249 lines
8.5 KiB
Plaintext
249 lines
8.5 KiB
Plaintext
|
#!/bin/bash
|
||
|
|
#
|
||
|
|
# .---. . .
|
||
|
|
# | | |
|
||
|
|
# |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
|
||
|
|
# | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
|
||
|
|
# ' ' --' --' -' - -' ' ' -' -' -' ' - --'
|
||
|
|
#
|
||
|
|
# Freedom in the Cloud
|
||
|
|
#
|
||
|
|
# Firewall functions
|
||
|
|
#
|
||
|
|
# License
|
||
|
|
# =======
|
||
|
|
#
|
||
|
|
# Copyright (C) 2014-2016 Bob Mottram <bob@robotics.uk.to>
|
||
|
|
#
|
||
|
|
# This program is free software: you can redistribute it and/or modify
|
||
|
|
# it under the terms of the GNU Affero General Public License as published by
|
||
|
|
# the Free Software Foundation, either version 3 of the License, or
|
||
|
|
# (at your option) any later version.
|
||
|
|
#
|
||
|
|
# This program is distributed in the hope that it will be useful,
|
||
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||
|
|
# GNU Affero General Public License for more details.
|
||
|
|
#
|
||
|
|
# You should have received a copy of the GNU Affero General Public License
|
||
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||
|
|
|
||
|
|
function save_firewall_settings {
|
||
|
|
iptables-save > /etc/firewall.conf
|
||
|
|
ip6tables-save > /etc/firewall6.conf
|
||
|
|
printf '#!/bin/sh\n' > /etc/network/if-up.d/iptables
|
||
|
|
printf 'iptables-restore < /etc/firewall.conf\n' >> /etc/network/if-up.d/iptables
|
||
|
|
printf 'ip6tables-restore < /etc/firewall6.conf\n' >> /etc/network/if-up.d/iptables
|
||
|
|
chmod +x /etc/network/if-up.d/iptables
|
||
|
|
}
|
||
|
|
|
||
|
|
function enable_ipv6 {
|
||
|
|
# endure that ipv6 is enabled and can route
|
||
|
|
sed -i 's/net.ipv6.conf.all.disable_ipv6.*/net.ipv6.conf.all.disable_ipv6 = 0/g' /etc/sysctl.conf
|
||
|
|
#sed -i "s/net.ipv6.conf.all.accept_redirects.*/net.ipv6.conf.all.accept_redirects = 1/g" /etc/sysctl.conf
|
||
|
|
#sed -i "s/net.ipv6.conf.all.accept_source_route.*/net.ipv6.conf.all.accept_source_route = 1/g" /etc/sysctl.conf
|
||
|
|
sed -i "s/net.ipv6.conf.all.forwarding.*/net.ipv6.conf.all.forwarding=1/g" /etc/sysctl.conf
|
||
|
|
echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
|
||
|
|
}
|
||
|
|
|
||
|
|
function configure_firewall {
|
||
|
|
if grep -q "RELATED" /etc/firewall.conf; then
|
||
|
|
# recreate the firewall to remove RELATED
|
||
|
|
sed -i "/firewall/d" $COMPLETION_FILE
|
||
|
|
fi
|
||
|
|
if grep -Fxq "configure_firewall" $COMPLETION_FILE; then
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
|
||
|
|
# docker does its own firewalling
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
iptables -P INPUT ACCEPT
|
||
|
|
ip6tables -P INPUT ACCEPT
|
||
|
|
iptables -F
|
||
|
|
ip6tables -F
|
||
|
|
iptables -t nat -F
|
||
|
|
ip6tables -t nat -F
|
||
|
|
iptables -X
|
||
|
|
ip6tables -X
|
||
|
|
iptables -P INPUT DROP
|
||
|
|
ip6tables -P INPUT DROP
|
||
|
|
iptables -A INPUT -i lo -j ACCEPT
|
||
|
|
iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
||
|
|
|
||
|
|
# Make sure incoming tcp connections are SYN packets
|
||
|
|
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
|
||
|
|
|
||
|
|
# Drop packets with incoming fragments
|
||
|
|
iptables -A INPUT -f -j DROP
|
||
|
|
|
||
|
|
# Drop bogons
|
||
|
|
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
|
||
|
|
iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
|
||
|
|
iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
|
||
|
|
|
||
|
|
# Incoming malformed NULL packets:
|
||
|
|
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
|
||
|
|
|
||
|
|
echo 'configure_firewall' >> $COMPLETION_FILE
|
||
|
|
}
|
||
|
|
|
||
|
|
function configure_firewall_ping {
|
||
|
|
if grep -Fxq "configure_firewall_ping" $COMPLETION_FILE; then
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
# Only allow ping for mesh installs
|
||
|
|
if [[ $SYSTEM_TYPE != "$VARIANT_MESH" ]]; then
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
|
||
|
|
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
|
||
|
|
function_check save_firewall_settings
|
||
|
|
save_firewall_settings
|
||
|
|
echo 'configure_firewall_ping' >> $COMPLETION_FILE
|
||
|
|
}
|
||
|
|
|
||
|
|
function configure_firewall_for_avahi {
|
||
|
|
if grep -Fxq "configure_firewall_for_avahi" $COMPLETION_FILE; then
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
iptables -A INPUT -p tcp --dport 548 -j ACCEPT
|
||
|
|
iptables -A INPUT -p udp --dport 548 -j ACCEPT
|
||
|
|
iptables -A INPUT -p tcp --dport 5353 -j ACCEPT
|
||
|
|
iptables -A INPUT -p udp --dport 5353 -j ACCEPT
|
||
|
|
iptables -A INPUT -p tcp --dport 5354 -j ACCEPT
|
||
|
|
iptables -A INPUT -p udp --dport 5354 -j ACCEPT
|
||
|
|
function_check save_firewall_settings
|
||
|
|
save_firewall_settings
|
||
|
|
echo 'configure_firewall_for_avahi' >> $COMPLETION_FILE
|
||
|
|
}
|
||
|
|
|
||
|
|
function configure_firewall_for_dns {
|
||
|
|
if grep -Fxq "configure_firewall_for_dns" $COMPLETION_FILE; then
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
|
||
|
|
# docker does its own firewalling
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
iptables -A INPUT -p udp -m udp --dport 1024:65535 --sport 53 -j ACCEPT
|
||
|
|
function_check save_firewall_settings
|
||
|
|
save_firewall_settings
|
||
|
|
echo 'configure_firewall_for_dns' >> $COMPLETION_FILE
|
||
|
|
}
|
||
|
|
|
||
|
|
function configure_firewall_for_web_access {
|
||
|
|
if grep -Fxq "configure_firewall_for_web_access" $COMPLETION_FILE; then
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
|
||
|
|
# docker does its own firewalling
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
if [[ $ONION_ONLY != "no" ]]; then
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
iptables -A INPUT -p tcp --dport 32768:61000 --sport 80 -j ACCEPT
|
||
|
|
iptables -A INPUT -p tcp --dport 32768:61000 --sport 443 -j ACCEPT
|
||
|
|
function_check save_firewall_settings
|
||
|
|
save_firewall_settings
|
||
|
|
|
||
|
|
echo 'configure_firewall_for_web_access' >> $COMPLETION_FILE
|
||
|
|
}
|
||
|
|
|
||
|
|
function configure_firewall_for_web_server {
|
||
|
|
if grep -Fxq "configure_firewall_for_web_server" $COMPLETION_FILE; then
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
|
||
|
|
# docker does its own firewalling
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
if [[ $ONION_ONLY != "no" ]]; then
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
|
||
|
|
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
|
||
|
|
function_check save_firewall_settings
|
||
|
|
save_firewall_settings
|
||
|
|
|
||
|
|
OPEN_PORTS+=('HTTP 80')
|
||
|
|
OPEN_PORTS+=('HTTPS 443')
|
||
|
|
echo 'configure_firewall_for_web_server' >> $COMPLETION_FILE
|
||
|
|
}
|
||
|
|
|
||
|
|
function configure_firewall_for_ssh {
|
||
|
|
if grep -Fxq "configure_firewall_for_ssh" $COMPLETION_FILE; then
