Autonomous System - IPSET
Blokujemy sieć Facebook lub inną firmę posiadającą Autonomous System
Szukanie numeru AS
ASN Lookup & Information
lub
host -t a facebook.com
whois 69.171.230.68 | grep OriginAS
OriginAS: AS32934
ipset -N facebook_nets nethash
for x in `whois -h whois.radb.net '!gAS32934' | grep "/"`; do ipset -A facebook_nets $x; done
iptables -I FORWARD -m set --match-set facebook_nets src -j DROP
Przykładowy pliczek
iptables="/sbin/iptables"
startme() {
echo "1" > /proc/sys/net/ipv4/ip_forward
face="enp1s0"
iptables --flush
iptables --flush -t nat
iptables --flush -t mangle
iptables --delete-chain
iptables --policy INPUT DROP
iptables --policy OUTPUT ACCEPT
iptables --policy FORWARD DROP
iptables --append INPUT --in-interface lo --jump ACCEPT
iptables -A INPUT -m conntrack --ctstate NEW -p tcp --tcp-flags SYN,RST,ACK,FIN,URG,PSH ACK -j LOG --log-prefix "ACK scan: "
iptables -A INPUT -m conntrack --ctstate NEW -p tcp --tcp-flags SYN,RST,ACK,FIN,URG,PSH ACK -j DROP
iptables -A INPUT -m conntrack --ctstate NEW -p tcp --tcp-flags SYN,RST,ACK,FIN,URG,PSH FIN -j LOG --log-prefix "FIN scan: "
iptables -A INPUT -m conntrack --ctstate NEW -p tcp --tcp-flags SYN,RST,ACK,FIN,URG,PSH FIN -j DROP
iptables -A INPUT -m conntrack --ctstate NEW -p tcp --tcp-flags SYN,RST,ACK,FIN,URG,PSH PSH -j LOG --log-prefix "Xmas scan: "
iptables -A INPUT -m conntrack --ctstate NEW -p tcp --tcp-flags SYN,RST,ACK,FIN,URG,PSH FIN,URG,PSH -j DROP
iptables -A INPUT -m conntrack --ctstate INVALID -p tcp ! --tcp-flags SYN,RST,ACK,FIN,PSH,URG SYN,RST,ACK,FIN,PSH,URG -j LOG --log-prefix "Null scan: "
iptables -A INPUT -m conntrack --ctstate INVALID -p tcp ! --tcp-flags SYN,RST,ACK,FIN,PSH,URG SYN,RST
iptables -N syn-flood
iptables -A INPUT -p tcp --syn -j syn-flood
iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j LOG --log-prefix "SYN-flood: "
iptables -A syn-flood -j DROP
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j LOG --log-prefix "Ping: "
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j REJECT --reject-with icmp-host-unreachable
iptables --append INPUT --match state --state ESTABLISHED --jump ACCEPT
iptables --append INPUT --match state --state RELATED --jump ACCEPT
iptables --append INPUT --in-interface $face --protocol tcp --destination-port 22 --source 85.128.131.1/32 --jump ACCEPT -m comment --comment "Nazwa RZ"
iptables --append INPUT --in-interface $face --protocol tcp --destination-port 22 --source 91.196.11.204/32 --jump ACCEPT -m comment --comment "Nazwa RZ"
iptables --append INPUT --in-interface $face --protocol tcp --destination-port 22 --source 46.174.28.72/32 --jump ACCEPT -m comment --comment "dom"
iptables --append INPUT --in-interface $face --protocol tcp --destination-port 22 --source 46.148.151.202/32 --jump ACCEPT -m comment --comment "test"
iptables --append INPUT --in-interface $face --protocol udp --destination-port 80 --source 0.0.0.0/0 --jump ACCEPT -m comment --comment "HAPROXY"
iptables --append INPUT --in-interface $face --protocol tcp --destination-port 443 --source 0.0.0.0/0 --jump ACCEPT -m comment --comment "HAPROXY"
ipset destroy PL_RESPL_nets
ipset destroy ERANET_nets
ipset -N PL_RESPL_nets nethash
for x in `whois -h whois.radb.net '!gAS42981' | grep "/"`; do ipset -A PL_RESPL_nets $x; done
iptables --append INPUT --in-interface $face --protocol tcp --destination-port 22 -m set --match-set PL_RESPL_nets src --jump ACCEPT -m comment --comment "PL_RESPL_NET"
ipset -N ERANET_nets nethash
for x in `whois -h whois.radb.net '!gAS12912' | grep "/"`; do ipset -A ERANET_nets $x; done
iptables --append INPUT --in-interface $face --protocol tcp --destination-port 22 -m set --match-set ERANET_nets src --jump ACCEPT -m comment --comment "ERANET_NET"
iptables --append INPUT --in-interface $face --jump DROP -m comment --comment "---- A tych to lizał pies ----"
echo ""
echo "#######################################"
echo "############## S T A R T ##############"
echo "#######################################"
echo ""
echo -e "\e[36mIPki RESPL \e[0m"
ipset list PL_RESPL_nets
echo ""
echo -e "\e[36mIPki ERANET/TMOBILE \e[0m"
ipset list ERANET_nets
echo -e "\e[32m"
$iptables -nvL
echo -e "\e[35m"
$iptables -nvL -t nat
echo -e "\e[0m"
echo " Zobacz czy nie ma takich komunikatów, jeśli są to gdzies jest pomyłka."
echo -e "\e[36m iptables v1.4.21: option --destination requires an argument \e[0m"
echo -e "\e[36m Try iptables -h or iptables --help for more information. \e[0m"
echo ""
echo -e "\e[31mFinito\e[0m"
sleep 3
}
stopme() {
$iptables --flush
$iptables --flush -t nat
$iptables --flush -t mangle
$iptables --delete-chain
$iptables --policy INPUT ACCEPT
$iptables --policy FORWARD ACCEPT
$iptables --policy OUTPUT ACCEPT
echo -e "\e[32mFitewall stop\e[0m"
echo -e "\e[31mFinito\e[0m"
}
status() {
echo -e "\e[36m"
$iptables -nvL
echo -e "\e[35m"
$iptables -nvL -t nat
echo -e "\e[0m"
echo ""
echo -e "\e[31mFinito\e[0m"
}
editme () {
vi /usr/local/sbin/firewall
}
case "$1" in
edit) editme ;;
start) startme ;;
stop) stopme ;;
status) status;;
restart) stopme; startme ;;
*) status; echo "usage: $0 edit|start|stop|restart|status" >&2
exit 1
;;
esac