1. Advertising
    y u no do it?

    Advertising (learn more)

    Advertise virtually anything here, with CPM banner ads, CPM email ads and CPC contextual links. You can target relevant areas of the site and show ads based on geographical location of the user if you wish.

    Starts at just $1 per CPM or $0.10 per CPC.

DDoS Protection Script For iptables

Discussion in 'Security' started by abuzant, Sep 18, 2008.

  1. #1
    Hello,

    After a few days of being attacked by a 25,000 zombie botnet, believe me i have tried almost everything possible to make it stop. The best thing that helped was this script, thought it could help here when it's your turn getting those script-kiddies attackers visiting your servers.

    Code (Text):
    1.  
    2. #!/bin/sh
    3. #------------------------------------------------------------------------------
    4. #
    5. # File: SIG-antiDDoS.sh
    6. #
    7. # Compiler: Ruslan Abuzant <ruslan@abuzant.com>
    8. #           PS> Collected From Lots Of Sources
    9. #           PS> Credits: Real Authors (no idea)
    10. #
    11. # URL: http://www.liteforex.org/
    12. #
    13. # License: GNU GPL (version 2, or any later version).
    14. #
    15. # Configuration.
    16. #------------------------------------------------------------------------------
    17.  
    18. # For debugging use iptables -v.
    19. IPTABLES="/sbin/iptables"
    20. IP6TABLES="/sbin/ip6tables"
    21. MODPROBE="/sbin/modprobe"
    22. RMMOD="/sbin/rmmod"
    23. ARP="/usr/sbin/arp"
    24.  
    25.  
    26. # Logging options.
    27. #------------------------------------------------------------------------------
    28. LOG="LOG --log-level debug --log-tcp-sequence --log-tcp-options"
    29. LOG="$LOG --log-ip-options"
    30.  
    31.  
    32. # Defaults for rate limiting
    33. #------------------------------------------------------------------------------
    34. RLIMIT="-m limit --limit 3/s --limit-burst 8"
    35.  
    36.  
    37. # Unprivileged ports.
    38. #------------------------------------------------------------------------------
    39. PHIGH="1024:65535"
    40. PSSH="1000:1023"
    41.  
    42.  
    43. # Load required kernel modules
    44. #------------------------------------------------------------------------------
    45. $MODPROBE ip_conntrack_ftp
    46. $MODPROBE ip_conntrack_irc
    47.  
    48.  
    49. # Mitigate ARP spoofing/poisoning and similar attacks.
    50. #------------------------------------------------------------------------------
    51. # Hardcode static ARP cache entries here
    52. # $ARP -s IP-ADDRESS MAC-ADDRESS
    53.  
    54.  
    55. # Kernel configuration.
    56. #------------------------------------------------------------------------------
    57.  
    58. # Disable IP forwarding.
    59. # On => Off = (reset)
    60. echo 1 > /proc/sys/net/ipv4/ip_forward
    61. echo 0 > /proc/sys/net/ipv4/ip_forward
    62.  
    63. # Enable IP spoofing protection
    64. for i in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $i; done
    65.  
    66. # Protect against SYN flood attacks
    67. echo 1 > /proc/sys/net/ipv4/tcp_syncookies
    68.  
    69. # Ignore all incoming ICMP echo requests
    70. echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
    71.  
    72. # Ignore ICMP echo requests to broadcast
    73. echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
    74.  
    75. # Log packets with impossible addresses.
    76. for i in /proc/sys/net/ipv4/conf/*/log_martians; do echo 1 > $i; done
    77.  
    78. # Don't log invalid responses to broadcast
    79. echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
    80.  
    81. # Don't accept or send ICMP redirects.
    82. for i in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo 0 > $i; done
    83. for i in /proc/sys/net/ipv4/conf/*/send_redirects; do echo 0 > $i; done
    84.  
    85. # Don't accept source routed packets.
    86. for i in /proc/sys/net/ipv4/conf/*/accept_source_route; do echo 0 > $i; done
    87.  
    88. # Disable multicast routing
    89. for i in /proc/sys/net/ipv4/conf/*/mc_forwarding; do echo 0 > $i; done
    90.  
    91. # Disable proxy_arp.
    92. for i in /proc/sys/net/ipv4/conf/*/proxy_arp; do echo 0 > $i; done
