Skip to content

Commit ec2dedf

Browse files
haikelfazzanihaikelfazzani
committed
first commit
0 parents  commit ec2dedf

File tree

8 files changed

+320
-0
lines changed

8 files changed

+320
-0
lines changed

‎.gitignore

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
test
2+
node_modules
3+
.cache
4+
.vscode
5+
testr
6+
temp
7+
testfile
8+
test.js
9+
test.sh
10+
*.tmp
11+
12+
package-lock.json

‎firewall/Readme.md

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Firewall
2+
3+
## Install
4+
```shell
5+
apt install ipset iptables netfilter-persistent ipset-persistent iptables-persistent
6+
```
7+
8+
## Iptables common rules
9+
10+
**DROP RFC1918 PACKETS**
11+
```shell
12+
-A INPUT -s 10.0.0.0/8 -j DROP
13+
-A INPUT -s 172.16.0.0/12 -j DROP
14+
-A INPUT -s 192.168.0.0/16 -j DROP
15+
```
16+
17+
**Outbound UDP Flood protection**
18+
```shell
19+
iptables -N udp-flood
20+
iptables -A OUTPUT -p udp -j udp-flood
21+
iptables -A udp-flood -p udp -m limit --limit 50/s -j RETURN
22+
iptables -A udp-flood -j LOG --log-level 4 --log-prefix 'UDP-flood attempt: '
23+
iptables -A udp-flood -j DROP
24+
```
25+
26+
**prevent flooding general**
27+
```shell
28+
iptables -N udp-flood
29+
iptables -A udp-flood -m limit --limit 4/second --limit-burst 4 -j RETURN
30+
iptables -A udp-flood -j DROP
31+
iptables -A INPUT -i eth0 -p udp -j udp-flood
32+
iptables -A INPUT -i eth0 -f -j DROP
33+
```
34+
35+
**prevent amplification attack**
36+
```shell
37+
iptables -N DNSAMPLY
38+
iptables -A DNSAMPLY -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
39+
iptables -A DNSAMPLY -p udp -m hashlimit --hashlimit-srcmask 24 --hashlimit-mode srcip --hashlimit-upto 30/m --hashlimit-burst 10 --hashlimit-name DNSTHROTTLE --dport 53 -j ACCEPT
40+
iptables -A DNSAMPLY -p udp -m udp --dport 53 -j DROP
41+
```
42+
43+
## Notes
44+
- [A Tutorial for Controlling Network Traffic with iptables](https://www.linode.com/docs/guides/control-network-traffic-with-iptables/)
45+
- [IPset reference](https://manpages.debian.org/testing/ipset/ipset.8.en.html)
46+
- [Iptables Essentials](https://github.com/trimstray/iptables-essentials/blob/master/README.md#xmas-packets)
47+
- [IPtables persist](https://unix.stackexchange.com/questions/52376/why-do-iptables-rules-disappear-when-restarting-my-debian-system)
48+
49+
# License
50+
MIT

‎firewall/block_malicious_ips.sh

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
#!/bin/bash
2+
3+
source ./firewall/constants.sh
4+
5+
block_malicious_ips() {
6+
SRC_URL="https://gitlab.com/haikelfazzani/blocklist/-/raw/master/ips/malicious.txt"
7+
8+
curl -s -X GET \
9+
-H "Content-type: application/json" \
10+
-H "Accept: application/json" \
11+
"$SRC_URL" >$TEMP_FILE_PATH
12+
13+
uniq_ips=$(awk '{if (++dup[$0] == 1) print $0;}' $TEMP_FILE_PATH)
14+
15+
ipset_name="malicious-set"
16+
17+
ipset -q flush $ipset_name
18+
ipset create $ipset_name hash:net -exist
19+
20+
# echo "$uniq_ips"
21+
echo "$uniq_ips" >$TEMP_FILE_PATH
22+
23+
sed -i '/^$/d; / *#/d; /\//d' $TEMP_FILE_PATH
24+
25+
while read -r ip; do
26+
if [[ "$ip" =~ $ipRegexV4 ]]; then
27+
ipset add $ipset_name $ip -exist
28+
else
29+
echo $ip >>$TEMP_FILE_INVALID_PATH
30+
sed -i "/$ip/d" $TEMP_FILE_PATH
31+
fi
32+
done <"$TEMP_FILE_PATH"
33+
34+
ipset save
35+
36+
iptables -D INPUT -m set --match-set $ipset_name src -j DROP 2>/dev/null
37+
iptables -D OUTPUT -m set --match-set $ipset_name src -j DROP 2>/dev/null
38+
39+
iptables -I INPUT -m set --match-set $ipset_name src -j DROP
40+
iptables -I OUTPUT -m set --match-set $ipset_name src -j DROP
41+
42+
iptables-save >/etc/iptables/rules.v4
43+
iptables -S
44+
}
45+
46+
(
47+
set -e
48+
block_malicious_ips
49+
)
50+
51+
errorCode=$?
52+
if [ $errorCode -ne 0 ]; then
53+
echo "Error in block_malicious_ips: $errorCode"
54+
exit $errorCode
55+
fi

