bfw - bfw - simple Bridge FireWall
(HTM) git clone git://r-36.net/bfw
(DIR) Log
(DIR) Files
(DIR) Refs
(DIR) README
(DIR) LICENSE
---
bfw (2477B)
---
1 #!/bin/sh
2 #
3 # Bridge Firewall to restrict a malicious device.
4 #
5
6 PATH=/sbin:/bin
7
8 # Interfacd to the malicious device.
9 INIF="in0"
10 # Interface to the outside network.
11 OUTIF="out0"
12
13 BRIF="br0"
14 ALLOWEDHOSTS="/etc/bfw.allowed.conf"
15 BLOCKEDHOSTS="/etc/bfw.blocked.conf"
16
17 do_start() {
18 iptables -F FORWARD
19 iptables -P FORWARD DROP
20
21 # enable connection tracking
22 iptables -I FORWARD -s 0.0.0.0/0.0.0.0 \
23 -d 0.0.0.0/0.0.0.0 -m state --state INVALID -j DROP
24 iptables -I FORWARD -m state --state RELATED,ESTABLISHED \
25 -j ACCEPT
26
27 # fun
28 # iptables -A FORWARD -p icmp -m limit --limt 4/s -j ACCEPT
29 # iptables -I FORWARD -j DROP -p tcp -s 0.0.0.0/0 \
30 # -m string --string "cmd.exe"
31
32 # allow ICMP
33 iptables -A FORWARD -p icmp -j ACCEPT
34
35 # allow DNS
36 iptables -A FORWARD -p udp --dport 53 -j ACCEPT
37
38 # allow local network
39 iptables -A FORWARD -s 192.168.0.0/255.255.0.0 \
40 -d 192.168.0.0/255.255.0.0 -j ACCEPT
41
42 # blocked hosts
43 [ -e "$BLOCKEDHOSTS" ] && {
44 cat "$BLOCKEDHOSTS" \
45 | while read -r line;
46 do
47 [ -z "$line" ] && continue
48
49 case "$line" in
50 \#*)
51 ;;
52 *)
53 iptables -A FORWARD \
54 -s 192.168.0.0/255.255.0.0 \
55 -d $line \
56 -j LOG \
57 --log-prefix \
58 "FORWARD(${INIF}) rule blocked:"
59 iptables -A FORWARD \
60 -s 192.168.0.0/255.255.0.0 \
61 -d $line \
62 -j DROP
63
64 iptables -A FORWARD \
65 -d 192.168.0.0/255.255.0.0 \
66 -s $line \
67 -j LOG \
68 --log-prefix \
69 "FORWARD(${INIF}) rule blocked:"
70 iptables -A FORWARD \
71 -d 192.168.0.0/255.255.0.0 \
72 -s $line \
73 -j DROP
74 ;;
75 esac
76 done
77 }
78
79 # allowed hosts
80 [ -e "$ALLOWEDHOSTS" ] && {
81 cat "$ALLOWEDHOSTS" \
82 | while read -r line;
83 do
84 [ -z "$line" ] && continue
85
86 case "$line" in
87 \#*)
88 ;;
89 *)
90 iptables -A FORWARD \
91 -s 192.168.0.0/255.255.0.0 \
92 -d $line \
93 -j ACCEPT
94 iptables -A FORWARD \
95 -d 192.168.0.0/255.255.0.0 \
96 -s $line \
97 -j ACCEPT
98 ;;
99 esac
100 done
101 }
102
103 # log all remaining rejects
104 iptables -A FORWARD -j LOG \
105 --log-prefix "FORWARD(${INIF}) blocked:"
106 # reject everything else coming from the malicious device
107 iptables -A FORWARD -j REJECT
108 }
109
110 do_unload() {
111 iptables -F FORWARD
112 iptables -P FORWARD ACCEPT
113 }
114
115 usage() {
116 printf "usage: %s [start|stop|reload]\n" "$(basename "$1")" >&2
117 exit 1
118 }
119
120 if [ $# -lt 1 ];
121 then
122 usage $0
123 fi
124
125 cmd="$1"
126 case "$cmd" in
127 start)
128 do_start
129 ;;
130 reload|restart)
131 do_unload
132 do_start
133 ;;
134 stop)
135 do_unload
136 ;;
137 *)
138 usage $0
139 ;;
140 esac
141
142