    93.  
    94. # Enable secure redirects, i.e. only accept ICMP redirects for gateways
    95. # Helps against MITM attacks.
    96. for i in /proc/sys/net/ipv4/conf/*/secure_redirects; do echo 1 > $i; done
    97.  
    98. # Disable bootp_relay
    99. for i in /proc/sys/net/ipv4/conf/*/bootp_relay; do echo 0 > $i; done
    100.  
    101. # Default policies.
    102. #------------------------------------------------------------------------------
    103.  
    104. # Drop everything by default.
    105. $IPTABLES -P INPUT DROP
    106. $IPTABLES -P FORWARD DROP
    107. $IPTABLES -P OUTPUT DROP
    108.  
    109. # Set the nat/mangle/raw tables' chains to ACCEPT
    110. $IPTABLES -t nat -P PREROUTING ACCEPT
    111. $IPTABLES -t nat -P OUTPUT ACCEPT
    112. $IPTABLES -t nat -P POSTROUTING ACCEPT
    113.  
    114. $IPTABLES -t mangle -P PREROUTING ACCEPT
    115. $IPTABLES -t mangle -P INPUT ACCEPT
    116. $IPTABLES -t mangle -P FORWARD ACCEPT
    117. $IPTABLES -t mangle -P OUTPUT ACCEPT
    118. $IPTABLES -t mangle -P POSTROUTING ACCEPT
    119.  
    120. # Cleanup.
    121. #------------------------------------------------------------------------------
    122.  
    123. # Delete all
    124. $IPTABLES -F
    125. $IPTABLES -t nat -F
    126. $IPTABLES -t mangle -F
    127.  
    128. # Delete all
    129. $IPTABLES -X
    130. $IPTABLES -t nat -X
    131. $IPTABLES -t mangle -X
    132.  
    133. # Zero all packets and counters.
    134. $IPTABLES -Z
    135. $IPTABLES -t nat -Z
    136. $IPTABLES -t mangle -Z
    137.  
    138. # Completely disable IPv6.
    139. #------------------------------------------------------------------------------
    140.  
    141. # Block all IPv6 traffic
    142. # If the ip6tables command is available, try to block all IPv6 traffic.
    143. if test -x $IP6TABLES; then
    144. # Set the default policies
    145. # drop everything
    146. $IP6TABLES -P INPUT DROP 2>/dev/null
    147. $IP6TABLES -P FORWARD DROP 2>/dev/null
    148. $IP6TABLES -P OUTPUT DROP 2>/dev/null
    149.  
    150. # The mangle table can pass everything
    151. $IP6TABLES -t mangle -P PREROUTING ACCEPT 2>/dev/null
    152. $IP6TABLES -t mangle -P INPUT ACCEPT 2>/dev/null
    153. $IP6TABLES -t mangle -P FORWARD ACCEPT 2>/dev/null
    154. $IP6TABLES -t mangle -P OUTPUT ACCEPT 2>/dev/null
    155. $IP6TABLES -t mangle -P POSTROUTING ACCEPT 2>/dev/null
    156.  
    157. # Delete all rules.
    158. $IP6TABLES -F 2>/dev/null
    159. $IP6TABLES -t mangle -F 2>/dev/null
    160.  
    161. # Delete all chains.
    162. $IP6TABLES -X 2>/dev/null
    163. $IP6TABLES -t mangle -X 2>/dev/null
    164.  
    165. # Zero all packets and counters.
    166. $IP6TABLES -Z 2>/dev/null
    167. $IP6TABLES -t mangle -Z 2>/dev/null
    168. fi
    169.  
    170. # Custom user-defined chains.
    171. #------------------------------------------------------------------------------
    172.  
    173. # LOG packets, then ACCEPT.
    174. $IPTABLES -N ACCEPTLOG
    175. $IPTABLES -A ACCEPTLOG -j $LOG $RLIMIT --log-prefix "ACCEPT "
    176. $IPTABLES -A ACCEPTLOG -j ACCEPT
    177.  
    178. # LOG packets, then DROP.
    179. $IPTABLES -N DROPLOG
    180. $IPTABLES -A DROPLOG -j $LOG $RLIMIT --log-prefix "DROP "
    181. $IPTABLES -A DROPLOG -j DROP
    182.  
    183. # LOG packets, then REJECT.
    184. # TCP packets are rejected with a TCP reset.
    185. $IPTABLES -N REJECTLOG
    186. $IPTABLES -A REJECTLOG -j $LOG $RLIMIT --log-prefix "REJECT "
    187. $IPTABLES -A REJECTLOG -p tcp -j REJECT --reject-with tcp-reset
    188. $IPTABLES -A REJECTLOG -j REJECT
    189.  
    190. # Only allows RELATED ICMP types
    191. # (destination-unreachable, time-exceeded, and parameter-problem).
    192. # TODO: Rate-limit this traffic?
    193. # TODO: Allow fragmentation-needed?
    194. # TODO: Test.
    195. $IPTABLES -N RELATED_ICMP
    196. $IPTABLES -A RELATED_ICMP -p icmp --icmp-type destination-unreachable -j ACCEPT
    197. $IPTABLES -A RELATED_ICMP -p icmp --icmp-type time-exceeded -j ACCEPT
    198. $IPTABLES -A RELATED_ICMP -p icmp --icmp-type parameter-problem -j ACCEPT
    199. $IPTABLES -A RELATED_ICMP -j DROPLOG
    200.  
    201. # Make It Even Harder To Multi-PING