‎firewall/block_range_ips.sh

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
#!/bin/bash
2+
3+
source ./firewall/constants.sh
4+
5+
block_range_ips() {
6+
SRC_URL="https://gitlab.com/haikelfazzani/blocklist/-/raw/master/ips/range.txt"
7+
8+
curl -s -X GET \
9+
-H "Content-type: application/json" \
10+
-H "Accept: application/json" \
11+
"$SRC_URL" >$TEMP_FILE_PATH
12+
13+
uniq_ips=$(awk '{if (++dup[$0] == 1) print $0;}' $TEMP_FILE_PATH)
14+
15+
ipset_name="blacklist-range-set"
16+
17+
ipset -q flush $ipset_name
18+
ipset create $ipset_name hash:net -exist
19+
20+
# echo "$uniq_ips"
21+
echo "$uniq_ips" >$TEMP_FILE_PATH
22+
23+
sed -r -i '/^\s*$/d; /^[[:blank:]]*#/d;s/#.*//' $TEMP_FILE_PATH
24+
25+
while read -r ip_range; do
26+
ip=$(echo $ip_range | sed -r 's/\/.*//g')
27+
28+
if [[ "$ip" =~ $ipRegexV4 ]]; then
29+
ipset add $ipset_name $ip_range -exist
30+
# echo "==> $ip_range"
31+
else
32+
echo $ip_range >>$TEMP_FILE_INVALID_PATH
33+
sed -i "/$ip/d" $TEMP_FILE_PATH
34+
fi
35+
done <"$TEMP_FILE_PATH"
36+
37+
ipset save
38+
39+
iptables -D INPUT -m set --match-set $ipset_name src -j DROP 2>/dev/null
40+
iptables -D OUTPUT -m set --match-set $ipset_name src -j DROP 2>/dev/null
41+
42+
iptables -I INPUT -m set --match-set $ipset_name src -j DROP
43+
iptables -I OUTPUT -m set --match-set $ipset_name src -j DROP
44+
45+
iptables-save >/etc/iptables/rules.v4
46+
iptables -S
47+
}
48+
49+
(
50+
set -e
51+
block_range_ips
52+
)
53+
54+
errorCode=$?
55+
if [ $errorCode -ne 0 ]; then
56+
echo "Error in block_range_ips: $errorCode"
57+
exit $errorCode
58+
fi

‎firewall/common-rules.sh

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
#!/bin/bash
2+
3+
IPT=/sbin/iptables
4+
5+
cleanOldRules() {
6+
$IPT -F
7+
$IPT -X
8+
$IPT -t nat -F
9+
$IPT -t nat -X
10+
$IPT -t mangle -F
11+
$IPT -t mangle -X
12+
$IPT -P INPUT ACCEPT
13+
$IPT -P OUTPUT ACCEPT
14+
$IPT -P FORWARD ACCEPT
15+
}
16+
17+
applyRules() {
18+
iptables -A INPUT -i lo -j ACCEPT
19+
iptables -A OUTPUT -o lo -j ACCEPT
20+
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
21+
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
22+
23+
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP # Dropping Invalid Packets
24+
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
25+
iptables -A INPUT -i eth1 -p icmp --icmp-type echo-request -j DROP
26+
iptables -N port-scanning
27+
iptables -A port-scanning -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j RETURN
28+
iptables -A port-scanning -j DROP
29+
iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --set
30+
iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 -j DROP
31+
iptables -N syn_flood
32+
33+
iptables -A INPUT -p tcp --syn -j syn_flood
34+
iptables -A syn_flood -m limit --limit 1/s --limit-burst 3 -j RETURN
35+
iptables -A syn_flood -j DROP
36+
37+
iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j ACCEPT
38+
39+
iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j LOG --log-prefix PING-DROP:
40+
iptables -A INPUT -p icmp -j DROP
41+
42+
iptables -A OUTPUT -p icmp -j ACCEPT
43+
iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
44+
iptables -A INPUT -f -j DROP
45+
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
46+
iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
47+
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
48+
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
49+
iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
50+
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
51+
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
52+
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
53+
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
54+
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
55+
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
56+
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
57+
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
58+
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
59+
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
60+
61+
iptables-save >/etc/iptables/rules.v4
62+
iptables -S
63+
}
64+
65+
(
66+
set -e
67+
cleanOldRules
68+
applyRules
69+
)
70+
71+
errorCode=$?
72+
if [ $errorCode -ne 0 ]; then
73+
echo "Error in common-rules: $errorCode"
74+
exit $errorCode
75+
fi

