Super completo, com muito recursos (baseado no iptables), baseado em outros firewalls e com alguns pequenos ajustes, vale à pena conferir.

• Download my
• Enviar nova versão

Esconder código-fonte

#!/bin/bash
#################################################################
#****************************Ziper_linux************************#
#                                                               #
# Autor:      Ziper_linux  zip_linux@hotmail.com                #
#             se for alterar favor colocar meu nome como base   #
#                                                               #
# Agradecimentos:  MNB                                          #
#                  Ch3m0nZ                                      #
#                  www.vivaolinux.com.br                        #
#                                                               #
#################################################################

echo "Iniciando firewall:"

# variaveis
ENT="ppp0" # Edite esta variável de acordo com sua interface de conecção.
Pt='printf ==='

# carregando os modulos
modprobe ip_tables
modprobe iptable_nat

#Limpando regras e politicas.
iptables -F
iptables -X

$Pt
# Drop source routed packets
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route

# Seta entrada de pings e resposta à 1 por segundo, para evitar DoS.
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -m limit --limit 1/s -j RETURN

#Ativando syn cookies, proteção no kernel.
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
# Don't accept ICMP redirect messages
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
$Pt
# Don't send ICMP redirect messages
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects

# Enable source address spoofing protection
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter

# Protege contra os ataques do tipo "Syn-flood, DoS, etc"
iptables -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT
$Pt
# Protege contra port scanners avançados.
iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

# Proteção Contra IP Spoofing.
iptables -A INPUT -s 10.0.0.0/8 -i $ENT -j DROP
iptables -A INPUT -s 172.16.0.0/16 -i $ENT -j DROP
iptables -A INPUT -s 192.168.0.0/24 -i $ENT -j DROP

#Bloqueando Multicast
iptables -A INPUT -s 224.0.0.0/8 -d 0/0 -j DROP
iptables -A INPUT -s 0/0 -d 224.0.0.0/8 -j DROP

$Pt
# Protege contra todos os pacotes danificados e ou suspeitos.
iptables -A INPUT -m unclean -j DROP

# Bloqueando traceroute.
iptables -A INPUT -p udp -s 0/0 -i $ENT --dport 33435:33525 -j DROP

# Protecoes contra ataques diversos.
iptables -A INPUT -m state --state INVALID -j DROP

# Performance - Setando acesso a web com delay minimo(aumentando a prioridade para determinada porta)
iptables -t mangle -A OUTPUT -o $ENT -p tcp --dport 1863 -j TOS --set-tos Minimize-Delay
#papo no msn em "tempo real"
iptables -t mangle -A OUTPUT -o $ENT -p tcp --dport 80 -j TOS --set-tos Minimize-Delay
$Pt

# Proteção contra ssh brute force - criar um "rejeite-e-logue-SSH-brute-force"
iptables -N REJECT-SSSSH
iptables -A REJECT-SSSSH -j DROP -m recent --rcheck --name SSSSH --seconds 60 --hitcount 10
iptables -A REJECT-SSSSH -j LOG --log-prefix SSH-Bruteforce:
iptables -A REJECT-SSSSH -j REJECT -p tcp --reject-with tcp-reset
iptables -A REJECT-SSSSH -j REJECT


#Bloqueando acesso para o X Server.
iptables -A INPUT -p tcp -i $ENT --dport 5999:6003 -j DROP
iptables -A INPUT -p udp -i $ENT --dport 5999:6003 -j DROP
iptables -A INPUT -p tcp -i $ENT --dport 7100 -j DROP

#Bloqueando acesso a algumas portas frequentemente atacadas por hackers desinformados.
iptables -A INPUT -p tcp -i $ENT --dport 139 -j DROP
iptables -A INPUT -p udp -i $ENT --dport 139 -j DROP
iptables -A INPUT -p tcp -i $ENT --dport 135 -j DROP
iptables -A INPUT -p udp -i $ENT --dport 135 -j DROP

# Responde pacotes icmp especificados e rejeita o restante
iptables -A INPUT -i $ENT -p icmp --icmp-type host-unreachable -j ACCEPT
iptables -A INPUT -i $ENT -p icmp --icmp-type source-quench -j ACCEPT
iptables -A INPUT -i $ENT -p icmp -j REJECT --reject-with icmp-host-unreachable
$Pt

# libera o loopback.
iptables -I INPUT -i lo -j ACCEPT
iptables -I OUTPUT -o lo -j ACCEPT
iptables -I INPUT -i ! lo -s 127.0.0.0/255.0.0.0 -j DROP

#Barrando SSH (porta 4632)
#iptables -A INPUT -p TCP --dport 4632 -j DROP

#Barrando VNC
iptables -A INPUT -p TCP --dport 5901 -j DROP

#nessus
iptables -A INPUT -p tcp --destination-port 1241 -j ACCEPT

#Liberando socks
iptables -A OUTPUT -p tcp --sport 1024:5999 --dport 1080:1080 -m state --state NEW -j ACCEPT

#Liberando SSH (porta 4632)
iptables -A INPUT -p tcp --destination-port 4632 -j ACCEPT

#Abrindo interface lo
iptables -A INPUT -p tcp --syn -s 127.0.0.1/255.0.0.0 -j ACCEPT

#Liberando pacotes que realmente devem estabelecer conexão.
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

#Liberar Apache na porta 8080
iptables -A INPUT -p tcp --destination-port 8080 -j ACCEPT
#iptables -A FORWARD -j ACCEPT -p tcp --dport 8080

#Liberar acesso http (www)
iptables -A OUTPUT -p tcp --sport 1024:5999 --dport 80:80 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1024:5999 --dport 8080:8080 -m state --state NEW -j ACCEPT

#Liberando MSN
iptables -A OUTPUT -p tcp --sport 1024:5999 --dport 1863:1863 -m state --state NEW -j ACCEPT

#Liberando ping externo local p internet
#iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT

#Liberando conexão (P2P Gnutela)
#iptables -A OUTPUT -p tcp --sport 0:65535 --dport 6346:6346 -m state --state NEW -j ACCEPT

#Liberando conexão (P2P aMule)
iptables -A INPUT -p tcp --destination-port 4662 -j ACCEPT
iptables -A FORWARD -j ACCEPT -p tcp --dport 4672

#Liberando Azureus
#iptables -A INPUT -p tcp --destination-port 6881 -j ACCEPT
#iptables -A FORWARD -j ACCEPT -p tcp --dport 6881

echo ==
echo 'Firewall rodando!'

# good luck.

Cálculo de Horas

Verifica Falha Humana de Segurança em e-mail (usada por SPAMERS)

Backup de Repositórios Subversion

Backup via rede

Imspector - Manipular ACLS facilmente