freedombone-utils-firewall 23KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Firewall functions
  12. #
  13. # TODO: in future investigate using nftables
  14. #
  15. # License
  16. # =======
  17. #
  18. # Copyright (C) 2014-2017 Bob Mottram <bob@freedombone.net>
  19. #
  20. # This program is free software: you can redistribute it and/or modify
  21. # it under the terms of the GNU Affero General Public License as published by
  22. # the Free Software Foundation, either version 3 of the License, or
  23. # (at your option) any later version.
  24. #
  25. # This program is distributed in the hope that it will be useful,
  26. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  27. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  28. # GNU Affero General Public License for more details.
  29. #
  30. # You should have received a copy of the GNU Affero General Public License
  31. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  32. FIREWALL_CONFIG=$HOME/${PROJECT_NAME}-firewall.cfg
  33. FIREWALL_DOMAINS=$HOME/${PROJECT_NAME}-firewall-domains.cfg
  34. function save_firewall_settings {
  35. iptables-save > /etc/firewall.conf
  36. ip6tables-save > /etc/firewall6.conf
  37. printf '#!/bin/sh\n' > /etc/network/if-up.d/iptables
  38. printf 'iptables-restore < /etc/firewall.conf\n' >> /etc/network/if-up.d/iptables
  39. printf 'ip6tables-restore < /etc/firewall6.conf\n' >> /etc/network/if-up.d/iptables
  40. if [ -f /etc/network/if-up.d/iptables ]; then
  41. chmod +x /etc/network/if-up.d/iptables
  42. fi
  43. }
  44. function firewall_block_bad_ip_ranges {
  45. if [ $INSTALLING_MESH ]; then
  46. return
  47. fi
  48. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  49. return
  50. fi
  51. # There are various blocklists out there, but they're difficult
  52. # to verify. Indiscriminately blocking ranges without evidence
  53. # would be a bad idea.
  54. # From Wikipedia and elsewhere: US military addresses
  55. iptables -A INPUT -s 6.0.0.0/8 -j DROP
  56. iptables -A OUTPUT -s 6.0.0.0/8 -j DROP
  57. iptables -A INPUT -s 7.0.0.0/8 -j DROP
  58. iptables -A OUTPUT -s 7.0.0.0/8 -j DROP
  59. iptables -A INPUT -s 11.0.0.0/8 -j DROP
  60. iptables -A OUTPUT -s 11.0.0.0/8 -j DROP
  61. iptables -A INPUT -s 21.0.0.0/8 -j DROP
  62. iptables -A OUTPUT -s 21.0.0.0/8 -j DROP
  63. iptables -A INPUT -s 22.0.0.0/8 -j DROP
  64. iptables -A OUTPUT -s 22.0.0.0/8 -j DROP
  65. iptables -A INPUT -s 26.0.0.0/8 -j DROP
  66. iptables -A OUTPUT -s 26.0.0.0/8 -j DROP
  67. iptables -A INPUT -s 28.0.0.0/8 -j DROP
  68. iptables -A OUTPUT -s 28.0.0.0/8 -j DROP
  69. iptables -A INPUT -s 29.0.0.0/8 -j DROP
  70. iptables -A OUTPUT -s 29.0.0.0/8 -j DROP
  71. iptables -A INPUT -s 30.0.0.0/8 -j DROP
  72. iptables -A OUTPUT -s 30.0.0.0/8 -j DROP
  73. iptables -A INPUT -s 33.0.0.0/8 -j DROP
  74. iptables -A OUTPUT -s 33.0.0.0/8 -j DROP
  75. iptables -A INPUT -s 55.0.0.0/8 -j DROP
  76. iptables -A OUTPUT -s 55.0.0.0/8 -j DROP
  77. iptables -A INPUT -s 214.0.0.0/8 -j DROP
  78. iptables -A OUTPUT -s 214.0.0.0/8 -j DROP
  79. iptables -A INPUT -s 215.0.0.0/8 -j DROP
  80. iptables -A OUTPUT -s 215.0.0.0/8 -j DROP
  81. save_firewall_settings
  82. mark_completed $FUNCNAME
  83. }
  84. function global_rate_limit {
  85. if ! grep -q "tcp_challenge_ack_limit" /etc/sysctl.conf; then
  86. echo 'net.ipv4.tcp_challenge_ack_limit = 999999999' >> /etc/sysctl.conf
