235 lines
6.2 KiB
Bash
235 lines
6.2 KiB
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
echo "[+] Installing dependencies..."
|
|
apt update
|
|
apt install -y iptables ipset curl jq dnsutils xtables-addons-common logger
|
|
|
|
echo "[+] Loading config..."
|
|
source /etc/firewall.conf
|
|
|
|
############################################
|
|
# IPSets
|
|
############################################
|
|
echo "[+] Creating ipsets..."
|
|
|
|
ipset create blacklist hash:ip timeout 10800 -exist
|
|
ipset create blocklist hash:ip timeout 86400 -exist
|
|
ipset create geo_block hash:ip timeout 86400 -exist
|
|
ipset create asn_block hash:ip timeout 86400 -exist
|
|
ipset create whitelist hash:ip timeout 10800 -exist
|
|
|
|
for IP in $WHITELIST_IPS; do
|
|
ipset add whitelist $IP -exist
|
|
done
|
|
|
|
############################################
|
|
# IPTABLES BASE
|
|
############################################
|
|
echo "[+] Writing iptables rules..."
|
|
|
|
cat > /etc/iptables/rules.v4 <<EOF
|
|
*filter
|
|
:INPUT DROP [0:0]
|
|
:FORWARD DROP [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
|
|
:BRUTEFORCE - [0:0]
|
|
|
|
# -------------------------
|
|
# HOST INPUT
|
|
# -------------------------
|
|
|
|
# Whitelist first
|
|
-A INPUT -m set --match-set whitelist src -j ACCEPT
|
|
|
|
# Blocked sources (HOST)
|
|
-A INPUT -m set --match-set blacklist src -j LOG --log-prefix "FW-HOST-BLACKLIST " --log-level 4
|
|
-A INPUT -m set --match-set blacklist src -j DROP
|
|
|
|
-A INPUT -m set --match-set blocklist src -j LOG --log-prefix "FW-HOST-BLOCKLIST " --log-level 4
|
|
-A INPUT -m set --match-set blocklist src -j DROP
|
|
|
|
-A INPUT -m set --match-set geo_block src -j LOG --log-prefix "FW-HOST-GEO " --log-level 4
|
|
-A INPUT -m set --match-set geo_block src -j DROP
|
|
|
|
-A INPUT -m set --match-set asn_block src -j LOG --log-prefix "FW-HOST-ASN " --log-level 4
|
|
-A INPUT -m set --match-set asn_block src -j DROP
|
|
|
|
# Established
|
|
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
|
|
# Loopback
|
|
-A INPUT -i lo -j ACCEPT
|
|
|
|
# ICMP
|
|
-A INPUT -p icmp -j ACCEPT
|
|
|
|
# SSH Bruteforce
|
|
-A INPUT -p tcp --dport ${SSH_PORT} -m conntrack --ctstate NEW -j BRUTEFORCE
|
|
|
|
-A BRUTEFORCE -m recent --name SSH --update --seconds 5 --hitcount 5 \
|
|
-j SET --add-set blacklist src
|
|
|
|
-A BRUTEFORCE -m recent --name SSH --set -j RETURN
|
|
|
|
-A INPUT -p tcp --dport ${SSH_PORT} -j ACCEPT
|
|
|
|
# -------------------------
|
|
# DOCKER ENTRY
|
|
# -------------------------
|
|
-A FORWARD -j DOCKER-USER
|
|
|
|
# Default logging
|
|
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "FW-HOST-OTHER " --log-level 4
|
|
|
|
COMMIT
|
|
EOF
|
|
|
|
iptables-restore < /etc/iptables/rules.v4
|
|
|
|
############################################
|
|
# DOCKER USER CHAIN
|
|
############################################
|
|
echo "[+] Configuring DOCKER-USER..."
|
|
|
|
iptables -N DOCKER-USER 2>/dev/null || true
|
|
iptables -F DOCKER-USER
|
|
|
|
# Established first
|
|
iptables -A DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN
|
|
|
|
# Whitelist
|
|
iptables -A DOCKER-USER -m set --match-set whitelist src -j RETURN
|
|
|
|
# Logging + drops (Docker context)
|
|
iptables -A DOCKER-USER -m set --match-set blacklist src \
|
|
-j LOG --log-prefix "FW-DOCKER-BLACKLIST " --log-level 4
|
|
iptables -A DOCKER-USER -m set --match-set blacklist src -j DROP
|
|
|
|
iptables -A DOCKER-USER -m set --match-set blocklist src \
|
|
-j LOG --log-prefix "FW-DOCKER-BLOCKLIST " --log-level 4
|
|
iptables -A DOCKER-USER -m set --match-set blocklist src -j DROP
|
|
|
|
iptables -A DOCKER-USER -m set --match-set geo_block src \
|
|
-j LOG --log-prefix "FW-DOCKER-GEO " --log-level 4
|
|
iptables -A DOCKER-USER -m set --match-set geo_block src -j DROP
|
|
|
|
iptables -A DOCKER-USER -m set --match-set asn_block src \
|
|
-j LOG --log-prefix "FW-DOCKER-ASN " --log-level 4
|
|
iptables -A DOCKER-USER -m set --match-set asn_block src -j DROP
|
|
|
|
# Return to Docker
|
|
iptables -A DOCKER-USER -j RETURN
|
|
|
|
############################################
|
|
# BLOCKLIST.DE
|
|
############################################
|
|
cat > /usr/local/bin/update-blocklist.sh <<'EOF'
|
|
#!/bin/bash
|
|
curl -s http://blocklist.de/downloads/export-ips_all.txt \
|
|
| grep -v ":" \
|
|
| while read IP; do
|
|
ipset add blocklist $IP timeout 86400 -exist
|
|
done
|
|
EOF
|
|
chmod +x /usr/local/bin/update-blocklist.sh
|
|
|
|
############################################
|
|
# GEOIP
|
|
############################################
|
|
cat > /usr/local/bin/update-geoip.sh <<'EOF'
|
|
#!/bin/bash
|
|
source /etc/firewall.conf
|
|
TMP=$(mktemp)
|
|
|
|
for CC in $GEOIP_BLOCK; do
|
|
curl -s https://www.ipdeny.com/ipblocks/data/countries/${CC}.zone >> $TMP
|
|
done
|
|
|
|
while read IP; do
|
|
ipset add geo_block $IP timeout 86400 -exist
|
|
done < $TMP
|
|
|
|
rm $TMP
|
|
EOF
|
|
chmod +x /usr/local/bin/update-geoip.sh
|
|
|
|
############################################
|
|
# ASN
|
|
############################################
|
|
cat > /usr/local/bin/update-asn.sh <<'EOF'
|
|
#!/bin/bash
|
|
source /etc/firewall.conf
|
|
TMP=$(mktemp)
|
|
|
|
for ASN in $ASN_BLOCK; do
|
|
curl -s https://api.bgpview.io/asn/${ASN#AS}/prefixes \
|
|
| jq -r '.data.ipv4_prefixes[].prefix' >> $TMP
|
|
done
|
|
|
|
while read IP; do
|
|
ipset add asn_block $IP timeout 86400 -exist
|
|
done < $TMP
|
|
|
|
rm $TMP
|
|
EOF
|
|
chmod +x /usr/local/bin/update-asn.sh
|
|
|
|
############################################
|
|
# DNS WHITELIST (3h)
|
|
############################################
|
|
cat > /usr/local/bin/update-whitelist.sh <<'EOF'
|
|
#!/bin/bash
|
|
source /etc/firewall.conf
|
|
|
|
for HOST in $WHITELIST_HOSTS; do
|
|
IPS=$(dig +short $HOST | grep -E '^[0-9.]+$')
|
|
for IP in $IPS; do
|
|
ipset add whitelist $IP timeout 10800 -exist
|
|
done
|
|
done
|
|
EOF
|
|
chmod +x /usr/local/bin/update-whitelist.sh
|
|
|
|
############################################
|
|
# CRON
|
|
############################################
|
|
cat > /etc/cron.d/firewall <<EOF
|
|
0 */3 * * * root /usr/local/bin/update-whitelist.sh
|
|
10 * * * * root /usr/local/bin/update-blocklist.sh
|
|
30 * * * * root /usr/local/bin/update-geoip.sh
|
|
45 * * * * root /usr/local/bin/update-asn.sh
|
|
EOF
|
|
|
|
############################################
|
|
# IPSET PERSISTENCE
|
|
############################################
|
|
cat > /etc/systemd/system/ipset-restore.service <<EOF
|
|
[Unit]
|
|
Description=Restore ipset
|
|
Before=iptables.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/sbin/ipset restore < /etc/ipset.conf
|
|
ExecStop=/sbin/ipset save > /etc/ipset.conf
|
|
RemainAfterExit=yes
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
systemctl daemon-reexec
|
|
systemctl enable ipset-restore
|
|
|
|
############################################
|
|
# INITIAL RUN
|
|
############################################
|
|
echo "[+] Initial updates..."
|
|
/usr/local/bin/update-blocklist.sh
|
|
/usr/local/bin/update-geoip.sh
|
|
/usr/local/bin/update-asn.sh
|
|
/usr/local/bin/update-whitelist.sh
|
|
|
|
echo "[+] DONE" |