREWALL_FILENAME
  282. echo 'WantedBy=multi-user.target' >> $FIREWALL_FILENAME
  283. chroot "$rootdir" systemctl enable meshfirewall
  284. }