Public domain
#!/bin/bash
#Refrence : https://wiki.archlinux.org/index.php/simple_stateful_firewall#Example_iptables.rules_file
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd | sed -e "s/\/[^\/]*$//" )"
ipsFileAddress=$DIR"/modules/users/server/ipFilter/ips.txt"
firewallFileAddress=$DIR"/modules/users/server/ipFilter/firewall.txt"
SHELL=/bin/sh PATH=/bin:/sbin:/usr/bin:/usr/sbin
function valid_ip()
{
local ip=$1
local stat=1
if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
OIFS=$IFS
IFS='.'
ip=($ip)
IFS=$OIFS
[[ ${ip[0]} -le 255 && ${ip[1]} -le 255 \
&& ${ip[2]} -le 255 && ${ip[3]} -le 255 ]]
stat=$?
fi
if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/[1-9]{2}$ ]]; then
OIFS=$IFS
IFS='/'
subnet=($ip)
IFS='.'
ip=(${subnet[0]})
IFS=$OIFS
[[ ${ip[0]} -le 255 && ${ip[1]} -le 255 \
&& ${ip[2]} -le 255 && ${ip[3]} -le 255 && ${subnet[1]} -le 32 ]]
stat=$?
fi
return $stat
}
start() {
if [ -f "$ipsFileAddress" ]
then
stop
echo "$ipsFileAddress"
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -N TCP
iptables -N UDP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
#allow to connect from ssh to this compueter from every where
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --sport 22 -j ACCEPT
while IFS= read ip
do
if valid_ip $ip;then
stat='opend in firewall';
iptables -A INPUT -p tcp -s $ip --dport 80 -j ACCEPT
else
stat='bad ip format';
fi
printf "%-20s: %s\n" "$ip" "$stat"
done <"$ipsFileAddress"
#Allow to view all website from this computer
iptables -A INPUT -p tcp --sport 80 -j ACCEPT
iptables -A INPUT -p tcp --sport 443 -j ACCEPT
iptables -A INPUT -p udp --sport 53 -j ACCEPT
#echo "==============================================="
#echo "after firewall ran, the state of firewall is : "
#iptables -nvL --line-numbers
fi
}
stop() {
echo "clear and stop all firewall rules";
iptables -t filter -F
iptables -t filter -X
iptables -t filter -Z
iptables -t filter -P INPUT ACCEPT
iptables -t filter -P OUTPUT ACCEPT
iptables -t filter -P FORWARD ACCEPT
}
watch() {
if [ -f "$firewallFileAddress" ]
then
start
rm $firewallFileAddress
fi
}
case "$1" in
start)
start
;;
watch)
watch
;;
stop)
stop
;;
*)
echo $"Usage: sinic_firewall {start|watch|stop}"
exit 1
esac
#!/usr/bin/env bash
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
OS="$(cat /etc/issue)"
OSVERSION="$(cat /etc/os-release | grep VERSION_ID | sed 's/VERSION_ID="//g' | sed 's/"//g')"
echo "Welcome to Installer, Your OS is : " $OS
echo "Warning : If you are using ubuntu please pay attention to that version, if your version is lower than 15.04 your system use UpStart else it uses SystemD"
echo $OSVERSION
echo -n "Enter your startup system [upstart|systemd] :"
read STARTUPSYSTEM
read -d '' SYSTEMD <<- EOF
***********************************************************************************
********************************* crontab section *********************************
***********************************************************************************
Please write below line to root's crontab
* * * * * $DIR/sinic_firewall.sh watch
***********************************************************************************
***************************** start up script section *****************************
***********************************************************************************
Please write below lines in /etc/systemd/system/sinicFirewall.service
and then please enter this command in root console:
systemctl start sinicFirewall.service
systemctl enable sinicFirewall.service
************************************************************************************
***************************** this is the file content *****************************
************************************************************************************
[Unit]
Description=Sinic Firewall service
After=network.target
[Service]
User=root
Group=root
ExecStart=$DIR/sinic_firewall.sh start
[Install]
WantedBy=multi-user.target
EOF
read -d '' UPSTART <<- EOF
***********************************************************************************
********************************* crontab section *********************************
***********************************************************************************
Please write below line to root's crontab
* * * * * $DIR/sinic_firewall.sh watch
***********************************************************************************
***************************** start up script section *****************************
***********************************************************************************
Please write below lines in /etc/init/sinicFirewall.conf
and then please enter this command in root console:
service testjob start sinicFirewall
************************************************************************************
***************************** this is the file content *****************************
************************************************************************************
description "Sinic Firewall service"
author "Farid Ahmadian"
start on filesystem or runlevel [2345]
stop on shutdown
script
export HOME="/srv"
exec $DIR/sinic_firewall.sh start
end script
pre-start script
echo "$ (date) Sinic Firewall Starting" >> /var/log/sinic_firewall.log
end script
pre-stop script
echo "$ (date) Sinic Firewall Starting" >> /var/log/sinic_firewall.log
end script
EOF
if [ $STARTUPSYSTEM == "systemd" ]
then
echo "$SYSTEMD"
else
echo "$UPSTART"
fi
BY: Farid Ahmadian
TAG: firewall, iptables, bash-script, ubuntu, bash, upstart, systemd
DATE: 2016-07-11 21:40:51
With many thanks and best wishes for dear Pejman Moghadam, someone who taught me alot in linux and life :)