‎firewall/constants.sh

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/bash
2+
3+
export ipRegexV4="^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"
4+
5+
export TEMP_FILE_PATH="./firewall/ips.tmp"
6+
7+
export TEMP_FILE_INVALID_PATH="./firewall/ips_invalid.tmp"

‎hosts-file/Readme.md

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# blacklist domains ressources
2+
3+
- [adfilt](https://github.com/DandelionSprout/adfilt)
4+
- [neohosts](https://github.com/neoFelhz/neohosts)
5+
- [Ad-set-hosts](https://github.com/rentianyu/Ad-set-hosts)
6+
7+
# License
8+
9+
MIT

‎hosts-file/index.sh

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
#!/bin/bash
2+
3+
# colors
4+
Color_Off='\033[0m' # Text Reset
5+
6+
# Regular Colors
7+
Red='\033[0;31m' # Red
8+
Green='\033[0;32m' # Green
9+
Yellow='\033[0;33m' # Yellow
10+
11+
# update /etc/hosts
12+
declare -a remote_files=("_domains" "apple" "cloudfront" "common" "facebook" "google" "microsoft" "msn" "twitter" "yahoo")
13+
TEMP_FILE_PATH='./hosts-file/hosts_file.tmp'
14+
HOSTS_FILE_PATH='/etc/hosts'
15+
16+
date=$(date +%F)
17+
hostname=$(hostname)
18+
19+
echo -e ">>${Green} [Start] updating /etc/hosts ${Color_Off}"
20+
21+
HEADER="# Last updated: $date\n
22+
\n
23+
# The following lines are desirable for IPv4 capable hosts\n
24+
\n\n
25+
127.0.0.1 localhost\n
26+
127.0.1.1 $hostname\n
27+
# The following lines are desirable for IPv6 capable hosts\n
28+
\n\n
29+
::1 localhost ip6-localhost ip6-loopback\n
30+
fe00::0 ip6-localnet\n
31+
ff02::1 ip6-allnodes\n
32+
ff02::2 ip6-allrouters\n
33+
ff02::3 ip6-allhosts\n
34+
\n\n
35+
# The following lines are desirable for blocked domains\n
36+
\n"
37+
38+
echo -e $HEADER >$TEMP_FILE_PATH
39+
40+
for i in "${remote_files[@]}"; do
41+
domains=$(curl -s -X GET \
42+
-H "Content-type: text/plain; charset=UTF-8" \
43+
-H "Accept: text/plain; charset=UTF-8" \
44+
"https://gitlab.com/haikelfazzani/blocklist/-/raw/master/hosts/_domains.txt")
45+
46+
echo "$domains" | sed 's/[|^]//g; /^$/d; s/ *$//' | sed -E "/^[^#]/ s/^/0.0.0.0 /" >>$TEMP_FILE_PATH
47+
echo -e "> ${Yellow} [End Processing] $i ${Color_Off}"
48+
done
49+
50+
awk -i inplace '!seen[$0]++' $TEMP_FILE_PATH
51+
sed -i -e 's/0.0.0.0.*#/# /g' $TEMP_FILE_PATH
52+
cat $TEMP_FILE_PATH >$HOSTS_FILE_PATH
53+
54+
echo -e ">>${Green} [End] updating /etc/hosts ${Color_Off}"

0 commit comments

Comments
 (0)