bfw (2477B)
1 #!/bin/sh 2 # 3 # Bridge Firewall to restrict a malicious device. 4 # 5 6 PATH=/sbin:/bin 7 8 # Interfacd to the malicious device. 9 INIF="in0" 10 # Interface to the outside network. 11 OUTIF="out0" 12 13 BRIF="br0" 14 ALLOWEDHOSTS="/etc/bfw.allowed.conf" 15 BLOCKEDHOSTS="/etc/bfw.blocked.conf" 16 17 do_start() { 18 iptables -F FORWARD 19 iptables -P FORWARD DROP 20 21 # enable connection tracking 22 iptables -I FORWARD -s 0.0.0.0/0.0.0.0 \ 23 -d 0.0.0.0/0.0.0.0 -m state --state INVALID -j DROP 24 iptables -I FORWARD -m state --state RELATED,ESTABLISHED \ 25 -j ACCEPT 26 27 # fun 28 # iptables -A FORWARD -p icmp -m limit --limt 4/s -j ACCEPT 29 # iptables -I FORWARD -j DROP -p tcp -s 0.0.0.0/0 \ 30 # -m string --string "cmd.exe" 31 32 # allow ICMP 33 iptables -A FORWARD -p icmp -j ACCEPT 34 35 # allow DNS 36 iptables -A FORWARD -p udp --dport 53 -j ACCEPT 37 38 # allow local network 39 iptables -A FORWARD -s 192.168.0.0/255.255.0.0 \ 40 -d 192.168.0.0/255.255.0.0 -j ACCEPT 41 42 # blocked hosts 43 [ -e "$BLOCKEDHOSTS" ] && { 44 cat "$BLOCKEDHOSTS" \ 45 | while read -r line; 46 do 47 [ -z "$line" ] && continue 48 49 case "$line" in 50 \#*) 51 ;; 52 *) 53 iptables -A FORWARD \ 54 -s 192.168.0.0/255.255.0.0 \ 55 -d $line \ 56 -j LOG \ 57 --log-prefix \ 58 "FORWARD(${INIF}) rule blocked:" 59 iptables -A FORWARD \ 60 -s 192.168.0.0/255.255.0.0 \ 61 -d $line \ 62 -j DROP 63 64 iptables -A FORWARD \ 65 -d 192.168.0.0/255.255.0.0 \ 66 -s $line \ 67 -j LOG \ 68 --log-prefix \ 69 "FORWARD(${INIF}) rule blocked:" 70 iptables -A FORWARD \ 71 -d 192.168.0.0/255.255.0.0 \ 72 -s $line \ 73 -j DROP 74 ;; 75 esac 76 done 77 } 78 79 # allowed hosts 80 [ -e "$ALLOWEDHOSTS" ] && { 81 cat "$ALLOWEDHOSTS" \ 82 | while read -r line; 83 do 84 [ -z "$line" ] && continue 85 86 case "$line" in 87 \#*) 88 ;; 89 *) 90 iptables -A FORWARD \ 91 -s 192.168.0.0/255.255.0.0 \ 92 -d $line \ 93 -j ACCEPT 94 iptables -A FORWARD \ 95 -d 192.168.0.0/255.255.0.0 \ 96 -s $line \ 97 -j ACCEPT 98 ;; 99 esac 100 done 101 } 102 103 # log all remaining rejects 104 iptables -A FORWARD -j LOG \ 105 --log-prefix "FORWARD(${INIF}) blocked:" 106 # reject everything else coming from the malicious device 107 iptables -A FORWARD -j REJECT 108 } 109 110 do_unload() { 111 iptables -F FORWARD 112 iptables -P FORWARD ACCEPT 113 } 114 115 usage() { 116 printf "usage: %s [start|stop|reload]\n" "$(basename "$1")" >&2 117 exit 1 118 } 119 120 if [ $# -lt 1 ]; 121 then 122 usage $0 123 fi 124 125 cmd="$1" 126 case "$cmd" in 127 start) 128 do_start 129 ;; 130 reload|restart) 131 do_unload 132 do_start 133 ;; 134 stop) 135 do_unload 136 ;; 137 *) 138 usage $0 139 ;; 140 esac 141 142