freedombone-utils-firewall 12KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Firewall functions
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2014-2016 Bob Mottram <bob@robotics.uk.to>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. function save_firewall_settings {
  31. iptables-save > /etc/firewall.conf
  32. ip6tables-save > /etc/firewall6.conf
  33. printf '#!/bin/sh\n' > /etc/network/if-up.d/iptables
  34. printf 'iptables-restore < /etc/firewall.conf\n' >> /etc/network/if-up.d/iptables
  35. printf 'ip6tables-restore < /etc/firewall6.conf\n' >> /etc/network/if-up.d/iptables
  36. chmod +x /etc/network/if-up.d/iptables
  37. }
  38. function global_rate_limit {
  39. if ! grep -q "tcp_challenge_ack_limit" /etc/sysctl.conf; then
  40. echo 'net.ipv4.tcp_challenge_ack_limit = 999999999' >> /etc/sysctl.conf
  41. else
  42. sed -i 's|net.ipv4.tcp_challenge_ack_limit.*|net.ipv4.tcp_challenge_ack_limit = 999999999|g' /etc/sysctl.conf
  43. fi
  44. sysctl -p -q
  45. }
  46. function enable_ipv6 {
  47. # endure that ipv6 is enabled and can route
  48. sed -i 's/net.ipv6.conf.all.disable_ipv6.*/net.ipv6.conf.all.disable_ipv6 = 0/g' /etc/sysctl.conf
  49. #sed -i "s/net.ipv6.conf.all.accept_redirects.*/net.ipv6.conf.all.accept_redirects = 1/g" /etc/sysctl.conf
  50. #sed -i "s/net.ipv6.conf.all.accept_source_route.*/net.ipv6.conf.all.accept_source_route = 1/g" /etc/sysctl.conf
  51. sed -i "s/net.ipv6.conf.all.forwarding.*/net.ipv6.conf.all.forwarding=1/g" /etc/sysctl.conf
  52. echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
  53. }
  54. function configure_firewall {
  55. if [ $INSTALLING_MESH ]; then
  56. mesh_firewall
  57. return
  58. fi
  59. if grep -q "RELATED" /etc/firewall.conf; then
  60. # recreate the firewall to remove RELATED
  61. sed -i "/firewall/d" $COMPLETION_FILE
  62. fi
  63. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  64. return
  65. fi
  66. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  67. # docker does its own firewalling
  68. return
  69. fi
  70. iptables -P INPUT ACCEPT
  71. ip6tables -P INPUT ACCEPT
  72. iptables -F
  73. ip6tables -F
  74. iptables -t nat -F
  75. ip6tables -t nat -F
  76. iptables -X
  77. ip6tables -X
  78. iptables -P INPUT DROP
  79. ip6tables -P INPUT DROP
  80. iptables -A INPUT -i lo -j ACCEPT
  81. iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
  82. # Make sure incoming tcp connections are SYN packets
  83. iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
  84. # Drop packets with incoming fragments
  85. iptables -A INPUT -f -j DROP
  86. # Drop bogons
  87. iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
  88. iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
  89. iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
  90. # Incoming malformed NULL packets:
  91. iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
  92. mark_completed $FUNCNAME
  93. }
  94. function configure_firewall_ping {
  95. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  96. return
  97. fi
  98. # Only allow ping for mesh installs
  99. if [[ $SYSTEM_TYPE != "mesh"* ]]; then
  100. return
  101. fi
  102. iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
  103. iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
  104. function_check save_firewall_settings
  105. save_firewall_settings
  106. mark_completed $FUNCNAME
  107. }
  108. function configure_firewall_for_avahi {
  109. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  110. return
  111. fi
  112. iptables -A INPUT -p tcp --dport 548 -j ACCEPT
  113. iptables -A INPUT -p udp --dport 548 -j ACCEPT
  114. iptables -A INPUT -p tcp --dport 5353 -j ACCEPT
  115. iptables -A INPUT -p udp --dport 5353 -j ACCEPT
  116. iptables -A INPUT -p tcp --dport 5354 -j ACCEPT
  117. iptables -A INPUT -p udp --dport 5354 -j ACCEPT
  118. function_check save_firewall_settings
  119. save_firewall_settings
  120. mark_completed $FUNCNAME
  121. }
  122. function configure_firewall_for_dns {
  123. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  124. return
  125. fi