  87. else
  88. sed -i 's|net.ipv4.tcp_challenge_ack_limit.*|net.ipv4.tcp_challenge_ack_limit = 999999999|g' /etc/sysctl.conf
  89. fi
  90. sysctl -p -q
  91. }
  92. function enable_ipv6 {
  93. # endure that ipv6 is enabled and can route
  94. sed -i 's/net.ipv6.conf.all.disable_ipv6.*/net.ipv6.conf.all.disable_ipv6 = 0/g' /etc/sysctl.conf
  95. #sed -i "s/net.ipv6.conf.all.accept_redirects.*/net.ipv6.conf.all.accept_redirects = 1/g" /etc/sysctl.conf
  96. #sed -i "s/net.ipv6.conf.all.accept_source_route.*/net.ipv6.conf.all.accept_source_route = 1/g" /etc/sysctl.conf
  97. sed -i "s/net.ipv6.conf.all.forwarding.*/net.ipv6.conf.all.forwarding=1/g" /etc/sysctl.conf
  98. echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
  99. }
  100. function configure_firewall {
  101. if [ $INSTALLING_MESH ]; then
  102. mesh_firewall
  103. return
  104. fi
  105. if grep -q "RELATED" /etc/firewall.conf; then
  106. # recreate the firewall to remove RELATED
  107. sed -i "/firewall/d" $COMPLETION_FILE
  108. fi
  109. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  110. return
  111. fi
  112. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  113. # docker does its own firewalling
  114. return
  115. fi
  116. iptables -P INPUT ACCEPT
  117. ip6tables -P INPUT ACCEPT
  118. iptables -F
  119. ip6tables -F
  120. iptables -t nat -F
  121. ip6tables -t nat -F
  122. iptables -X
  123. ip6tables -X
  124. iptables -P INPUT DROP
  125. ip6tables -P INPUT DROP
  126. iptables -P FORWARD DROP
  127. ip6tables -P FORWARD DROP
  128. iptables -A INPUT -i lo -j ACCEPT
  129. iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
  130. # Drop invalid packets
  131. iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP
  132. # Make sure incoming tcp connections are SYN packets
  133. iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
  134. iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
  135. # Drop SYN packets with suspicious MSS value
  136. iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
  137. # Drop packets with incoming fragments
  138. iptables -A INPUT -f -j DROP
  139. # Drop bogons
  140. iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
  141. iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
  142. iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
  143. iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
  144. iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
  145. iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
  146. iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
  147. iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
  148. iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
  149. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
  150. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
  151. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
  152. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
  153. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
  154. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
  155. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
  156. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
  157. # Incoming malformed NULL packets:
  158. iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
  159. mark_completed $FUNCNAME
  160. }
  161. function firewall_drop_telnet {