    202. $IPTABLES  -A INPUT -p icmp -m limit --limit 1/s --limit-burst 2 -j ACCEPT
    203. $IPTABLES  -A INPUT -p icmp -m limit --limit 1/s --limit-burst 2 -j LOG --log-prefix PING-DROP:
    204. $IPTABLES  -A INPUT -p icmp -j DROP
    205. $IPTABLES  -A OUTPUT -p icmp -j ACCEPT
    206.  
    207. # Only allow the minimally required/recommended parts of ICMP. Block the rest.
    208. #------------------------------------------------------------------------------
    209.  
    210. # TODO: This section needs a lot of testing!
    211.  
    212. # First, drop all fragmented ICMP packets (almost always malicious).
    213. $IPTABLES -A INPUT -p icmp --fragment -j DROPLOG
    214. $IPTABLES -A OUTPUT -p icmp --fragment -j DROPLOG
    215. $IPTABLES -A FORWARD -p icmp --fragment -j DROPLOG
    216.  
    217. # Allow all ESTABLISHED ICMP traffic.
    218. $IPTABLES -A INPUT -p icmp -m state --state ESTABLISHED -j ACCEPT $RLIMIT
    219. $IPTABLES -A OUTPUT -p icmp -m state --state ESTABLISHED -j ACCEPT $RLIMIT
    220.  
    221. # Allow some parts of the RELATED ICMP traffic, block the rest.
    222. $IPTABLES -A INPUT -p icmp -m state --state RELATED -j RELATED_ICMP $RLIMIT
    223. $IPTABLES -A OUTPUT -p icmp -m state --state RELATED -j RELATED_ICMP $RLIMIT
    224.  
    225. # Allow incoming ICMP echo requests (ping), but only rate-limited.
    226. $IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT $RLIMIT
    227.  
    228. # Allow outgoing ICMP echo requests (ping), but only rate-limited.
    229. $IPTABLES -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT $RLIMIT
    230.  
    231. # Drop any other ICMP traffic.
    232. $IPTABLES -A INPUT -p icmp -j DROPLOG
    233. $IPTABLES -A OUTPUT -p icmp -j DROPLOG
    234. $IPTABLES -A FORWARD -p icmp -j DROPLOG
    235.  
    236. # Selectively allow certain special types of traffic.
    237. #------------------------------------------------------------------------------
    238.  
    239. # Allow loopback interface to do anything.
    240. $IPTABLES -A INPUT -i lo -j ACCEPT
    241. $IPTABLES -A OUTPUT -o lo -j ACCEPT
    242.  
    243. # Allow incoming connections related to existing allowed connections.
    244. $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    245.  
    246. # Allow outgoing connections EXCEPT invalid
    247. $IPTABLES -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
    248.  
    249. # Miscellaneous.
    250. #------------------------------------------------------------------------------
    251.  
    252. # We don't care about Milkosoft, Drop SMB/CIFS/etc..
    253. $IPTABLES -A INPUT -p tcp -m multiport --dports 135,137,138,139,445,1433,1434 -j DROP
    254. $IPTABLES -A INPUT -p udp -m multiport --dports 135,137,138,139,445,1433,1434 -j DROP
    255.  
    256. # Explicitly drop invalid incoming traffic
    257. $IPTABLES -A INPUT -m state --state INVALID -j DROP
    258.  
    259. # Drop invalid outgoing traffic, too.
    260. $IPTABLES -A OUTPUT -m state --state INVALID -j DROP
    261.  
    262. # If we would use NAT, INVALID packets would pass - BLOCK them anyways
    263. $IPTABLES -A FORWARD -m state --state INVALID -j DROP
    264.  
    265. # PORT Scanners (stealth also)
    266. $IPTABLES -A INPUT -m state --state NEW -p tcp --tcp-flags ALL ALL -j DROP
    267. $IPTABLES -A INPUT -m state --state NEW -p tcp --tcp-flags ALL NONE -j DROP
    268.  
    269. # TODO: Some more anti-spoofing rules? For example:
    270. # $IPTABLES -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
    271. # $IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
    272. # $IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
    273. $IPTABLES -N SYN_FLOOD
    274. $IPTABLES -A INPUT -p tcp --syn -j SYN_FLOOD
    275. $IPTABLES -A SYN_FLOOD -m limit --limit 2/s --limit-burst 6 -j RETURN
    276. $IPTABLES -A SYN_FLOOD -j DROP
    277.  
    278. # TODO: Block known-bad IPs (see http://www.dshield.org/top10.php).
    279. # $IPTABLES -A INPUT -s INSERT-BAD-IP-HERE -j DROPLOG
    280.  
    281. # Drop any traffic from IANA-reserved IPs.
    282. #------------------------------------------------------------------------------
    283.  
    284. $IPTABLES -A INPUT -s 0.0.0.0/7 -j DROP
    285. $IPTABLES -A INPUT -s 2.0.0.0/8 -j DROP
