From a032cdea7564fdd88d1c2f1a9f7694e99de090df Mon Sep 17 00:00:00 2001 From: vascoalvesxyz Date: Tue, 24 Mar 2026 11:07:33 +0000 Subject: [PATCH] variables --- ROUTER.sh | 127 ++++++++++++++++++++++++++++-------------------------- 1 file changed, 66 insertions(+), 61 deletions(-) diff --git a/ROUTER.sh b/ROUTER.sh index e3e917d..5689ba8 100644 --- a/ROUTER.sh +++ b/ROUTER.sh @@ -1,42 +1,33 @@ -# NETWORKS: -# DMZ: 23.214.219.128/25 -# Internal: 192.168.10.0/24 -# -# MACHINES: -# DNS2: 192.137.16.75 -# EDEN 193.138.212.1 +#!/bin/bash + dns2="87.248.214.99" eden="87.248.214.100" -# ============================== # Router 1 -# INTERFACES: -# - Internet: 87.248.214.97 -# - DMZ: 23.214.219.254 -# - Internal: 192.168.10.254 -# ============================== +dmzIP="23.214.219.254" +internalIP="192.168.10.254" +externalIP="87.248.214.97" -# ============================== # DMZ /25 -# IP: -# - dns : 23.214.219.130 -# - smtp : 23.214.219.131 -# - www : 23.214.219.132 -# - vpn-gw: 23.214.219.133 -# - mail: 23.214.219.134 -# ============================== +dns="23.214.219.130" +smtp="23.214.219.131" +www="23.214.219.132" +vpn_gw="23.214.219.133" +mail="23.214.219.134" -# ============================== # Internal -# IP: -# ftp: 192.168.10.2 -# datastore : 192.168.10.3 -# DHCP Client : 192.168.10.4-5 -# ============================== +ftp="192.168.10.2" +datastore="192.168.10.3" +dhcpClient="192.168.10.4" -sudo ifconfig enp0s8 23.214.219.254 netmask 255.255.255.128 -sudo ifconfig enp0s9 192.168.10.254 netmask 255.255.255.0 -sudo ifconfig enp0s10 87.248.214.97 netmask 255.255.255.0 +# Interfaces +dmzIF="enp0s8" +internalIF="enp0s9" +externalIF="enp0s10" + +sudo ifconfig $dmzIF $dmzIP netmask 255.255.255.128 +sudo ifconfig $internalIF $internalIP netmask 255.255.255.0 +sudo ifconfig $externalIF $externalIP netmask 255.255.255.0 sudo yum install iptables-services -y sudo systemctl stop firewalld @@ -52,50 +43,64 @@ iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT sudo iptables -A INPUT -i lo -j ACCEPT sudo iptables -A OUTPUT -o lo -j ACCEPT -#sudo iptables -t nat -A POSTROUTING -i enp0s9 -o enp0s3 -j MASQUERADE #SUS + +#sudo iptables -t nat -A POSTROUTING -i $internalIF -o enp0s3 -j MASQUERADE #SUS sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #CAREFULL + #DNS name resolution requests sent to outside servers and want a response: -sudo iptables -A INPUT -i enp0s10 -p udp --dport 53 -j ACCEPT +sudo iptables -A INPUT -i $externalIF -p udp --dport 53 -j ACCEPT + #SSH connections to the router system that originate from the inside and want an answer: -sudo iptables -A INPUT -i enp0s9 -p tcp --dport 22 -j ACCEPT -sudo iptables -A INPUT -i enp0s8 -s 23.214.219.133 -p tcp --dport 22 -j ACCEPT +sudo iptables -A INPUT -i $internalIF -p tcp --dport 22 -j ACCEPT +sudo iptables -A INPUT -i $dmzIF -s $vpn_gw -p tcp --dport 22 -j ACCEPT + #The dns server should be able to resolve names using the internet (and others???) sudo iptables -I FORWARD -j NFQUEUE --queue-bypass sudo iptables -I INPUT -j NFQUEUE --queue-bypass -sudo iptables -A FORWARD -i enp0s8 -o enp0s10 -s 23.214.219.130 -p udp --dport 53 -j ACCEPT +sudo iptables -A FORWARD -i $dmzIF -o $externalIF -s $dns -p udp --dport 53 -j ACCEPT + #The internal network should be able to send and recieve dns name resolutions to the dns server (1!) -sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.130 -p udp --dport 53 -j ACCEPT +sudo iptables -A FORWARD -i $internalIF -o $dmzIF -d $dns -p udp --dport 53 -j ACCEPT sudo iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT #THIS IS IMPORTANT AND MIGHT FUCK US + #The dns and dns2 servers should be able to synchronize the contents of DNS zones. (protocol tcp port 53) -sudo iptables -A FORWARD -i enp0s8 -o enp0s10 -s 23.214.219.130 -p tcp --dport 53 -j ACCEPT +sudo iptables -A FORWARD -i $dmzIF -o $externalIF -s $dns -p tcp --dport 53 -j ACCEPT + #SMTP connections to the smtp server and returns -sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.131 -p tcp --dport 587 -j ACCEPT -#sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -p tcp --dport 587 -m state --state ESTABLISHED,RELATED -j ACCEPT +sudo iptables -A FORWARD -i $internalIF -o $dmzIF -d $smtp -p tcp --dport 587 -j ACCEPT +#sudo iptables -A FORWARD -i $dmzIF -o $internalIF -p tcp --dport 587 -m state --state ESTABLISHED,RELATED -j ACCEPT + #POP and IMAP connections to the www server -sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.134 -p tcp --dport 143 -j ACCEPT -sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.134 -p tcp --dport 110 -j ACCEPT +sudo iptables -A FORWARD -i $internalIF -o $dmzIF -d $mail -p tcp --dport 143 -j ACCEPT +sudo iptables -A FORWARD -i $internalIF -o $dmzIF -d $mail -p tcp --dport 110 -j ACCEPT + #HTTP and HTTPS connectins -sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.132 -p tcp --dport 80 -j ACCEPT -sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.132 -p tcp --dport 443 -j ACCEPT +sudo iptables -A FORWARD -i $internalIF -o $dmzIF -d $www -p tcp --dport 80 -j ACCEPT +sudo iptables -A FORWARD -i $internalIF -o $dmzIF -d $www -p tcp --dport 443 -j ACCEPT + #OpenVPN connections to the vpn-gw server -sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.133 -p udp --dport 1194 -j ACCEPT -#sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -p udp --dport 1194 -j ACCEPT +sudo iptables -A FORWARD -i $internalIF -o $dmzIF -d $vpn_gw -p udp --dport 1194 -j ACCEPT +#sudo iptables -A FORWARD -i $dmzIF -o $internalIF -p udp --dport 1194 -j ACCEPT + #VPN clients connected to the gateway vpn-gw ???? vpn should be able to acess ftp e datastore -sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -s 23.214.219.133 -d 192.168.10.2 -j ACCEPT -sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -s 23.214.219.133 -d 192.168.10.3 -j ACCEPT +sudo iptables -A FORWARD -i $dmzIF -o $internalIF -s $vpn_gw -d $ftp -j ACCEPT +sudo iptables -A FORWARD -i $dmzIF -o $internalIF -s $vpn_gw -d $datastore -j ACCEPT + #FTP da internet WORRIED ??? -sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.2 -p tcp --dport 21 -j ACCEPT -sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --sport 20 -j ACCEPT #MIGHT BE NEEDED +sudo iptables -A FORWARD -i $externalIF -o $internalIF -d $ftp -p tcp --dport 21 -j ACCEPT +sudo iptables -A FORWARD -i $internalIF -o $externalIF -p tcp --sport 20 -j ACCEPT #MIGHT BE NEEDED + #SSH CONNECTIONS datastore server but only from eden or dn2 DNAT -s servers, and port and -d interface -sudo iptables -t nat -A PREROUTING -s $dns2 -p tcp --dport 22 -j DNAT --to-destination 192.168.10.3 -sudo iptables -t nat -A PREROUTING -s $eden -p tcp --dport 22 -j DNAT --to-destination 192.168.10.3 -sudo iptables -t nat -A PREROUTING -i enp0s10 -p tcp --dport 21 -j DNAT --to-destination 192.168.10.2 -sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.3 -s $dns2 -p tcp --dport 22 -j ACCEPT #Need to check and make diferent ip addresses -sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.3 -s $eden -p tcp --dport 22 -j ACCEPT -#enp0s9 to internet DNS, http, https, ssh, FTP(SERVERS??????(WHO INVITED THIS GUY)) SNAT -sudo iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o enp0s10 -j SNAT --to-source 87.248.214.97 -sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p udp --dport 53 -j ACCEPT -sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --dport 80 -j ACCEPT -sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --dport 443 -j ACCEPT -sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --sport 21 -j ACCEPT #MIGHT NOT BE ENOUGH -sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --dport 21 -j ACCEPT +sudo iptables -t nat -A PREROUTING -s $dns2 -p tcp --dport 22 -j DNAT --to-destination $datastore +sudo iptables -t nat -A PREROUTING -s $eden -p tcp --dport 22 -j DNAT --to-destination $datastore +sudo iptables -t nat -A PREROUTING -i $externalIF -p tcp --dport 21 -j DNAT --to-destination $ftp +sudo iptables -A FORWARD -i $externalIF -o $internalIF -d $datastore -s $dns2 -p tcp --dport 22 -j ACCEPT #Need to check and make diferent ip addresses +sudo iptables -A FORWARD -i $externalIF -o $internalIF -d $datastore -s $eden -p tcp --dport 22 -j ACCEPT + +#$internalIF to internet DNS, http, https, ssh, FTP(SERVERS??????(WHO INVITED THIS GUY)) SNAT +sudo iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o $externalIF -j SNAT --to-source $externalIP +sudo iptables -A FORWARD -i $internalIF -o $externalIF -p udp --dport 53 -j ACCEPT +sudo iptables -A FORWARD -i $internalIF -o $externalIF -p tcp --dport 80 -j ACCEPT +sudo iptables -A FORWARD -i $internalIF -o $externalIF -p tcp --dport 443 -j ACCEPT +sudo iptables -A FORWARD -i $internalIF -o $externalIF -p tcp --sport 21 -j ACCEPT #MIGHT NOT BE ENOUGH +sudo iptables -A FORWARD -i $internalIF -o $externalIF -p tcp --dport 21 -j ACCEPT