  162. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  163. return
  164. fi
  165. # telnet isn't enabled as an input and we can also
  166. # drop any outgoing telnet, just in case
  167. iptables -A OUTPUT -p tcp --dport telnet -j REJECT
  168. iptables -A OUTPUT -p udp --dport telnet -j REJECT
  169. function_check save_firewall_settings
  170. save_firewall_settings
  171. mark_completed $FUNCNAME
  172. }
  173. function configure_firewall_ping {
  174. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  175. return
  176. fi
  177. # Only allow ping for mesh installs
  178. if [[ $SYSTEM_TYPE != "mesh"* ]]; then
  179. return
  180. fi
  181. iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
  182. iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
  183. function_check save_firewall_settings
  184. save_firewall_settings
  185. mark_completed $FUNCNAME
  186. }
  187. function configure_internet_protocol {
  188. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  189. return
  190. fi
  191. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  192. return
  193. fi
  194. sed -i "s/#net.ipv4.tcp_syncookies.*/net.ipv4.tcp_syncookies=1/g" /etc/sysctl.conf
  195. sed -i "s/#net.ipv4.conf.all.accept_redirects.*/net.ipv4.conf.all.accept_redirects = 0/g" /etc/sysctl.conf
  196. sed -i "s/#net.ipv6.conf.all.accept_redirects.*/net.ipv6.conf.all.accept_redirects = 0/g" /etc/sysctl.conf
  197. sed -i "s/#net.ipv4.conf.all.send_redirects.*/net.ipv4.conf.all.send_redirects = 0/g" /etc/sysctl.conf
  198. sed -i "s/#net.ipv4.conf.all.accept_source_route.*/net.ipv4.conf.all.accept_source_route = 0/g" /etc/sysctl.conf
  199. sed -i "s/#net.ipv6.conf.all.accept_source_route.*/net.ipv6.conf.all.accept_source_route = 0/g" /etc/sysctl.conf
  200. sed -i "s/#net.ipv4.conf.default.rp_filter.*/net.ipv4.conf.default.rp_filter=1/g" /etc/sysctl.conf
  201. sed -i "s/#net.ipv4.conf.all.rp_filter.*/net.ipv4.conf.all.rp_filter=1/g" /etc/sysctl.conf
  202. sed -i "s/#net.ipv4.ip_forward.*/net.ipv4.ip_forward=0/g" /etc/sysctl.conf
  203. sed -i "s/#net.ipv6.conf.all.forwarding.*/net.ipv6.conf.all.forwarding=0/g" /etc/sysctl.conf
  204. sed -i "s/# net.ipv4.tcp_syncookies.*/net.ipv4.tcp_syncookies=1/g" /etc/sysctl.conf
  205. sed -i "s/# net.ipv4.conf.all.accept_redirects.*/net.ipv4.conf.all.accept_redirects = 0/g" /etc/sysctl.conf
  206. sed -i "s/# net.ipv6.conf.all.accept_redirects.*/net.ipv6.conf.all.accept_redirects = 0/g" /etc/sysctl.conf
  207. sed -i "s/# net.ipv4.conf.all.send_redirects.*/net.ipv4.conf.all.send_redirects = 0/g" /etc/sysctl.conf
  208. sed -i "s/# net.ipv4.conf.all.accept_source_route.*/net.ipv4.conf.all.accept_source_route = 0/g" /etc/sysctl.conf
  209. sed -i "s/# net.ipv6.conf.all.accept_source_route.*/net.ipv6.conf.all.accept_source_route = 0/g" /etc/sysctl.conf
  210. sed -i "s/# net.ipv4.conf.default.rp_filter.*/net.ipv4.conf.default.rp_filter=1/g" /etc/sysctl.conf
  211. sed -i "s/# net.ipv4.conf.all.rp_filter.*/net.ipv4.conf.all.rp_filter=1/g" /etc/sysctl.conf
  212. sed -i "s/# net.ipv4.ip_forward.*/net.ipv4.ip_forward=0/g" /etc/sysctl.conf
  213. sed -i "s/# net.ipv6.conf.all.forwarding.*/net.ipv6.conf.all.forwarding=0/g" /etc/sysctl.conf
  214. if ! grep -q "ignore pings" /etc/sysctl.conf; then
  215. echo '# ignore pings' >> /etc/sysctl.conf
  216. echo 'net.ipv4.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf
  217. echo 'net.ipv6.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf
  218. fi
  219. if ! grep -q "disable ipv6" /etc/sysctl.conf; then
  220. echo '# disable ipv6' >> /etc/sysctl.conf
  221. echo 'net.ipv6.conf.all.disable_ipv6 = 1' >> /etc/sysctl.conf
  222. fi
  223. if ! grep -q "net.ipv4.tcp_synack_retries" /etc/sysctl.conf; then
  224. echo 'net.ipv4.tcp_synack_retries = 2' >> /etc/sysctl.conf
  225. echo 'net.ipv4.tcp_syn_retries = 1' >> /etc/sysctl.conf
  226. fi
  227. if ! grep -q "keepalive" /etc/sysctl.conf; then
  228. echo '# keepalive' >> /etc/sysctl.conf
  229. echo 'net.ipv4.tcp_keepalive_probes = 9' >> /etc/sysctl.conf
  230. echo 'net.ipv4.tcp_keepalive_intvl = 75' >> /etc/sysctl.conf
  231. echo 'net.ipv4.tcp_keepalive_time = 7200' >> /etc/sysctl.conf
  232. fi
  233. if ! grep -q "net.ipv4.conf.default.send_redirects" /etc/sysctl.conf; then
  234. echo "net.ipv4.conf.default.send_redirects = 0" >> /etc/sysctl.conf
  235. else
  236. sed -i "s|# net.ipv4.conf.default.send_redirects.*|net.ipv4.conf.default.send_redirects = 0|g" /etc/sysctl.conf
  237. sed -i "s|#net.ipv4.conf.default.send_redirects.*|net.ipv4.conf.default.send_redirects = 0|g" /etc/sysctl.conf
  238. sed -i "s|net.ipv4.conf.default.send_redirects.*|net.ipv4.conf.default.send_redirects = 0|g" /etc/sysctl.conf
  239. fi
  240. if ! grep -q "net.ipv4.conf.all.secure_redirects" /etc/sysctl.conf; then
  241. echo "net.ipv4.conf.all.secure_redirects = 0" >> /etc/sysctl.conf
  242. else
  243. sed -i "s|# net.ipv4.conf.all.secure_redirects.*|net.ipv4.conf.all.secure_redirects = 0|g" /etc/sysctl.conf
  244. sed -i "s|#net.ipv4.conf.all.secure_redirects.*|net.ipv4.conf.all.secure_redirects = 0|g" /etc/sysctl.conf
  245. sed -i "s|net.ipv4.conf.all.secure_redirects.*|net.ipv4.conf.all.secure_redirects = 0|g" /etc/sysctl.conf
  246. fi
  247. if ! grep -q "net.ipv4.conf.default.accept_source_route" /etc/sysctl.conf; then
  248. echo "net.ipv4.conf.default.accept_source_route = 0" >> /etc/sysctl.conf
  249. else
  250. sed -i "s|# net.ipv4.conf.default.accept_source_route.*|net.ipv4.conf.default.accept_source_route = 0|g" /etc/sysctl.conf
  251. sed -i "s|#net.ipv4.conf.default.accept_source_route.*|net.ipv4.conf.default.accept_source_route = 0|g" /etc/sysctl.conf
  252. sed -i "s|net.ipv4.conf.default.accept_source_route.*|net.ipv4.conf.default.accept_source_route = 0|g" /etc/sysctl.conf
  253. fi
  254. if ! grep -q "net.ipv4.conf.default.secure_redirects" /etc/sysctl.conf; then
  255. echo "net.ipv4.conf.default.secure_redirects = 0" >> /etc/sysctl.conf
  256. else
  257. sed -i "s|# net.ipv4.conf.default.secure_redirects.*|net.ipv4.conf.default.secure_redirects = 0|g" /etc/sysctl.conf
  258. sed -i "s|#net.ipv4.conf.default.secure_redirects.*|net.ipv4.conf.default.secure_redirects = 0|g" /etc/sysctl.conf
  259. sed -i "s|net.ipv4.conf.default.secure_redirects.*|net.ipv4.conf.default.secure_redirects = 0|g" /etc/sysctl.conf
  260. fi
  261. if ! grep -q "net.ipv4.conf.default.accept_redirects" /etc/sysctl.conf; then
  262. echo "net.ipv4.conf.default.accept_redirects = 0" >> /etc/sysctl.conf
  263. else
  264. sed -i "s|# net.ipv4.conf.default.accept_redirects.*|net.ipv4.conf.default.accept_redirects = 0|g" /etc/sysctl.conf
  265. sed -i "s|#net.ipv4.conf.default.accept_redirects.*|net.ipv4.conf.default.accept_redirects = 0|g" /etc/sysctl.conf
