iptables

###############################################################################
# The MIT License
#
# Copyright 2012-2014 Jakub Jirutka <[email protected]>.
#
# Adjusted: 2019 Leszek Cimała
# It is best to use Jakubs template, this is for my needs.
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
# THE SOFTWARE.
#

###############################################################################
#
#   Basic ip(6)tables (both IPv4 and IPv6) template for an ordinary servers
#
# This file is in iptables-restore (ip6tables-restore) format. See the man
# pages for iptables-restore (ip6tables-restore). Rules that should be loaded
# only by iptables (ip6tables) uses the -4 (-6) option.
#
# The following is a set of firewall rules that should be applicable to Linux 
# servers running within departments. It is intended to provide a useful 
# starting point from which to devise a comprehensive firewall policy for 
# a host.
#
# Parts 1 and 3 of these rules are the same for each host, whilst part 2 can be 
# populated with rules specific to particular hosts. The optional part 4 is
# prepared for a NAT rules, e.g. for port forwarding, redirect, masquerade...
#
# This template is based on http://jdem.cz/v64a3 from University of Leicester
#
# For the newest version go to https://gist.github.com/jirutka/3742890.
#
# @author Jakub Jirutka <[email protected]>
# @version 1.3.1
# @date 2014-01-28
#

###############################################################################
# 1. COMMON HEADER                                                            #
#                                                                             #
# This section is a generic header that should be suitable for most hosts.    #
###############################################################################

*filter

# Base policy
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

# Don't attempt to firewall internal traffic on the loopback device.
-A INPUT -i lo -j ACCEPT

# ER2020: BLACKLIST: go fuck yourself Iranian bastards (cracking email password):
-4 -A FORWARD -s 46.38.144.0/24 -j DROP

# Continue connections that are already established or related to an established 
# connection.
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# Drop non-conforming packets, such as malformed headers, etc.
-A INPUT -m conntrack --ctstate INVALID -j DROP

# Block remote packets claiming to be from a loopback address.
-4 -A INPUT -s 127.0.0.0/8 ! -i lo -j DROP
-6 -A INPUT -s ::1/128 ! -i lo -j DROP

# Drop all packets that are going to broadcast, multicast or anycast address.
-4 -A INPUT -m addrtype --dst-type BROADCAST -j DROP
-4 -A INPUT -m addrtype --dst-type MULTICAST -j DROP
-4 -A INPUT -m addrtype --dst-type ANYCAST -j DROP
-4 -A INPUT -d 224.0.0.0/4 -j DROP

# Chain for preventing SSH brute-force attacks.
# Permits 10 new connections within 5 minutes from a single host then drops 
# incomming connections from that host. Beyond a burst of 100 connections we 
# log at up 1 attempt per second to prevent filling of logs.
-N SSHBRUTE
-A SSHBRUTE -m recent --name SSH --set
-A SSHBRUTE -m recent --name SSH --update --seconds 300 --hitcount 10 -m limit --limit 1/second --limit-burst 100 -j LOG --log-prefix "iptables[SSH-brute]: "
-A SSHBRUTE -m recent --name SSH --update --seconds 300 --hitcount 10 -j DROP
-A SSHBRUTE -j ACCEPT

# ER2016: disable bruteforce protection - allow only my ip ;-)
-4 -A INPUT -p tcp -s 78.157.163.74 --dport 22 -j ACCEPT
# ED - trzyniec
-4 -A INPUT -p tcp -s 81.200.51.236 --dport 22 -j ACCEPT
# ED - vpn
-4 -A INPUT -p tcp -s 77.78.95.12 --dport 22 -j ACCEPT
# 2018 - vacations TEMPORARY!!!
#-A INPUT -p tcp --dport 22 -j ACCEPT