    286. $IPTABLES -A INPUT -s 5.0.0.0/8 -j DROP
    287. $IPTABLES -A INPUT -s 7.0.0.0/8 -j DROP
    288. $IPTABLES -A INPUT -s 10.0.0.0/8 -j DROP
    289. $IPTABLES -A INPUT -s 23.0.0.0/8 -j DROP
    290. $IPTABLES -A INPUT -s 27.0.0.0/8 -j DROP
    291. $IPTABLES -A INPUT -s 31.0.0.0/8 -j DROP
    292. $IPTABLES -A INPUT -s 36.0.0.0/7 -j DROP
    293. $IPTABLES -A INPUT -s 39.0.0.0/8 -j DROP
    294. $IPTABLES -A INPUT -s 42.0.0.0/8 -j DROP
    295. $IPTABLES -A INPUT -s 49.0.0.0/8 -j DROP
    296. $IPTABLES -A INPUT -s 50.0.0.0/8 -j DROP
    297. $IPTABLES -A INPUT -s 77.0.0.0/8 -j DROP
    298. $IPTABLES -A INPUT -s 78.0.0.0/7 -j DROP
    299. $IPTABLES -A INPUT -s 92.0.0.0/6 -j DROP
    300. $IPTABLES -A INPUT -s 96.0.0.0/4 -j DROP
    301. $IPTABLES -A INPUT -s 112.0.0.0/5 -j DROP
    302. $IPTABLES -A INPUT -s 120.0.0.0/8 -j DROP
    303. $IPTABLES -A INPUT -s 169.254.0.0/16 -j DROP
    304. $IPTABLES -A INPUT -s 172.16.0.0/12 -j DROP
    305. $IPTABLES -A INPUT -s 173.0.0.0/8 -j DROP
    306. $IPTABLES -A INPUT -s 174.0.0.0/7 -j DROP
    307. $IPTABLES -A INPUT -s 176.0.0.0/5 -j DROP
    308. $IPTABLES -A INPUT -s 184.0.0.0/6 -j DROP
    309. $IPTABLES -A INPUT -s 192.0.2.0/24 -j DROP
    310. $IPTABLES -A INPUT -s 197.0.0.0/8 -j DROP
    311. $IPTABLES -A INPUT -s 198.18.0.0/15 -j DROP
    312. $IPTABLES -A INPUT -s 223.0.0.0/8 -j DROP
    313. $IPTABLES -A INPUT -s 224.0.0.0/3 -j DROP
    314.  
    315. # Selectively allow certain outbound connections, block the rest.
    316. #------------------------------------------------------------------------------
    317.  
    318. # Allow outgoing DNS requests. Few things will work without this.
    319. $IPTABLES -A OUTPUT -m state --state NEW -p udp --dport 53 -j ACCEPT
    320. $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT
    321.  
    322. # Allow outgoing HTTP requests. Unencrypted, use with care.
    323. $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT
    324.  
    325. # Allow outgoing HTTPS requests.
    326. $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT
    327.  
    328. # Allow outgoing SMTPS requests. Do NOT allow unencrypted SMTP!
    329. # $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 465 -j ACCEPT
    330.  
    331. # Allow outgoing "submission" (RFC 2476) requests.
    332. $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 587 -j ACCEPT
    333.  
    334. # Allow outgoing POP3S requests.
    335. $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 995 -j ACCEPT
    336.  
    337. # Allow outgoing SSH requests.
    338. $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
    339.  
    340. # Allow outgoing FTP requests. Unencrypted, use with care.
    341. $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT
    342.  
    343. # Allow outgoing NNTP requests. Unencrypted, use with care.
    344. # $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 119 -j ACCEPT
    345.  
    346. # Allow outgoing NTP requests. Unencrypted, use with care.
    347. # $IPTABLES -A OUTPUT -m state --state NEW -p udp --dport 123 -j ACCEPT
    348.  
    349. # Allow outgoing IRC requests. Unencrypted, use with care.
    350. # Note: This usually needs the ip_conntrack_irc kernel module.
    351. # $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 6667 -j ACCEPT
    352.  
    353. # Allow outgoing requests to various proxies. Unencrypted, use with care.
    354. # $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 8080 -j ACCEPT
    355. # $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 8090 -j ACCEPT
    356.  
    357. # Allow outgoing DHCP requests. Unencrypted, use with care.
    358. # TODO: This is completely untested, I have no idea whether it works!
    359. # TODO: I think this can be tightened a bit more.
    360. $IPTABLES -A OUTPUT -m state --state NEW -p udp --sport 67:68 --dport 67:68 -j ACCEPT
    361.  
    362. # Allow outgoing CVS requests. Unencrypted, use with care.
    363. # $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 2401 -j ACCEPT
    364.  
    365. # Allow outgoing MySQL requests. Unencrypted, use with care.
    366. # $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 3306 -j ACCEPT
    367.  
    368. # Allow outgoing SVN requests. Unencrypted, use with care.