  266. sed -i "s|net.ipv4.conf.default.accept_redirects.*|net.ipv4.conf.default.accept_redirects = 0|g" /etc/sysctl.conf
  267. fi
  268. mark_completed $FUNCNAME
  269. }
  270. function mesh_firewall {
  271. FIREWALL_FILENAME=${rootdir}/etc/systemd/system/meshfirewall.service
  272. MESH_FIREWALL_SCRIPT=${rootdir}/usr/bin/mesh-firewall
  273. echo '#!/bin/bash' > $MESH_FIREWALL_SCRIPT
  274. echo 'iptables -P INPUT ACCEPT' >> $MESH_FIREWALL_SCRIPT
  275. echo 'ip6tables -P INPUT ACCEPT' >> $MESH_FIREWALL_SCRIPT
  276. echo 'iptables -F' >> $MESH_FIREWALL_SCRIPT
  277. echo 'ip6tables -F' >> $MESH_FIREWALL_SCRIPT
  278. echo 'iptables -t nat -F' >> $MESH_FIREWALL_SCRIPT
  279. echo 'ip6tables -t nat -F' >> $MESH_FIREWALL_SCRIPT
  280. echo 'iptables -X' >> $MESH_FIREWALL_SCRIPT
  281. echo 'ip6tables -X' >> $MESH_FIREWALL_SCRIPT
  282. echo 'iptables -P INPUT DROP' >> $MESH_FIREWALL_SCRIPT
  283. echo 'ip6tables -P INPUT DROP' >> $MESH_FIREWALL_SCRIPT
  284. echo 'iptables -A INPUT -i lo -j ACCEPT' >> $MESH_FIREWALL_SCRIPT
  285. echo 'iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT' >> $MESH_FIREWALL_SCRIPT
  286. echo '' >> $MESH_FIREWALL_SCRIPT
  287. echo '# Make sure incoming tcp connections are SYN packets' >> $MESH_FIREWALL_SCRIPT
  288. echo 'iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP' >> $MESH_FIREWALL_SCRIPT
  289. echo '' >> $MESH_FIREWALL_SCRIPT
  290. echo '# Drop packets with incoming fragments' >> $MESH_FIREWALL_SCRIPT
  291. echo 'iptables -A INPUT -f -j DROP' >> $MESH_FIREWALL_SCRIPT
  292. echo '' >> $MESH_FIREWALL_SCRIPT
  293. echo '# Drop bogons' >> $MESH_FIREWALL_SCRIPT
  294. echo 'iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP' >> $MESH_FIREWALL_SCRIPT
  295. echo 'iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP' >> $MESH_FIREWALL_SCRIPT
  296. echo 'iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP' >> $MESH_FIREWALL_SCRIPT
  297. echo '' >> $MESH_FIREWALL_SCRIPT
  298. echo '# Incoming malformed NULL packets:' >> $MESH_FIREWALL_SCRIPT
  299. echo 'iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP' >> $MESH_FIREWALL_SCRIPT
  300. echo '' >> $MESH_FIREWALL_SCRIPT
  301. echo "iptables -A INPUT -p tcp --dport $TOX_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  302. echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport $ZERONET_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  303. echo "iptables -A INPUT -i $WIFI_INTERFACE -p tcp --dport $ZERONET_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  304. echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport $TRACKER_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  305. echo "iptables -A INPUT -i $WIFI_INTERFACE -p tcp --dport $TRACKER_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  306. echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport 1900 -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  307. chmod +x $MESH_FIREWALL_SCRIPT
  308. echo '[Unit]' > $FIREWALL_FILENAME
  309. echo 'Description=Mesh Firewall' >> $FIREWALL_FILENAME
  310. echo '' >> $FIREWALL_FILENAME
  311. echo '[Service]' >> $FIREWALL_FILENAME
  312. echo 'Type=oneshot' >> $FIREWALL_FILENAME
  313. echo 'ExecStart=/usr/bin/mesh-firewall' >> $FIREWALL_FILENAME
  314. echo 'RemainAfterExit=no' >> $FIREWALL_FILENAME
  315. echo '' >> $FIREWALL_FILENAME
  316. echo 'TimeoutSec=30' >> $FIREWALL_FILENAME
  317. echo '' >> $FIREWALL_FILENAME