# Chain for preventing ping flooding - up to 6 pings per second from a single 
# source, again with log limiting. Also prevents us from ICMP REPLY flooding 
# some victim when replying to ICMP ECHO from a spoofed source.
-N ICMPFLOOD
-A ICMPFLOOD -m recent --set --name ICMP --rsource
-A ICMPFLOOD -m recent --update --seconds 1 --hitcount 6 --name ICMP --rsource --rttl -m limit --limit 1/sec --limit-burst 1 -j LOG --log-prefix "iptables[ICMP-flood]: "
-A ICMPFLOOD -m recent --update --seconds 1 --hitcount 6 --name ICMP --rsource --rttl -j DROP
-A ICMPFLOOD -j ACCEPT


###############################################################################
# 2. HOST SPECIFIC RULES                                                      #
#                                                                             #
# This section is a good place to enable your host-specific services.         #
###############################################################################

# Accept HTTP and HTTPS
#-A INPUT -p tcp -m multiport --dports 80,443 --syn -m conntrack --ctstate NEW -j ACCEPT

# Accept FTP only for IPv4
#-4 -A INPUT -p tcp --dport 21 --syn -m conntrack --ctstate NEW -j ACCEPT

# ER2017: enable VNC on 5900
-4 -A INPUT -p tcp -s 78.157.163.74 --dport 5900 -j ACCEPT
#-4 -A INPUT -p tcp --dport 5900 -j ACCEPT
-4 -A INPUT -p tcp -s 78.157.163.74 --dport 5901 -j ACCEPT

# ER2017: enable forwarding from and to VM bridge (important!)
-A FORWARD -i br0 -j ACCEPT
-A FORWARD -o br0 -j ACCEPT

# ER2017: enable central rsyslog
-4 -A INPUT -i br0 -p tcp --dport 514 -d 172.17.1.1 -j ACCEPT

# ER2017: HTTP and HTTPS
-4 -A INPUT -p tcp --dport 80  -j ACCEPT
-4 -A INPUT -p tcp --dport 443 -j ACCEPT

# ER2017: enable syncthing web
-4 -A INPUT -p tcp -s 78.157.163.74 --dport 8384 -j ACCEPT
-4 -A FORWARD -i eth0 -p tcp --dport 8384 -d 172.17.1.2 -j ACCEPT

# ER2017: syncthing synchronization
-4 -A INPUT -p tcp -s 78.157.163.74 --dport 22000 -j ACCEPT
-4 -A INPUT -p udp -s 78.157.163.74 --dport 21027 -j ACCEPT

# ER2017: SSH? is that needed?
-4 -A INPUT -p tcp -s 78.157.163.74 --dport 2203 -j ACCEPT
#-A FORWARD -i eth0 -p tcp --dport 2203 -d 172.17.1.3 -j ACCEPT

#-4 -A INPUT -p tcp --dport 25  -j ACCEPT
#-A FORWARD -i venet0 -p tcp --dport 25 -d 172.17.1.4 -j ACCEPT

# ER2017: ftp on web server
-A INPUT  -p tcp -m tcp --dport 21 -m conntrack --ctstate ESTABLISHED,NEW -j ACCEPT -m comment --comment "Allow ftp connections on port 21"
-A INPUT  -p tcp -m tcp --dport 20 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Allow ftp connections on port 20"
-A INPUT  -p tcp -m tcp --sport 1024: --dport 29000:29100 -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "Allow passive inbound connections"


###############################################################################
# 3. GENERAL RULES                                                            #
#                                                                             #
# This section contains general rules that should be suitable for most hosts. #
###############################################################################

# Accept worldwide access to SSH and use SSHBRUTE chain for preventing 
# brute-force attacks.
-A INPUT -p tcp --dport 2203 --syn -m conntrack --ctstate NEW -j SSHBRUTE

# Permit useful IMCP packet types for IPv4
# Note: RFC 792 states that all hosts MUST respond to ICMP ECHO requests.
# Blocking these can make diagnosing of even simple faults much more tricky.
# Real security lies in locking down and hardening all services, not by hiding.
-4 -A INPUT -p icmp --icmp-type 0  -m conntrack --ctstate NEW -j ACCEPT
-4 -A INPUT -p icmp --icmp-type 3  -m conntrack --ctstate NEW -j ACCEPT
-4 -A INPUT -p icmp --icmp-type 11 -m conntrack --ctstate NEW -j ACCEPT