    369. # $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 3690 -j ACCEPT
    370.  
    371. # Allow outgoing PLESK requests. Unencrypted, use with care.
    372. # $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 8443 -j ACCEPT
    373.  
    374. # Allow outgoing Tor (http://tor.eff.org) requests.
    375. # Note: Do _not_ use unencrypted protocols over Tor (sniffing is possible)!
    376. # $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 9001 -j ACCEPT
    377. # $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 9002 -j ACCEPT
    378. # $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 9030 -j ACCEPT
    379. # $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 9031 -j ACCEPT
    380. # $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 9090 -j ACCEPT
    381. # $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 9091 -j ACCEPT
    382.  
    383. # Allow outgoing OpenVPN requests.
    384. $IPTABLES -A OUTPUT -m state --state NEW -p udp --dport 1194 -j ACCEPT
    385.  
    386. # TODO: ICQ, MSN, GTalk, Skype, Yahoo, etc...
    387.  
    388. # Selectively allow certain inbound connections, block the rest.
    389. #------------------------------------------------------------------------------
    390.  
    391. # Allow incoming DNS requests.
    392. $IPTABLES -A INPUT -m state --state NEW -p udp --dport 53 -j ACCEPT
    393. $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT
    394.  
    395. # Allow incoming HTTP requests.
    396. $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT
    397.  
    398. # Allow incoming HTTPS requests.
    399. $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT
    400.  
    401. # Allow incoming POP3 requests.
    402. $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 110 -j ACCEPT
    403.  
    404. # Allow incoming IMAP4 requests.
    405. $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 143 -j ACCEPT
    406.  
    407. # Allow incoming POP3S requests.
    408. $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 995 -j ACCEPT
    409.  
    410. # Allow incoming SMTP requests.
    411. $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT
    412.  
    413. # Allow incoming SSH requests.
    414. $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
    415.  
    416. # Allow incoming FTP requests.
    417. $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT
    418.  
    419. # Allow incoming NNTP requests.
    420. # $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 119 -j ACCEPT
    421.  
    422. # Allow incoming MySQL requests.
    423. # $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 3306 -j ACCEPT
    424.  
    425. # Allow incoming PLESK requests.
    426. # $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 8843 -j ACCEPT
    427.  
    428. # Allow incoming BitTorrent requests.
    429. # TODO: Are these already handled by ACCEPTing established/related traffic?
    430. # $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 6881 -j ACCEPT
    431. # $IPTABLES -A INPUT -m state --state NEW -p udp --dport 6881 -j ACCEPT
    432.  
    433. # Allow incoming nc requests.
    434. # $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 2030 -j ACCEPT
    435. # $IPTABLES -A INPUT -m state --state NEW -p udp --dport 2030 -j ACCEPT
    436.  
    437. # Explicitly log and reject everything else.
    438. #------------------------------------------------------------------------------
    439. # Use REJECT instead of REJECTLOG if you don't need/want logging.
    440. $IPTABLES -A INPUT -j REJECTLOG
    441. $IPTABLES -A OUTPUT -j REJECTLOG
    442. $IPTABLES -A FORWARD -j REJECTLOG
    443.  
    444.  
    445. #------------------------------------------------------------------------------
    446. # Testing the firewall.
    447. #------------------------------------------------------------------------------
    448.  
    449. # You should check/test that the firewall really works, using
    450. # iptables -vnL, nmap, ping, telnet, ...
    451.  
    452. # Exit gracefully.
    453. #------------------------------------------------------------------------------
    454.  
    455.     exit 0
    456.  
    Have a nice day, Ruslan
     
    abuzant, Sep 18, 2008 IP
    shacow likes this.
  2. shacow

    shacow Active Member

    Messages:
    339
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    60
    #2
    excellent. I will keep this as a reference..

    could you explain what it actually does, and if it should be setup in cron etc?
     
    shacow, Sep 18, 2008 IP
  3. iloveRP.com

    iloveRP.com Peon

    Messages:
    457
    Likes Received:
    4
    Best Answers:
    0
    Trophy Points:
    0
    #3
    How to save this script? And what format will be used in saving this script? Where to upload this one?
     
    iloveRP.com, Sep 18, 2008 IP
  4. nimhost

    nimhost Active Member

    Messages:
    235
    Likes Received:
    7
    Best Answers:
    0
    Trophy Points:
    58
    #4
    i think it's same function like csf do :)
     
    nimhost, Sep 18, 2008 IP
  5. abuzant

    abuzant Active Member

    Messages:
    956
    Likes Received:
    45
    Best Answers:
    0
    Trophy Points:
    90
    #5
    shacow> maybe shoot me a 'thanks' reputation point? :D

    ilovePR> this is a UNIX style bash script, save it anywhere on your linux host machine and start it automatically with your server.. shall stop all attacks :D

    nimhost> really?! what a helpful guy you are, keep your bull for yourself if you know it; I posted for people that need it. FO!
     
    abuzant, Sep 19, 2008 IP
  6. shacow

    shacow Active Member

    Messages:
    339
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    60
    #6
    Thanks, so I just start it at boot right? - Is there anything I need to change in the script to get it working?

    Oh and... ermm how do I give you rep?
     
    shacow, Sep 19, 2008 IP
  7. nimhost

    nimhost Active Member

    Messages:
    235
    Likes Received:
    7
    Best Answers:
    0
    Trophy Points:
    58
    #7
    well this is a forum where everyone can talk
    i think you haven't try csf by your self
     
    nimhost, Sep 19, 2008 IP
  8. Tox

    Tox Active Member

    Messages:
    706
    Likes Received:
    5
    Best Answers:
    0
    Trophy Points:
    58
    #8
    Thank you for your share.
     
    Tox, Oct 1, 2008 IP
  9. WoW Blood

    WoW Blood Active Member

    Messages:
    164
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    85
    #9
    How do I like activate this?
     
    WoW Blood, Oct 5, 2008 IP
  10. mywedding

    mywedding Peon

    Messages:
    14
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #10
    chmod +x "bash-name" (without quotes
     
    mywedding, Oct 10, 2008 IP
  11. jamesfenwick

    jamesfenwick Peon

    Messages:
    3
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #11
    Will this work for a counter strike server?
     
    jamesfenwick, Nov 26, 2008 IP
  12. abuzant

    abuzant Active Member

    Messages:
    956
    Likes Received:
    45
    Best Answers:
    0
    Trophy Points:
    90
    #12
    Any server, this is a hardware level firewall and does actually care what doi you have on your server.

    PS> you might of course need to alter port numbers of mysql and apache with those of your CS server (see Tcp on CS documentation)

    Good luck, use the redDevil
     
    abuzant, Nov 27, 2008 IP
  13. ecommee

    ecommee Peon

    Messages:
    11
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #13
    Can i use this all the time? or just if needed?
     
    ecommee, Dec 1, 2008 IP
  14. looking4vps

    looking4vps Peon

    Messages:
    1,497
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    0
    #14
    how would you install on CentOS 5 vps?
     
    looking4vps, Sep 11, 2010 IP
  15. rsharp

    rsharp Peon

    Messages:
    1
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #15

    No he can't because he stole it from http://www.hermann-uwe.de/files/fw_laptop. Instead, maybe he can explain why he removed all the credits, helpful comments and GPL license.

    I would strongly advise against using this script unless you have vetted it yourself. The original was a work in progress and this idiot has just removed some of the warnings and TODOs instead of testing and fixing them. He's also added a couple of things that are just plain wrong.

    What is so hard about leaving credit where it's due?

    He doesn't need "shooting a rep point" he just needs plain shooting (preferably in the genitalia).
     
    rsharp, Dec 28, 2010 IP
  16. abuzant

    abuzant Active Member

    Messages:
    956
    Likes Received:
    45
    Best Answers:
    0
    Trophy Points:
    90
    #16
    Hey Mr. DJ,

    Be careful with your language, you are absolutely not welcome here without respect.

    Before you even had your first PC, or knew what a PC is, I was already developing linux scripts.
    This script has been lurking around the web with my name for over 5 years now, did you know what a PC is before 5 years?

    In addition, Mr. Smart***, I would suggest opening your eyes WIDER, and look at the credits where it clearly says:

     
    abuzant, Dec 29, 2010 IP
  17. jarrodw

    jarrodw Peon

    Messages:
    31
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #17
    Please do not implement iptables conntrack if you do not know what it does. Conntrack has the potential to cause memory exhaustion when implemented incorrectly. If you start to see log lines in your kernel logs that say things like:

    oom-killer: gfp_mask=0x800d0

    or similar lines, or you are getting terrible performance from your server you need to look at how much traffic you are getting compared to the server specification. If the server spec is strong enough to handle the traffic you might be having issues with conntrack.

    Conntrack works like a stack and if you have lots of short lived tcp connections (like HTTP) there is a possibility for high site traffic to cause conntrack table entries to get popped off of the stack causing TCP reset to happen.

    Just be aware of what you are installing. It looks like a good script but it implements things that could cause serious problems if you do not know how they work.

    This is just a heads up, conntrack is great. Just make sure that you educate yourself in how it works at the netfilter site.
     
    jarrodw, Jan 1, 2011 IP
  18. raffo77

    raffo77 Active Member

    Messages:
    236
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    51
    #18
    Good, but all know Linux.. i will be happy to see the same on FreeBSD with pf or ipfw :D
     
    raffo77, Jan 12, 2011 IP
  19. panteng

    panteng Peon

    Messages:
    48
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #19
    wonderful..... execuse me,, what I have some questions about this script...
    1. How to active this script?? Only change its permission mode??
    2. What the type extention file to save that script ?? PHP ?? or py ??

    thanks.. I hope my questions can be answered...
     
    panteng, Jan 12, 2011 IP
  20. jarrodw

    jarrodw Peon

    Messages:
    31
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #20
    Extension does not matter on linux. It does when you are running scripts under apache and using mod_php or mod_py
    then you have to have the proper extension configured and even then you can change the extension to something arbitrary.

    For shell scripts you need to have the magic line:

    #!/usr/bin/env perl

    similar for python, ruby, sh etc.

    Open up the script and look at the first line.

    From this line:


    #!/bin/sh


    We can tell that it is a Bourne Shell script. You can save it with .sh or .asdokfjlkgfajslgdfka and both will work. The command line does not care about extensions.

    GCC and CC the compilers for c/cpp will bark errors if you feed a file without .c or .cpp which is proven with the following:


    noway@ridley:~/c$ mv structtest.c structtest1
    noway@ridley:~/c$ gcc structtest1
    structtest1: file not recognized: File format not recognized
    collect2: ld returned 1 exit status


    Now with a .c extension:

    nowayd@ridley:~/c$ gcc structtest.c
    noway@ridley:~/c$ ls
    a.out
     
    Last edited: Jan 12, 2011
    jarrodw, Jan 12, 2011 IP