Bonjour,
Pourriez-vous me donnez votre avis sur mon script pare-feux iptables ? Celui-ci est-il efficace ? Quelles nouvelles règles je pourraient ajouter ou modifier ?
Merci d’avance
iptables -F
echo - Réinitialisation… : [OK]iptables -X
echo - Flush : [OK]iptables -P INPUT DROP
echo - INPUT DROP : [OK]iptables -P OUTPUT DROP
echo - OUTPUT DROP : [OK]iptables -P FORWARD DROP
echo - FORWARD DROP : [OK]
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
echo : ACCEPT connexions établies INPUT : [OK]iptables -A OUTPUT -m state ! --state INVALID -j ACCEPT
echo : ACCEPT connexions établies OUTPUT : [OK]iptables -I INPUT -i lo -j ACCEPT
echo : ACCEPT boucle lo : [OK]
iptables -A INPUT -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
iptables -A INPUT -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
iptables -A INPUT -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
iptables -A INPUT -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
echo - Drop Various Attacks : [OK]
iptables -A INPUT -p all -s localhost -i wlan0 -j DROP
iptables -A INPUT -p all -s localhost -i eth0 -j DROP
echo - Prevent sources addres : [OK]
iptables -A INPUT -f -j DROP
echo - Drop Fragments : [OK]
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j DROP
echo - Drop Ping Packets : [OK]
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A FORWARD -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
echo - Drop Invalid Packets : [OK]
iptables -A INPUT -s 127.0.0.0/8 -j DROP
echo - Drop LAND Packets : [OK]
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
echo - Drop Null Packets : [OK]
iptables -A INPUT -p tcp -m tcp --tcp-flags RST RST -m limit --limit 2/second --limit-burst 2 -j ACCEPT
echo - Drop excessive RST Packets to avoid Smurf-Attacks : [OK]
iptables -A INPUT -p icmp -m icmp --icmp-type address-mask-request -j DROP
iptables -A INPUT -p icmp -m icmp --icmp-type timestamp-request -j DROP
iptables -A INPUT -p icmp -m limit --limit 2/second --limit-burst 2 -j ACCEPT
iptables -A INPUT -p icmp -j DROP
echo - Drop Smurf-Attacks : [OK]
iptables -A INPUT -s 224.0.0.0/4 -j DROP
iptables -A INPUT -d 224.0.0.0/4 -j DROP
iptables -A INPUT -s 240.0.0.0/5 -j DROP
iptables -A INPUT -d 240.0.0.0/5 -j DROP
iptables -A INPUT -s 0.0.0.0/8 -j DROP
iptables -A INPUT -d 0.0.0.0/8 -j DROP
iptables -A INPUT -d 239.255.255.0/24 -j DROP
iptables -A INPUT -d 255.255.255.255 -j DROP
echo - Drop Spank DoS Attacks : [OK]
iptables -A INPUT -p tcp -m state --state NEW -m limit --limit 2/second --limit-burst 2 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW -j DROP
echo - Drop SYN Flood Packets : [OK]
iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
echo - Drop XMAS Packets : [OK]
iptables -A INPUT -m recent --name portscan --rcheck --seconds 86400 -j DROP
iptables -A FORWARD -m recent --name portscan --rcheck --seconds 86400 -j DROP
iptables -A INPUT -m recent --name portscan --remove
iptables -A FORWARD -m recent --name portscan --remove
echo - Lock-out systems that attempted a port-scan lock lasts a day : [OK]
iptables -A INPUT -m recent --name portscan --set -j LOG --log-prefix "Portscan:"
iptables -A INPUT -m recent --name portscan --set -j DROP
iptables -A FORWARD -m recent --name portscan --set -j LOG --log-prefix "Portscan:"
iptables -A FORWARD -m recent --name portscan --set -j DROP
echo - Log Port-Scan Attempts : [OK]
iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
echo - Block Packets used by Port-Scans : [OK]
iptables -A logdrop -m limit --limit 5/m --limit-burst 10 -j LOG
echo - Log Burst Limit 5/10 : [OK]
iptables-save > ~/firewall.txt
echo - Save Rules to a File ~firewall.txt : [OK]
echo
echo “Config .firewall-olto” : [OK]
echo
echo "Setting Firewall [OK] - Appuyer sur pour continuer…"
read touche
case $touche in
*) echo “Reprise du script…”
;;
esac
echo
echo …
echo "Script Firewall by olto"
echo …
echo
exit 0