# Permit needed ICMP packet types for IPv6 per RFC 4890.
-6 -A INPUT              -p ipv6-icmp --icmpv6-type 1   -j ACCEPT
-6 -A INPUT              -p ipv6-icmp --icmpv6-type 2   -j ACCEPT
-6 -A INPUT              -p ipv6-icmp --icmpv6-type 3   -j ACCEPT
-6 -A INPUT              -p ipv6-icmp --icmpv6-type 4   -j ACCEPT
-6 -A INPUT              -p ipv6-icmp --icmpv6-type 133 -j ACCEPT
-6 -A INPUT              -p ipv6-icmp --icmpv6-type 134 -j ACCEPT
-6 -A INPUT              -p ipv6-icmp --icmpv6-type 135 -j ACCEPT
-6 -A INPUT              -p ipv6-icmp --icmpv6-type 136 -j ACCEPT
-6 -A INPUT              -p ipv6-icmp --icmpv6-type 137 -j ACCEPT
-6 -A INPUT              -p ipv6-icmp --icmpv6-type 141 -j ACCEPT
-6 -A INPUT              -p ipv6-icmp --icmpv6-type 142 -j ACCEPT
-6 -A INPUT -s fe80::/10 -p ipv6-icmp --icmpv6-type 130 -j ACCEPT
-6 -A INPUT -s fe80::/10 -p ipv6-icmp --icmpv6-type 131 -j ACCEPT
-6 -A INPUT -s fe80::/10 -p ipv6-icmp --icmpv6-type 132 -j ACCEPT
-6 -A INPUT -s fe80::/10 -p ipv6-icmp --icmpv6-type 143 -j ACCEPT
-6 -A INPUT              -p ipv6-icmp --icmpv6-type 148 -j ACCEPT
-6 -A INPUT              -p ipv6-icmp --icmpv6-type 149 -j ACCEPT
-6 -A INPUT -s fe80::/10 -p ipv6-icmp --icmpv6-type 151 -j ACCEPT
-6 -A INPUT -s fe80::/10 -p ipv6-icmp --icmpv6-type 152 -j ACCEPT
-6 -A INPUT -s fe80::/10 -p ipv6-icmp --icmpv6-type 153 -j ACCEPT

# Permit IMCP echo requests (ping) and use ICMPFLOOD chain for preventing ping 
# flooding.
-4 -A INPUT -p icmp --icmp-type 8  -m conntrack --ctstate NEW -j ICMPFLOOD
-6 -A INPUT -p ipv6-icmp --icmpv6-type 128 -j ICMPFLOOD

# Do not log packets that are going to ports used by SMB
# (Samba / Windows Sharing).
-A INPUT -p udp -m multiport --dports 135,445 -j DROP
-A INPUT -p udp --dport 137:139 -j DROP
-A INPUT -p udp --sport 137 --dport 1024:65535 -j DROP
-A INPUT -p tcp -m multiport --dports 135,139,445 -j DROP

# Do not log packets that are going to port used by UPnP protocol.
-A INPUT -p udp --dport 1900 -j DROP

# Do not log late replies from nameservers.
-A INPUT -p udp --sport 53 -j DROP

# Good practise is to explicately reject AUTH traffic so that it fails fast.
-A INPUT -p tcp --dport 113 --syn -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset

# Prevent DOS by filling log files.
-A INPUT -m limit --limit 1/second --limit-burst 100 -j LOG --log-prefix "iptables[DOS]: "


COMMIT


###############################################################################
# 4. HOST SPECIFIC NAT RULES                                                  #
#                                                                             #
# Uncomment this section if you want to use NAT table, e.g. for port          #
# forwarding, redirect, masquerade... If you want to load this section only   #
# for IPv4 and ignore for IPv6, use ip6tables-restore with -T filter.         #
###############################################################################

