Adaptive iptables

Scripts triggered by systemd for modifying iptables firewall rules.

---

Table of Contents

• ⬆️ Top of ReadMe File

• ⚡ Quick Start

• 🐚 Utilize Adaptive iptables

• 🗒 Notes

• 📇 Attribution

• ⚖ License

---

Quick Start

Downloading

sudo su -
cd /usr/local/etc

git clone --recurse-submodules git@github.com:paranoid-linux/adaptive-iptables.git

Upgrading

sudo su -
cd /usr/local/etc/adaptive-iptables

git pull
git submodule update --init --recursive --merge

---

Utilize Adaptive iptables

The base-policies.sh script, and each script under the interface-protocols and services directories may be run with --help argument to output available options.

bash base-policies.sh --help

Installation

1. Assign interface names to array for easier looping

2. Install base policies and protocol filters

3. Enable base policies and protocol filters

_interface_list=('eth0' 'wlan0')


bash base-policies.sh --install
bash interface-protocols/icmp.sh --install
bash interface-protocols/tcp.sh --install
bash interface-protocols/udp.sh --install


bash base-policies.sh --systemd='enable'
for _interface in "${_interface_list[@]}"; do
    bash interface-protocols/icmp.sh --systemd='enable' --interface="${_interface}"
    bash interface-protocols/tcp.sh --systemd='enable' --interface="${_interface}"
    bash interface-protocols/udp.sh --systemd='enable' --interface="${_interface}"
done

Restarting of interfaces should trigger protocol filters, and restarting of device should trigger base-policies.sh

Logging

Enable logging.sh to facilitate debugging of connections that should be allowed...

bash interface-protocols/logging.sh --install

for _interface in "${_interface_list[@]}"; do
    bash interface-protocols/logging.sh --systemd='enable' --interface="${_interface}"
done

Disable logging.sh to avoid filling logs with traffic that should be ignored...

for _interface in "${_interface_list[@]}"; do
    bash interface-protocols/logging.sh --systemd='disable' --interface="${_interface}"
done

View logs with your favorite text parser...

grep -i -- 'put_log' /var/log/messages

tail -f /var/log/messages | awk '$7 ~ "put_log" {print}'

Services

1. Install systemd template for a given service

2. Enable service firewall rules for a set of interfaces

bash services/ssh.sh --install

for _interface in "${_interface_list[@]}"; do
    bash services/ssh.sh --systemd='enable' --interface="${_interface}"
done

Firewall rules should be started when service and interface are available, and stopped when either are unavailable.

---

Notes

Unless other wise stated within an individual script, the scripts within this repository target iptables and not ip6tables

The tcp.sh filters will log specific types of dropped packets and is intended to be used with fail2ban (or similar firewall management software). Future revisions may include a command-line option to toggle logging behaviors.

Some services, such as OpenVPN, require setting additional command-line options; please review the --help documentation for details.

---

Attribution

• ICMP

  • iptables -p icmp -h
  • https://serverfault.com/questions/84963/why-not-block-icmp
  • https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol

• UDP

  • https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

• TCP

  • https://www.cyberciti.biz/faq/linux-detect-port-scan-attacks/
  • https://www.ossramblings.com/using_iptables_rate_limiting_to_prevent_portscans
  • https://www.linuxquestions.org/questions/linux-security-4/tcp-packet-flags-syn-fin-ack-etc-and-firewall-rules-317389/
  • https://gist.github.com/petrilli/1959001
  • https://serverfault.com/questions/123208/iptables-p-udp-state-established
  • https://serverfault.com/questions/191390/iptables-and-dhcp-questions

---

License

Legal bits of Open Source software

Adaptive iptables documentation on how this project may be utilized
Copyright (C) 2019  S0AndS0

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as published
by the Free Software Foundation; version 3 of the License.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License
along with this program.  If not, see <https://www.gnu.org/licenses/>.