  318. echo '[Install]' >> $FIREWALL_FILENAME
  319. echo 'WantedBy=multi-user.target' >> $FIREWALL_FILENAME
  320. chmod +x $FIREWALL_FILENAME
  321. chroot "$rootdir" systemctl enable meshfirewall
  322. }
  323. function firewall_add {
  324. firewall_name=$(echo "$1" | sed "s| |-|g")
  325. firewall_port=$2
  326. firewall_protocol="$3"
  327. if ! grep -q "${firewall_name}=${firewall_port}" $FIREWALL_CONFIG; then
  328. echo "${firewall_name}=${firewall_port}" >> $FIREWALL_CONFIG
  329. if [ ! ${firewall_protocol} ]; then
  330. iptables -A INPUT -p udp --dport ${firewall_port} -j ACCEPT
  331. iptables -A INPUT -p tcp --dport ${firewall_port} -j ACCEPT
  332. else
  333. if [[ "${firewall_protocol}" == *"udp"* ]]; then
  334. iptables -A INPUT -p udp --dport ${firewall_port} -j ACCEPT
  335. fi
  336. if [[ "${firewall_protocol}" == *"tcp"* ]]; then
  337. iptables -A INPUT -p tcp --dport ${firewall_port} -j ACCEPT
  338. fi
  339. fi
  340. save_firewall_settings
  341. fi
  342. }
  343. function firewall_add_range {
  344. firewall_name=$(echo "$1" | sed "s| |-|g")
  345. firewall_port_start=$2
  346. firewall_port_end=$3
  347. firewall_protocol="$4"
  348. if ! grep -q "${firewall_name}=${firewall_port_start}:${firewall_port_end}" $FIREWALL_CONFIG; then
  349. echo "${firewall_name}=${firewall_port_start}:${firewall_port_end}" >> $FIREWALL_CONFIG
  350. if [ ! ${firewall_protocol} ]; then
  351. iptables -A INPUT -p udp --dport ${firewall_port_start}:${firewall_port_end} -j ACCEPT
  352. iptables -A INPUT -p tcp --dport ${firewall_port_start}:${firewall_port_end} -j ACCEPT
  353. else
  354. if [[ "${firewall_protocol}" == *"udp"* ]]; then
  355. iptables -A INPUT -p udp --dport ${firewall_port_start}:${firewall_port_end} -j ACCEPT
  356. fi
  357. if [[ "${firewall_protocol}" == *"tcp"* ]]; then
  358. iptables -A INPUT -p tcp --dport ${firewall_port_start}:${firewall_port_end} -j ACCEPT
  359. fi
  360. fi
  361. save_firewall_settings
  362. fi
  363. }
  364. function firewall_remove {
  365. firewall_port=$1
  366. firewall_protocol="$2"
  367. if [ ! -f $FIREWALL_CONFIG ]; then
  368. return
  369. fi
  370. if grep -q "=${firewall_port}" $FIREWALL_CONFIG; then
  371. if [ ! ${firewall_protocol} ]; then
  372. iptables -D INPUT -p udp --dport ${firewall_port} -j ACCEPT
  373. iptables -D INPUT -p tcp --dport ${firewall_port} -j ACCEPT
  374. else
  375. if [[ "${firewall_protocol}" == *"udp"* ]]; then
  376. iptables -D INPUT -p udp --dport ${firewall_port} -j ACCEPT
  377. fi
  378. if [[ "${firewall_protocol}" == *"tcp"* ]]; then
  379. iptables -D INPUT -p tcp --dport ${firewall_port} -j ACCEPT
  380. fi
  381. fi
  382. sed -i "/=${firewall_port}/d" $FIREWALL_CONFIG
  383. save_firewall_settings
  384. fi
  385. }
  386. function domain_to_hex_string {
  387. domain="$1"
  388. ctr=1
  389. segment=$(echo "$domain" | awk -F '.' -v value="$ctr" '{print $value}')
  390. while [ ${#segment} -gt 0 ]
  391. do
  392. characters=$(echo -n "$segment" | wc -c)
  393. hexnum=$(echo "obase=16; $characters" | bc)
  394. echo -n "|"
  395. if [ $(echo -n "$hexnum" | wc -c) -lt 2 ]; then
  396. echo -n "0"
  397. fi
  398. echo -n "$hexnum|$segment"
  399. ctr=$((ctr + 1))
  400. segment=$(echo "$domain" | awk -F '.' -v value="$ctr" '{print $value}')
  401. done
  402. echo ""
  403. }
  404. function firewall_block_domain {
  405. blocked_domain="$1"
