107 lines
4.9 KiB
Bash
107 lines
4.9 KiB
Bash
#!/bin/bash
|
|
|
|
dns2="87.248.214.99"
|
|
eden="87.248.214.100"
|
|
|
|
# Router 1
|
|
dmzIP="23.214.219.254"
|
|
internalIP="192.168.10.254"
|
|
externalIP="87.248.214.97"
|
|
|
|
# DMZ /25
|
|
dns="23.214.219.130"
|
|
smtp="23.214.219.131"
|
|
www="23.214.219.132"
|
|
vpn_gw="23.214.219.133"
|
|
mail="23.214.219.134"
|
|
|
|
# Internal
|
|
ftp="192.168.10.2"
|
|
datastore="192.168.10.3"
|
|
dhcpClient="192.168.10.4"
|
|
|
|
# Interfaces
|
|
dmzIF="enp0s8"
|
|
internalIF="enp0s9"
|
|
externalIF="enp0s10"
|
|
|
|
sudo ifconfig $dmzIF $dmzIP netmask 255.255.255.128
|
|
sudo ifconfig $internalIF $internalIP netmask 255.255.255.0
|
|
sudo ifconfig $externalIF $externalIP netmask 255.255.255.0
|
|
|
|
sudo yum install iptables-services -y
|
|
sudo systemctl stop firewalld
|
|
sudo systemctl disable firewalld
|
|
sudo systemctl mask firewalld
|
|
sudo systemctl enable iptables
|
|
sudo iptables -F
|
|
sudo iptables -t nat -F
|
|
sudo iptables -t mangle -F
|
|
sudo sysctl -w net.ipv4.ip_forward=1
|
|
iptables -P INPUT DROP
|
|
iptables -P FORWARD DROP
|
|
iptables -P OUTPUT ACCEPT
|
|
sudo iptables -A INPUT -i lo -j ACCEPT
|
|
sudo iptables -A OUTPUT -o lo -j ACCEPT
|
|
|
|
#sudo iptables -t nat -A POSTROUTING -i $internalIF -o enp0s3 -j MASQUERADE #SUS
|
|
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #CAREFULL
|
|
|
|
#DNS name resolution requests sent to outside servers and want a response:
|
|
sudo iptables -A INPUT -i $externalIF -p udp --dport 53 -j ACCEPT
|
|
|
|
#SSH connections to the router system that originate from the inside and want an answer:
|
|
sudo iptables -A INPUT -i $internalIF -p tcp --dport 22 -j ACCEPT
|
|
sudo iptables -A INPUT -i $dmzIF -s $vpn_gw -p tcp --dport 22 -j ACCEPT
|
|
|
|
#The dns server should be able to resolve names using the internet (and others???)
|
|
sudo iptables -I FORWARD -j NFQUEUE --queue-bypass
|
|
sudo iptables -I INPUT -j NFQUEUE --queue-bypass
|
|
sudo iptables -A FORWARD -i $dmzIF -o $externalIF -s $dns -p udp --dport 53 -j ACCEPT
|
|
|
|
#The internal network should be able to send and recieve dns name resolutions to the dns server (1!)
|
|
sudo iptables -A FORWARD -i $internalIF -o $dmzIF -d $dns -p udp --dport 53 -j ACCEPT
|
|
sudo iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT #THIS IS IMPORTANT AND MIGHT FUCK US
|
|
|
|
#The dns and dns2 servers should be able to synchronize the contents of DNS zones. (protocol tcp port 53)
|
|
sudo iptables -A FORWARD -i $dmzIF -o $externalIF -s $dns -p tcp --dport 53 -j ACCEPT
|
|
|
|
#SMTP connections to the smtp server and returns
|
|
sudo iptables -A FORWARD -i $internalIF -o $dmzIF -d $smtp -p tcp --dport 587 -j ACCEPT
|
|
#sudo iptables -A FORWARD -i $dmzIF -o $internalIF -p tcp --dport 587 -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
#POP and IMAP connections to the www server
|
|
sudo iptables -A FORWARD -i $internalIF -o $dmzIF -d $mail -p tcp --dport 143 -j ACCEPT
|
|
sudo iptables -A FORWARD -i $internalIF -o $dmzIF -d $mail -p tcp --dport 110 -j ACCEPT
|
|
|
|
#HTTP and HTTPS connectins
|
|
sudo iptables -A FORWARD -i $internalIF -o $dmzIF -d $www -p tcp --dport 80 -j ACCEPT
|
|
sudo iptables -A FORWARD -i $internalIF -o $dmzIF -d $www -p tcp --dport 443 -j ACCEPT
|
|
|
|
#OpenVPN connections to the vpn-gw server
|
|
sudo iptables -A FORWARD -i $internalIF -o $dmzIF -d $vpn_gw -p udp --dport 1194 -j ACCEPT
|
|
#sudo iptables -A FORWARD -i $dmzIF -o $internalIF -p udp --dport 1194 -j ACCEPT
|
|
|
|
#VPN clients connected to the gateway vpn-gw ???? vpn should be able to acess ftp e datastore
|
|
sudo iptables -A FORWARD -i $dmzIF -o $internalIF -s $vpn_gw -d $ftp -j ACCEPT
|
|
sudo iptables -A FORWARD -i $dmzIF -o $internalIF -s $vpn_gw -d $datastore -j ACCEPT
|
|
|
|
#FTP da internet WORRIED ???
|
|
sudo iptables -A FORWARD -i $externalIF -o $internalIF -d $ftp -p tcp --dport 21 -j ACCEPT
|
|
sudo iptables -A FORWARD -i $internalIF -o $externalIF -p tcp --sport 20 -j ACCEPT #MIGHT BE NEEDED
|
|
|
|
#SSH CONNECTIONS datastore server but only from eden or dn2 DNAT -s servers, and port and -d interface
|
|
sudo iptables -t nat -A PREROUTING -s $dns2 -p tcp --dport 22 -j DNAT --to-destination $datastore
|
|
sudo iptables -t nat -A PREROUTING -s $eden -p tcp --dport 22 -j DNAT --to-destination $datastore
|
|
sudo iptables -t nat -A PREROUTING -i $externalIF -p tcp --dport 21 -j DNAT --to-destination $ftp
|
|
sudo iptables -A FORWARD -i $externalIF -o $internalIF -d $datastore -s $dns2 -p tcp --dport 22 -j ACCEPT #Need to check and make diferent ip addresses
|
|
sudo iptables -A FORWARD -i $externalIF -o $internalIF -d $datastore -s $eden -p tcp --dport 22 -j ACCEPT
|
|
|
|
#$internalIF to internet DNS, http, https, ssh, FTP(SERVERS??????(WHO INVITED THIS GUY)) SNAT
|
|
sudo iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o $externalIF -j SNAT --to-source $externalIP
|
|
sudo iptables -A FORWARD -i $internalIF -o $externalIF -p udp --dport 53 -j ACCEPT
|
|
sudo iptables -A FORWARD -i $internalIF -o $externalIF -p tcp --dport 80 -j ACCEPT
|
|
sudo iptables -A FORWARD -i $internalIF -o $externalIF -p tcp --dport 443 -j ACCEPT
|
|
sudo iptables -A FORWARD -i $internalIF -o $externalIF -p tcp --sport 21 -j ACCEPT #MIGHT NOT BE ENOUGH
|
|
sudo iptables -A FORWARD -i $internalIF -o $externalIF -p tcp --dport 21 -j ACCEPT
|