#!/bin/bash
#
# Firewall rules for laptop. Only connections are allowed out when turned on.
# Based on file from http://www.pantz.org/os/linux/security/laptopiptables.shtml
# Paulo Vital - 20060911
# 

# Set some variables
IPTABLES="/sbin/iptables"

# Function to set the file to one or zero.
enable () { for file in $@; do echo 1 > $file; done }
disable () { for file in $@; do echo 0 > $file; done }
checkmodule () {
    SEARCH=$@
    NUMMODULE=`lsmod | awk '{ print $1 }' | grep $SEARCH | wc -l`
    if [ "$NUMMODULE" -eq "0" ]
    then
        echo "The module $SEARCH is not loaded."
        echo "Installing module $SEARCH..."
        /sbin/modprobe $SEARCH
        return
    else
        for MODULE in `lsmod | awk '{ print $1 }' | grep $SEARCH `
        do
            [ $MODULE ] && { echo "The module $MODULE is loaded."; }
        done
    fi
}

######################################################################
function start_firewall {
    echo "Firewall: enabling filtering"

    #Check if the iptables modules are installed and install if they arent
    checkmodule ip_tables
    checkmodule iptable_nat
           	
    #Use Selective ACK which can be used to signify that specific packets are missing.
    disable /proc/sys/net/ipv4/tcp_sack

    #If the kernel should attempt to forward packets. Off by default. Routers should enable.
    disable /proc/sys/net/ipv4/ip_forward

    #Protect against wrapping sequence numbers and in round trip time measurement.
    disable /proc/sys/net/ipv4/tcp_timestamps
			   
    #Help against syn-flood DoS or DDoS attacks using particular choices of initial TCP sequence numbers.
    enable /proc/sys/net/ipv4/tcp_syncookies

    # Enable broadcast echo protection.
    enable /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

    # Disable source routed packets.
    disable  /proc/sys/net/ipv4/conf/*/accept_source_route

    # Disable ICMP Redirect acceptance.
    disable /proc/sys/net/ipv4/conf/*/accept_redirects

    # Don't send Redirect messages.
    disable /proc/sys/net/ipv4/conf/*/send_redirects

    # Do not respond to packets that would cause us to go out
    # a different interface than the one to which we're responding.
    enable /proc/sys/net/ipv4/conf/*/rp_filter

    # Log packets with impossible addresses.
    enable /proc/sys/net/ipv4/conf/*/log_martians

    # Clear any previous rules.
    $IPTABLES -F
    $IPTABLES -F -t nat
    $IPTABLES -F -t mangle
													           
    # Default drop policy.
    $IPTABLES -P INPUT DROP
    $IPTABLES -P OUTPUT DROP
    $IPTABLES -P FORWARD DROP

    # Allow anything over loopback.
    $IPTABLES -A INPUT  -i lo -s 127.0.0.1 -j ACCEPT
    $IPTABLES -A OUTPUT -o lo -d 127.0.0.1 -j ACCEPT

    # Drop any tcp packet that does not start a connection with a syn flag.
    $IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

    # Drop any invalid packet that could not be identified.
    $IPTABLES -A INPUT -m state --state INVALID -j DROP

    # Drop invalid packets.
    $IPTABLES -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
    $IPTABLES -A INPUT -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN              -j DROP
    $IPTABLES -A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST              -j DROP
    $IPTABLES -A INPUT -p tcp -m tcp --tcp-flags FIN,RST FIN,RST              -j DROP
    $IPTABLES -A INPUT -p tcp -m tcp --tcp-flags ACK,FIN FIN                  -j DROP
    $IPTABLES -A INPUT -p tcp -m tcp --tcp-flags ACK,URG URG                  -j DROP

    # Reject broadcasts to 224.0.0.1
    $IPTABLES -A INPUT -d 224.0.0.0 -j REJECT

    # Allow TCP/UDP connections out. Keep state so conns out are allowed back in.
    $IPTABLES -A INPUT  -p tcp -m state --state ESTABLISHED     -j ACCEPT
    $IPTABLES -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
    $IPTABLES -A INPUT  -p udp -m state --state ESTABLISHED     -j ACCEPT
    $IPTABLES -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT

    # Allow ESP connections out. Keep state 
    $IPTABLES -A INPUT  -p udp -i eth0 --sport 500 --dport 500 -m state --state ESTABLISHED      -j ACCEPT
    $IPTABLES -A OUTPUT -p udp -o eth0 --sport 500 --dport 500 -m state --state NEW,ESTABLISHED  -j ACCEPT
    $IPTABLES -A INPUT  -p 50  -i eth0 -m state --state ESTABLISHED      -j ACCEPT
    $IPTABLES -A OUTPUT -p 50  -o eth0 -m state --state NEW,ESTABLISHED  -j ACCEPT

    # Allow ICMP out and anything that went out back in.
    $IPTABLES -A INPUT  -p icmp -m state --state ESTABLISHED      -j ACCEPT
    $IPTABLES -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED  -j ACCEPT

    # Allow only ICMP echo requests (ping) in. Limit rate in. Uncomment if needed.
    $IPTABLES -A INPUT  -p icmp -m state --state NEW,ESTABLISHED --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

    # Allow ssh connections in. Uncomment if needed.
    $IPTABLES -A INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -m state --state NEW -m limit --limit 1/s -j ACCEPT

    # Drop everything that did not match above and log it.
    $IPTABLES -A INPUT   -j LOG --log-level 4 --log-prefix "IPT_INPUT: "
    $IPTABLES -A INPUT   -j DROP
    $IPTABLES -A FORWARD -j LOG --log-level 4 --log-prefix "IPT_FORWARD: "
    $IPTABLES -A FORWARD -j DROP
    $IPTABLES -A OUTPUT  -j LOG --log-level 4 --log-prefix "IPT_OUTPUT: "
    $IPTABLES -A OUTPUT  -j DROP

}
######################################################################
function stop_firewall {
    # stop firewall
    echo "Firewall: disabling filtering (allowing all access)"
    $IPTABLES -F
    $IPTABLES -F -t nat
    $IPTABLES -F -t mangle
    $IPTABLES -P INPUT ACCEPT
    $IPTABLES -P OUTPUT ACCEPT
    $IPTABLES -P FORWARD ACCEPT
}
######################################################################
function stop_conn {
    # stop all external connections
    echo "Firewall: stopping all external connections"
    $IPTABLES -F INPUT
    $IPTABLES -F OUTPUT
    $IPTABLES -P INPUT DROP
    $IPTABLES -P FORWARD REJECT
    $IPTABLES -P OUTPUT REJECT

    # allow anything over loopback
    $IPTABLES -A INPUT -i lo -s 127.0.0.1 -j ACCEPT
    $IPTABLES -A OUTPUT -o lo -d 127.0.0.1 -j ACCEPT
}

case "$1" in
    start)
    	start_firewall
    ;;
    stop)
        stop_firewall
    ;;
    off)
	    stop_conn
    ;;
    *)
	echo "$0 {start|stop|off}"
	echo "Start: executes primary ruleset. Default is block all in and allow everything out."
	echo "Stop: disables all filtering"
	echo "Off: disables all non-loopback connections"
    ;;
esac