  126. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  127. # docker does its own firewalling
  128. return
  129. fi
  130. iptables -A INPUT -p udp -m udp --dport 1024:65535 --sport 53 -j ACCEPT
  131. function_check save_firewall_settings
  132. save_firewall_settings
  133. mark_completed $FUNCNAME
  134. }
  135. function configure_firewall_for_web_access {
  136. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  137. return
  138. fi
  139. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  140. # docker does its own firewalling
  141. return
  142. fi
  143. if [[ $ONION_ONLY != "no" ]]; then
  144. return
  145. fi
  146. iptables -A INPUT -p tcp --dport 32768:61000 --sport 80 -j ACCEPT
  147. iptables -A INPUT -p tcp --dport 32768:61000 --sport 443 -j ACCEPT
  148. function_check save_firewall_settings
  149. save_firewall_settings
  150. mark_completed $FUNCNAME
  151. }
  152. function configure_firewall_for_web_server {
  153. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  154. return
  155. fi
  156. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  157. # docker does its own firewalling
  158. return
  159. fi
  160. if [[ $ONION_ONLY != "no" ]]; then
  161. return
  162. fi
  163. iptables -A INPUT -p tcp --dport 80 -j ACCEPT
  164. iptables -A INPUT -p tcp --dport 443 -j ACCEPT
  165. function_check save_firewall_settings
  166. save_firewall_settings
  167. OPEN_PORTS+=('HTTP 80')
  168. OPEN_PORTS+=('HTTPS 443')
  169. mark_completed $FUNCNAME
  170. }
  171. function configure_firewall_for_ssh {
  172. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  173. return
  174. fi
  175. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  176. # docker does its own firewalling
  177. return
  178. fi
  179. iptables -A INPUT -p tcp --dport 22 -j ACCEPT
  180. iptables -A INPUT -p tcp --dport $SSH_PORT -j ACCEPT
  181. function_check save_firewall_settings
  182. save_firewall_settings
  183. OPEN_PORTS+=("SSH $SSH_PORT")
  184. mark_completed $FUNCNAME
  185. }
  186. function configure_firewall_for_git {
  187. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  188. return
  189. fi
  190. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  191. # docker does its own firewalling
  192. return
  193. fi
  194. if [[ $ONION_ONLY != "no" ]]; then
  195. return
  196. fi
  197. iptables -A INPUT -p tcp --dport 9418 -j ACCEPT
  198. function_check save_firewall_settings
  199. save_firewall_settings
  200. OPEN_PORTS+=("Git 9418")
  201. mark_completed $FUNCNAME
  202. }
  203. function configure_internet_protocol {
  204. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  205. return
  206. fi
  207. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  208. return
  209. fi
  210. sed -i "s/#net.ipv4.tcp_syncookies=1/net.ipv4.tcp_syncookies=1/g" /etc/sysctl.conf
  211. sed -i "s/#net.ipv4.conf.all.accept_redirects = 0/net.ipv4.conf.all.accept_redirects = 0/g" /etc/sysctl.conf
  212. sed -i "s/#net.ipv6.conf.all.accept_redirects = 0/net.ipv6.conf.all.accept_redirects = 0/g" /etc/sysctl.conf
  213. sed -i "s/#net.ipv4.conf.all.send_redirects = 0/net.ipv4.conf.all.send_redirects = 0/g" /etc/sysctl.conf
  214. sed -i "s/#net.ipv4.conf.all.accept_source_route = 0/net.ipv4.conf.all.accept_source_route = 0/g" /etc/sysctl.conf
  215. sed -i "s/#net.ipv6.conf.all.accept_source_route = 0/net.ipv6.conf.all.accept_source_route = 0/g" /etc/sysctl.conf
  216. sed -i "s/#net.ipv4.conf.default.rp_filter=1/net.ipv4.conf.default.rp_filter=1/g" /etc/sysctl.conf
  217. sed -i "s/#net.ipv4.conf.all.rp_filter=1/net.ipv4.conf.all.rp_filter=1/g" /etc/sysctl.conf
  218. sed -i "s/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=0/g" /etc/sysctl.conf
  219. sed -i "s/#net.ipv6.conf.all.forwarding=1/net.ipv6.conf.all.forwarding=0/g" /etc/sysctl.conf
  220. if ! grep -q "ignore pings" /etc/sysctl.conf; then
  221. echo '# ignore pings' >> /etc/sysctl.conf
  222. echo 'net.ipv4.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf
  223. echo 'net.ipv6.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf
  224. fi
  225. if ! grep -q "disable ipv6" /etc/sysctl.conf; then