  406. if ! grep "$blocked_domain" $FIREWALL_DOMAINS; then
  407. hexstr=$(domain_to_hex_string $blocked_domain)
  408. iptables -A INPUT -p udp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
  409. iptables -A INPUT -p tcp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
  410. iptables -A OUTPUT -p udp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
  411. iptables -A OUTPUT -p tcp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
  412. iptables -I FORWARD -p udp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
  413. iptables -I FORWARD -p tcp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
  414. echo "${blocked_domain}" >> $FIREWALL_DOMAINS
  415. save_firewall_settings
  416. # run the blocking rules now
  417. if [ -f /usr/bin/gnusocial-firewall ]; then
  418. /usr/bin/gnusocial-firewall
  419. fi
  420. if [ -f /usr/bin/postactiv-firewall ]; then
  421. /usr/bin/postactiv-firewall
  422. fi
  423. fi
  424. }
  425. function firewall_unblock_domain {
  426. unblocked_domain="$1"
  427. if grep "${unblocked_domain}" $FIREWALL_DOMAINS; then
  428. hexstr=$(domain_to_hex_string $unblocked_domain)
  429. iptables -D INPUT -p udp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
  430. iptables -D INPUT -p tcp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
  431. iptables -D OUTPUT -p udp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
  432. iptables -D OUTPUT -p tcp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
  433. iptables -D FORWARD -p udp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
  434. iptables -D FORWARD -p tcp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
  435. sed -i "/${unblocked_domain}/d" $FIREWALL_DOMAINS
  436. save_firewall_settings
  437. fi
  438. }
  439. function firewall_drop_spoofed_packets {
  440. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  441. return
  442. fi
  443. iptables -t mangle -A PREROUTING -s 224.0.0.0/3 -j DROP
  444. iptables -t mangle -A PREROUTING -s 169.254.0.0/16 -j DROP
  445. iptables -t mangle -A PREROUTING -s 172.16.0.0/12 -j DROP
  446. iptables -t mangle -A PREROUTING -s 192.0.2.0/24 -j DROP
  447. iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP
  448. iptables -t mangle -A PREROUTING -s 240.0.0.0/5 -j DROP
  449. iptables -t mangle -A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP
  450. function_check save_firewall_settings
  451. save_firewall_settings
  452. mark_completed $FUNCNAME
  453. }
  454. function firewall_rate_limits {
  455. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  456. return
  457. fi
  458. # Limit connections per source IP
  459. iptables -A INPUT -p tcp -m connlimit --connlimit-above 111 -j REJECT --reject-with tcp-reset
  460. # Limit RST packets
  461. iptables -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT
  462. iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP
  463. # Limit new TCP connections per second per source IP
  464. iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
  465. iptables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP
  466. # SSH brute-force protection
  467. iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --set
  468. iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 -j DROP
  469. function_check save_firewall_settings
  470. save_firewall_settings
  471. mark_completed $FUNCNAME
  472. }
  473. # NOTE: deliberately no exit 0