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
|
||
|
|
# docker does its own firewalling
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||
|
|
iptables -A INPUT -p tcp --dport $SSH_PORT -j ACCEPT
|
||
|
|
function_check save_firewall_settings
|
||
|
|
save_firewall_settings
|
||
|
|
|
||
|
|
OPEN_PORTS+=("SSH $SSH_PORT")
|
||
|
|
echo 'configure_firewall_for_ssh' >> $COMPLETION_FILE
|
||
|
|
}
|
||
|
|
|
||
|
|
function configure_firewall_for_git {
|
||
|
|
if grep -Fxq "configure_firewall_for_git" $COMPLETION_FILE; then
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
|
||
|
|
# docker does its own firewalling
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
if [[ $ONION_ONLY != "no" ]]; then
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
iptables -A INPUT -p tcp --dport 9418 -j ACCEPT
|
||
|
|
function_check save_firewall_settings
|
||
|
|
save_firewall_settings
|
||
|
|
|
||
|
|
OPEN_PORTS+=("Git 9418")
|
||
|
|
echo 'configure_firewall_for_git' >> $COMPLETION_FILE
|
||
|
|
}
|
||
|
|
|
||
|
|
function configure_internet_protocol {
|
||
|
|
if grep -Fxq "configure_internet_protocol" $COMPLETION_FILE; then
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
if [[ $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
|
||
|
|
return
|
||
|
|
fi
|
||
|
|
sed -i "s/#net.ipv4.tcp_syncookies=1/net.ipv4.tcp_syncookies=1/g" /etc/sysctl.conf
|
||
|
|
sed -i "s/#net.ipv4.conf.all.accept_redirects = 0/net.ipv4.conf.all.accept_redirects = 0/g" /etc/sysctl.conf
|
||
|
|
sed -i "s/#net.ipv6.conf.all.accept_redirects = 0/net.ipv6.conf.all.accept_redirects = 0/g" /etc/sysctl.conf
|
||
|
|
sed -i "s/#net.ipv4.conf.all.send_redirects = 0/net.ipv4.conf.all.send_redirects = 0/g" /etc/sysctl.conf
|
||
|
|
sed -i "s/#net.ipv4.conf.all.accept_source_route = 0/net.ipv4.conf.all.accept_source_route = 0/g" /etc/sysctl.conf
|
||
|
|
sed -i "s/#net.ipv6.conf.all.accept_source_route = 0/net.ipv6.conf.all.accept_source_route = 0/g" /etc/sysctl.conf
|
||
|
|
sed -i "s/#net.ipv4.conf.default.rp_filter=1/net.ipv4.conf.default.rp_filter=1/g" /etc/sysctl.conf
|
||
|
|
sed -i "s/#net.ipv4.conf.all.rp_filter=1/net.ipv4.conf.all.rp_filter=1/g" /etc/sysctl.conf
|
||
|
|
sed -i "s/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=0/g" /etc/sysctl.conf
|
||
|
|
sed -i "s/#net.ipv6.conf.all.forwarding=1/net.ipv6.conf.all.forwarding=0/g" /etc/sysctl.conf
|
||
|
|
if ! grep -q "ignore pings" /etc/sysctl.conf; then
|
||
|
|
echo '# ignore pings' >> /etc/sysctl.conf
|
||
|
|
echo 'net.ipv4.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf
|
||
|
|
echo 'net.ipv6.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf
|
||
|
|
fi
|
||
|
|
if ! grep -q "disable ipv6" /etc/sysctl.conf; then
|
||
|
|
echo '# disable ipv6' >> /etc/sysctl.conf
|
||
|
|
echo 'net.ipv6.conf.all.disable_ipv6 = 1' >> /etc/sysctl.conf
|
||
|
|
fi
|
||
|
|
if ! grep -q "net.ipv4.tcp_synack_retries" /etc/sysctl.conf; then
|
||
|
|
echo 'net.ipv4.tcp_synack_retries = 2' >> /etc/sysctl.conf
|
||
|
|
echo 'net.ipv4.tcp_syn_retries = 1' >> /etc/sysctl.conf
|
||
|
|
fi
|
||
|
|
if ! grep -q "keepalive" /etc/sysctl.conf; then
|
||
|
|
echo '# keepalive' >> /etc/sysctl.conf
|
||
|
|
echo 'net.ipv4.tcp_keepalive_probes = 9' >> /etc/sysctl.conf
|
||
|
|
echo 'net.ipv4.tcp_keepalive_intvl = 75' >> /etc/sysctl.conf
|
||
|
|
echo 'net.ipv4.tcp_keepalive_time = 7200' >> /etc/sysctl.conf
|
||
|
|
fi
|
||
|
|
echo 'configure_internet_protocol' >> $COMPLETION_FILE
|
||
|
|
}
|