Forum: Skrypty w jednym miejscu ! ?

Kod Pobierz kod źródłowy


    # Limiting TCP session

      echo "30" > /proc/sys/net/ipv4/tcp_fin_timeout

      echo "2400" > /proc/sys/net/ipv4/tcp_keepalive_time

      echo "0" > /proc/sys/net/ipv4/tcp_window_scaling

      echo "0" > /proc/sys/net/ipv4/tcp_sack

      echo "20480" > /proc/sys/net/ipv4/ip_conntrack_max

      echo "20" > /proc/sys/net/ipv4/ipfrag_time

      echo "1280" > /proc/sys/net/ipv4/tcp_max_syn_backlog

      echo "43200" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_established 

      echo "60" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_close_wait



    # TCP timestamps protection

      echo "1" > /proc/sys/net/ipv4/tcp_timestamps



    # Ignore redirected packets   

      echo "0" > /proc/sys/net/ipv4/conf/all/send_redirects



    # Enabling packet forwarding

      echo "1" > /proc/sys/net/ipv4/ip_forward



    if [ "$NAT_ENABLE" == "MASQUERADE" ] then

      INTERNET_IP=`ifconfig $INTERNET_ETH | grep "inet addr:" | awk '{print $2}' | cut -d ":" -f 2`

    fi



    # Hate hosts blocking

     for i in $HATEHOSTS

      do

   iptables -A INPUT -s $i -j DROP

   iptables -A OUTPUT -d $i -j DROP

   iptables -A FORWARD -s $i -j DROP

      done



    # BOGON traffic filtering

     BOGON="0.0.0.0/7 2.0.0.0/8 5.0.0.0/8 10.0.0.0/8 14.0.0.0/8 23.0.0.0/8 27.0.0.0/8 31.0.0.0/8 36.0.0.0/7 39.0.0.0/8 \

     42.0.0.0/8 46.0.0.0/8 49.0.0.0/8 50.0.0.0/8 100.0.0.0/6 104.0.0.0/5 112.0.0.0/7 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 \

     173.0.0.0/8 174.0.0.0/7 176.0.0.0/5 184.0.0.0/7 192.0.2.0/24 192.168.0.0/16 197.0.0.0/8 198.18.0.0/15 223.0.0.0/8 224.0.0.0/3"



     for i in $BOGON

      do

   iptables -A INPUT -i $INTERNET_ETH -s $i -j DROP

   iptables -A OUTPUT -o $INTERNET_ETH -d $i -j DROP

   iptables -A FORWARD -i $INTERNET_ETH -s $i -j DROP

   iptables -A FORWARD -o $INTERNET_ETH -d $i -j DROP

      done



    # Viruses filtering

     HPORTS="135;tcp 137;udp 138;udp 139;udp 137;tcp 138;tcp 139;tcp 445;tcp"



     if [ "$HATEPORTS" == "yes" ] then

      for i in $HPORTS

      do

      PORT=`echo $i | cut -d'' -f1`

      PROTO=`echo $i | cut -d'' -f2`



   iptables -A FORWARD -i $INTERNET_ETH -p $PROTO --dport $PORT -j DROP

        iptables -A FORWARD -o $INTERNET_ETH -p $PROTO --dport $PORT -j DROP

      done

     fi



  

    # Block NEW ceonnections without syn flag

      iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

      iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP



    # Drop fragmented packets

      iptables -A INPUT -f -j DROP

      iptables -A FORWARD -f -j DROP



    # Drop connections in INVALID state

      iptables -A INPUT -m state --state INVALID -j DROP

      iptables -A FORWARD -m state --state INVALID -j DROP



    # Automatic MTU discovering

      iptables -A OUTPUT -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

      iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu