1+ #! /bin/bash
2+
3+ # MIT License
4+
5+ # Copyright (c) 2024 Geoffrey Gontard
6+
7+ # Permission is hereby granted, free of charge, to any person obtaining a copy
8+ # of this software and associated documentation files (the "Software"), to deal
9+ # in the Software without restriction, including without limitation the rights
10+ # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11+ # copies of the Software, and to permit persons to whom the Software is
12+ # furnished to do so, subject to the following conditions:
13+
14+ # The above copyright notice and this permission notice shall be included in all
15+ # copies or substantial portions of the Software.
16+
17+ # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18+ # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19+ # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
20+ # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21+ # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22+ # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
23+ # SOFTWARE.
24+
25+
26+
27+
28+ disable_firewall () {
29+ systemctl stop nftables.service
30+ }
31+
32+
33+
34+
35+ # This script is based on nftables, it can't work without it.
36+ # Testing if nftables is installed on the system, try to install it if not, or exit.
37+ install_firewall () {
38+ if [[ $( exists_command " nft" ) != " exists" ; then
39+ echo " Error: nftables not found on the system but is required to configure your firewall with $NAME ."
40+
41+ if [[ $( exists_command " apt" ) = " exists" ; then
42+ echo " Installing nftables with APT..."
43+ echo " Warning: if iptables is installed, nftables will replace it. "
44+ echo " Warning: be sure to keep a copy of your currents firewall rulesets."
45+ read -p " $continue_question "
46+
47+ if [[ $install_confirmation_nftables = $yes ]]; then
48+ apt install -y nftables
49+ systemctl enable nftables.service
50+ systemctl restart nftables.service
51+ else
52+ # Exit to avoid doing anything else with this script without nftables installed
53+ exit
54+ fi
55+
56+ else
57+ echo " Error: nftables could not been installed with APT."
58+
59+ # Exit to avoid doing anything else with this script without nftables installed
60+ exit
61+ fi
62+
63+ fi
64+ }
65+
66+
67+
68+
69+ # Configure the firewall
70+ create_firewall () {
71+
72+ now=$( date +%y-%m-%d_%H-%M-%S)
73+ nftables_file=" /etc/nftables.conf"
74+ nftables_dir=" /etc/bashpack/firewall/"
75+ nftables_file_backup=$nftables_dir " nftables.conf_backup_$now "
76+
77+
78+ # # Making sure to use nftables
79+ # apt install -y nftables
80+ # systemctl enable nftables.service
81+ # systemctl restart nftables.service
82+
83+ # Making sure the nftables.conf file exists
84+ nft list ruleset > $nftables_file
85+
86+ # Making a backup of your current nftables ruleset
87+ mkdir -p $nftables_dir
88+ chmod 755 $nftables_dir
89+ cp $nftables_file $nftables_file_backup
90+
91+ echo " "
92+ echo " A backup of your current nftables firewall ruleset has been saved to " $nftables_file_backup " ."
93+ echo " "
94+
95+ # --------------------------
96+ # Here is what this script will erase and recreate :
97+ #
98+ # table inet filter
99+ # chain $NAME_UPPERCASE-PREROUTING type filter hook prerouting priority -199; policy drop;
100+ # ct state related,established counter accept
101+ # iifname lo counter accept
102+ # chain $NAME_UPPERCASE-OUTPUT
103+ # type filter hook output priority -300; policy accept;
104+ #
105+ # Documentation here: https://wiki.nftables.org/wiki-nftables/index.php/Netfilter_hooks
106+ # --------------------------
107+
108+ # Deleting current ruleset to get a clean firewall and avoid any issues
109+ nft flush ruleset
110+
111+ # Adding the inet filter table to the current firewall
112+ nft add table inet filter
113+
114+ # Creating $NAME_UPPERCASE-PREROUTING chain
115+ # Eveything is closed inbound by default
116+ nft add chain inet filter $NAME_UPPERCASE -PREROUTING { type filter hook prerouting priority -199\; policy drop\; }
117+ nft add rule inet filter $NAME_UPPERCASE -PREROUTING ct state related,established counter accept
118+ nft add rule inet filter $NAME_UPPERCASE -PREROUTING iifname lo counter accept
119+ # Allowing Docker containers to see each others & to reach internet (works with or without Docker bridges) (this rule is created even if Docker is not installed to anticipate any futures Docker installations)
120+ nft add rule inet filter $NAME_UPPERCASE -PREROUTING ip saddr 172.0.0.0/8 counter accept
121+ # Inbound customs rules below
122+ # nft add rule inet filter $NAME_UPPERCASE-PREROUTING tcp dport <PORT> counter accept
123+
124+ # Creating $NAME_UPPERCASE-POSTROUTING
125+ # Eveything is open outbound by default
126+ nft add chain inet filter $NAME_UPPERCASE -POSTROUTING { type filter hook postrouting priority -300\; policy accept\; }
127+
128+
129+ # Saving the new nftables ruleset
130+ nft list ruleset > $nftables_file
131+
132+ # Restarting firewall
133+ systemctl restart nftables.service
134+
135+ # Restarting Docker (if Docker is installed) to force it using nftables instead of iptables
136+ if [[ $( exists_command " docker" ) = " exists" ; then
137+ systemctl restart docker.service
138+ fi
139+
140+
141+ echo " Success! New firewall configured."
142+
143+
144+ }
145+
146+
147+
148+ install_firewall
149+ create_firewall
0 commit comments