*nat

# Base policy
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

# Redirect port 21 to local port 2121
#-A PREROUTING -i eth0 -p tcp --dport 21 -j REDIRECT --to-port 2121

# Forward port 8080 to port 80 on host 192.168.1.10
#-4 -A PREROUTING -i eth0 -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.10:80

# ER2017: masquarade bridge

# Warning: add -i venet0:0 below, if not, all traffic on specific port will be routed back

#-A POSTROUTING -s 172.17.1.0/24 ! -o br0 -j MASQUERADE
-A POSTROUTING -s 172.17.1.0/24 ! -o br0 -j SNAT --to-source 37.205.9.57
#-A POSTROUTING -o br0 -j MASQUERADE

# SSH (always: me, ED trzyniec, ED VPN) 
# sync
-A PREROUTING -s 78.157.163.74 -p tcp --dport 2202 -j DNAT --to-destination 172.17.1.2:22
-A PREROUTING -s 81.200.51.236 -p tcp --dport 2202 -j DNAT --to-destination 172.17.1.2:22
-A PREROUTING -s 77.78.95.12   -p tcp --dport 2202 -j DNAT --to-destination 172.17.1.2:22
# web
-A PREROUTING -s 78.157.163.74 -p tcp --dport 2203 -j DNAT --to-destination 172.17.1.3:22
-A PREROUTING -s 81.200.51.236 -p tcp --dport 2203 -j DNAT --to-destination 172.17.1.3:22
-A PREROUTING -s 77.78.95.12   -p tcp --dport 2203 -j DNAT --to-destination 172.17.1.3:22
#web - allow from all ips, github ci
-A PREROUTING  -p tcp --dport 2203 -j DNAT --to-destination 172.17.1.3:22
# mail
-A PREROUTING -s 78.157.163.74 -p tcp --dport 2204 -j DNAT --to-destination 172.17.1.4:22
-A PREROUTING -s 81.200.51.236 -p tcp --dport 2204 -j DNAT --to-destination 172.17.1.4:22
-A PREROUTING -s 77.78.95.12   -p tcp --dport 2204 -j DNAT --to-destination 172.17.1.4:22

# syncthing web
-A PREROUTING -p tcp --dport 8384 -j DNAT --to-destination 172.17.1.2:8384

# syncthing synchronization port
-A PREROUTING -p tcp --dport 22000 -j DNAT --to-destination 172.17.1.2:22000
-A PREROUTING -p udp --dport 21027 -j DNAT --to-destination 172.17.1.2:21027

# FTP on web server
-A PREROUTING -p tcp --dport 21 -j DNAT --to-destination 172.17.1.3:21
-A PREROUTING -p tcp --dport 20 -j DNAT --to-destination 172.17.1.3:20
-A PREROUTING -p tcp --dport 29000:29100 -j DNAT --to-destination 172.17.1.3:29000-29100

# MAIL services on mail server
# imap
-A PREROUTING -p tcp -i venet0 --dport 143 -j DNAT --to-destination 172.17.1.4:143
-A PREROUTING -p tcp -i venet0 --dport 993 -j DNAT --to-destination 172.17.1.4:993
# smtp
-A PREROUTING -p tcp -i venet0 --dport 25 -j DNAT --to-destination 172.17.1.4:25
-A PREROUTING -p tcp -i venet0 --dport 465 -j DNAT --to-destination 172.17.1.4:465
-A PREROUTING -p tcp -i venet0 --dport 587 -j DNAT --to-destination 172.17.1.4:587

# temporary iperf to mail server
#-A PREROUTING -p tcp -i venet0 --dport 5001 -j DNAT --to-destination 172.17.1.3:5001

# temporary direct web test
#-A PREROUTING -p tcp -i venet0 --dport 80 -j DNAT --to-destination 172.17.1.3:80

COMMIT