  226. echo '# disable ipv6' >> /etc/sysctl.conf
  227. echo 'net.ipv6.conf.all.disable_ipv6 = 1' >> /etc/sysctl.conf
  228. fi
  229. if ! grep -q "net.ipv4.tcp_synack_retries" /etc/sysctl.conf; then
  230. echo 'net.ipv4.tcp_synack_retries = 2' >> /etc/sysctl.conf
  231. echo 'net.ipv4.tcp_syn_retries = 1' >> /etc/sysctl.conf
  232. fi
  233. if ! grep -q "keepalive" /etc/sysctl.conf; then
  234. echo '# keepalive' >> /etc/sysctl.conf
  235. echo 'net.ipv4.tcp_keepalive_probes = 9' >> /etc/sysctl.conf
  236. echo 'net.ipv4.tcp_keepalive_intvl = 75' >> /etc/sysctl.conf
  237. echo 'net.ipv4.tcp_keepalive_time = 7200' >> /etc/sysctl.conf
  238. fi
  239. mark_completed $FUNCNAME
  240. }
  241. function mesh_firewall {
  242. FIREWALL_FILENAME=${rootdir}/etc/systemd/system/meshfirewall.service
  243. MESH_FIREWALL_SCRIPT=${rootdir}/usr/bin/mesh-firewall
  244. echo '#!/bin/bash' > $MESH_FIREWALL_SCRIPT
  245. echo 'iptables -P INPUT ACCEPT' >> $MESH_FIREWALL_SCRIPT
  246. echo 'ip6tables -P INPUT ACCEPT' >> $MESH_FIREWALL_SCRIPT
  247. echo 'iptables -F' >> $MESH_FIREWALL_SCRIPT
  248. echo 'ip6tables -F' >> $MESH_FIREWALL_SCRIPT
  249. echo 'iptables -t nat -F' >> $MESH_FIREWALL_SCRIPT
  250. echo 'ip6tables -t nat -F' >> $MESH_FIREWALL_SCRIPT
  251. echo 'iptables -X' >> $MESH_FIREWALL_SCRIPT
  252. echo 'ip6tables -X' >> $MESH_FIREWALL_SCRIPT
  253. echo 'iptables -P INPUT DROP' >> $MESH_FIREWALL_SCRIPT
  254. echo 'ip6tables -P INPUT DROP' >> $MESH_FIREWALL_SCRIPT
  255. echo 'iptables -A INPUT -i lo -j ACCEPT' >> $MESH_FIREWALL_SCRIPT
  256. echo 'iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT' >> $MESH_FIREWALL_SCRIPT
  257. echo '' >> $MESH_FIREWALL_SCRIPT
  258. echo '# Make sure incoming tcp connections are SYN packets' >> $MESH_FIREWALL_SCRIPT
  259. echo 'iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP' >> $MESH_FIREWALL_SCRIPT
  260. echo '' >> $MESH_FIREWALL_SCRIPT
  261. echo '# Drop packets with incoming fragments' >> $MESH_FIREWALL_SCRIPT
  262. echo 'iptables -A INPUT -f -j DROP' >> $MESH_FIREWALL_SCRIPT
  263. echo '' >> $MESH_FIREWALL_SCRIPT
  264. echo '# Drop bogons' >> $MESH_FIREWALL_SCRIPT
  265. echo 'iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP' >> $MESH_FIREWALL_SCRIPT
  266. echo 'iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP' >> $MESH_FIREWALL_SCRIPT
  267. echo 'iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP' >> $MESH_FIREWALL_SCRIPT
  268. echo '' >> $MESH_FIREWALL_SCRIPT
  269. echo '# Incoming malformed NULL packets:' >> $MESH_FIREWALL_SCRIPT
  270. echo 'iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP' >> $MESH_FIREWALL_SCRIPT
  271. echo '' >> $MESH_FIREWALL_SCRIPT
  272. echo "iptables -A INPUT -p tcp --dport $TOX_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  273. echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport $ZERONET_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  274. echo "iptables -A INPUT -i $WIFI_INTERFACE -p tcp --dport $ZERONET_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  275. echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport $TRACKER_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  276. echo "iptables -A INPUT -i $WIFI_INTERFACE -p tcp --dport $TRACKER_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  277. echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport 1900 -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  278. chmod +x $MESH_FIREWALL_SCRIPT
  279. echo '[Unit]' > $FIREWALL_FILENAME
  280. echo 'Description=Mesh Firewall' >> $FIREWALL_FILENAME
  281. echo '' >> $FIREWALL_FILENAME
  282. echo '[Service]' >> $FIREWALL_FILENAME
  283. echo 'Type=oneshot' >> $FIREWALL_FILENAME
  284. echo 'ExecStart=/usr/bin/mesh-firewall' >> $FIREWALL_FILENAME
  285. echo 'RemainAfterExit=no' >> $FIREWALL_FILENAME
  286. echo '' >> $FIREWALL_FILENAME
  287. echo 'TimeoutSec=30' >> $FIREWALL_FILENAME
  288. echo '' >> $FIREWALL_FILENAME
  289. echo '[Install]' >> $FIREWALL_FILENAME
  290. echo 'WantedBy=multi-user.target' >> $FIREWALL_FILENAME
  291. chroot "$rootdir" systemctl enable meshfirewall
  292. }