ADG Soluções

#!/bin/bash
 
# Este script deve ser usado em Desktops apenas, não possui qualquer
# especialização para uso em servidores de segurança ou ambientes em produção
# oferece apenas o nível básico de proteção, para maiores informações consultar
# a documentação oficial do iptables e sites especializados em segurança
#
# Criado por Allan Garcia
# allan.garcia@gmail.com
# V 1.0
 
. /lib/lsb/init-functions
 
IPTABLES="/sbin/iptables"
IPTABLES_SAVE="/sbin/iptables-save"
IPTABLES_RESTORE="/sbin/iptables-restore"
IPTABLES_RULES="/etc/default/iptables"
SAVE_RESTORE_OPTIONS="-c"
 
fillbasicrules() {
${IPTABLES} -F
${IPTABLES} -X
${IPTABLES} -P INPUT DROP
${IPTABLES} -P FORWARD DROP
${IPTABLES} -P OUTPUT DROP
${IPTABLES} -N Ubuntu-Firewall-1-INPUT
${IPTABLES} -A INPUT -j Ubuntu-Firewall-1-INPUT
${IPTABLES} -A FORWARD -j Ubuntu-Firewall-1-INPUT
${IPTABLES} -A OUTPUT -j ACCEPT
${IPTABLES} -A Ubuntu-Firewall-1-INPUT -i lo -j ACCEPT
${IPTABLES} -A Ubuntu-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
${IPTABLES} -A Ubuntu-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
${IPTABLES} -A Ubuntu-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
}
 
checkrules() {
if [ ! -f ${IPTABLES_RULES} ]; then
echo -n "There is no rules configured, can I suggest some (y/n) [y]?"
read input
if [ -z $input ] || [ "$input" == "y" ] || [ "$input" == "yes" ] || [ "$input" == "Y" ] || [ "$input" == "YES" ]; then
fillbasicrules
save
else
echo "Not starting iptables. First create some rules then run"
echo "\"/etc/init.d/iptables save\""
return 1
fi
fi
}
 
save() {
${IPTABLES_SAVE} ${SAVE_RESTORE_OPTIONS} > ${IPTABLES_RULES}
return $?
}
 
start() {
checkrules || return 1
${IPTABLES_RESTORE} ${SAVE_RESTORE_OPTIONS} < ${IPTABLES_RULES}
return $?
}
 
stop() {
for table in `cat /proc/net/ip_tables_names`; do
${IPTABLES} -F -t $table
${IPTABLES} -X -t $table
if [ $table == nat ]; then
${IPTABLES} -t $table -P PREROUTING ACCEPT
${IPTABLES} -t $table -P POSTROUTING ACCEPT
${IPTABLES} -t $table -P OUTPUT ACCEPT
elif [ $table == mangle ]; then
${IPTABLES} -t $table -P PREROUTING ACCEPT
${IPTABLES} -t $table -P INPUT ACCEPT
${IPTABLES} -t $table -P FORWARD ACCEPT
${IPTABLES} -t $table -P OUTPUT ACCEPT
${IPTABLES} -t $table -P POSTROUTING ACCEPT
elif [ $table == filter ]; then
${IPTABLES} -t $table -P INPUT ACCEPT
${IPTABLES} -t $table -P FORWARD ACCEPT
${IPTABLES} -t $table -P OUTPUT ACCEPT
fi
done
}
 
restart() {
for table in `cat /proc/net/ip_tables_names`; do
${IPTABLES} -F -t $table
${IPTABLES} -X -t $table
done
start
}
 
case "$1" in
save)
echo -n "Saving iptables state..."
save
if [ $? -eq 0 ]; then
echo " ok"
else
echo " error!"
fi
;;
 
start)
log_begin_msg "Loading iptables state and starting firewall..."
start
log_end_msg $?
;;
 
stop)
log_begin_msg "Stopping firewall..."
stop
log_end_msg 0
;;
 
restart)
log_begin_msg "Stopping firewall..."
restart
log_end_msg $?
;;
 
*)
echo "Usage: /etc/init.d/iptables {start|stop|restart|save}" >&2
exit 1
;;
 
esac
 
exit 0