Skip to content

Commit

Permalink
tenateive fix
Browse files Browse the repository at this point in the history
  • Loading branch information
nikolojedison committed Feb 6, 2018
1 parent 292b81b commit 8d8aad0
Showing 1 changed file with 61 additions and 61 deletions.
122 changes: 61 additions & 61 deletions nukem.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -109,40 +109,40 @@ $ipt -P INPUT DROP
$ipt -P FORWARD DROP
$ipt -P OUTPUT ACCEPT
$ipt -A INPUT -p udp -m multiport --dports 5060,5061 -m set --match-set fail2ban-ASTERISK src -j $ipt REJECT --reject-with icmp-port-unreachable
$ipt -A INPUT -p tyes | cp -i -m multiport --dports 5060,5061 -m set --match-set fail2ban-ASTERISK src -j REJECT --reject-with icmp-port-unreachable
$ipt -A INPUT -p tyes | cp -i -m multiport --dports 22 -j fail2ban-ssh
$ipt -A INPUT -p tcp -m multiport --dports 5060,5061 -m set --match-set fail2ban-ASTERISK src -j REJECT --reject-with icmp-port-unreachable
$ipt -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
$ipt -A INPUT -m set --match-set voip_bl src -j DROP
$ipt -A INPUT -i lo -j ACCEPT
$ipt -A INPUT -p udp -m udp --dport 10000:20000 -j ACCEPT
$ipt -A INPUT -p udp -m udp --dport 2727 -j ACCEPT
$ipt -A INPUT -p udp -m udp --dport 4569 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p udp -m udp --dport 5060:5061 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tyes | cp -i -m tyes | cp -i --dport 5060:5061 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tcp -m tcp --dport 5060:5061 -j ACCEPT
$ipt -A INPUT -s known_external_proxy -p udp -m udp --dport 5060:5061 -j ACCEPT
$ipt -A INPUT -p udp -m udp --dport 5060:5061 -m string --string "User-Agent: VaxSIPUserAgent" --algo bm --to 65535 -j DROP
$ipt -A INPUT -p udp -m udp --dport 5060:5061 -m string --string "User-Agent: friendly-scanner" --algo bm --to 65535 -j REJECT --reject-with icmp-port-unreachable
$ipt -A INPUT -p udp -m udp --dport 5060:5061 -m string --string "REGISTER sip:" --algo bm --to 65535 -m recent --set --name VOIP --rsource
$ipt -A INPUT -p udp -m udp --dport 5060:5061 -m string --string "REGISTER sip:" --algo bm --to 65535 -m recent --update --seconds 60 --hitcount 12 --rttl --name VOIP --mask 255.255.255.255 --rsource -j DROP
$ipt -A INPUT -p udp -m udp --dport 5060:5061 -m string --string "INVITE sip:" --algo bm --to 65535 -m recent --set --name VOIPINV --rsource
$ipt -A INPUT -p udp -m udp --dport 5060:5061 -m string --string "INVITE sip:" --algo bm --to 65535 -m recent --update --seconds 60 --hitcount 12 --rttl --name VOIPINV --mask 255.255.255.255 --rsource -j DROP
$ipt -A INPUT -p tyes | cp -i -m tyes | cp -i --dport 5060:5061 -m hashlimit --hashlimit-upto 6/sec --hashlimit-burst 5 --hashlimit-mode srcip,dstport --hashlimit-name tunnel_limit -j ACCEPT
$ipt -A INPUT -p tcp -m tcp --dport 5060:5061 -m hashlimit --hashlimit-upto 6/sec --hashlimit-burst 5 --hashlimit-mode srcip,dstport --hashlimit-name tunnel_limit -j ACCEPT
$ipt -A INPUT -p udp -m udp --dport 5060:5061 -m hashlimit --hashlimit-upto 6/sec --hashlimit-burst 5 --hashlimit-mode srcip,dstport --hashlimit-name tunnel_limit -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p icmp -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tyes | cp -i -m tyes | cp -i --dport 137 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tyes | cp -i -m tyes | cp -i --dport 138 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tyes | cp -i -m tyes | cp -i --dport 139 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tyes | cp -i -m tyes | cp -i --dport 445 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tyes | cp -i -m tyes | cp -i --dport 10000 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tyes | cp -i -m tyes | cp -i --dport 22 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tyes | cp -i -m tyes | cp -i --dport 123 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tcp -m tcp --dport 137 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tcp -m tcp --dport 138 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tcp -m tcp --dport 139 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tcp -m tcp --dport 445 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tcp -m tcp --dport 10000 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tcp -m tcp --dport 22 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tcp -m tcp --dport 123 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p udp -m udp --dport 123 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tyes | cp -i -m tyes | cp -i --dport 5038 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tyes | cp -i -m tyes | cp -i --dport 58080 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tyes | cp -i -m tyes | cp -i --dport 55050 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i -m tyes | cp -i --dport 80 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i -m tyes | cp -i --dport 443 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tcp -m tcp --dport 5038 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tcp -m tcp --dport 58080 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tcp -m tcp --dport 55050 -j ACCEPT
$ipt -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
$ipt -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
$ipt -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tyes | cp -i -m tyes | cp -i --dport 514 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p tcp -m tcp --dport 514 -j ACCEPT
$ipt -A INPUT -s xxx.xxx.xxx.xxx/24 -p udp -m udp --dport 514 -j ACCEPT
$ipt -A INPUT -j DROP
$ipt -A OUTPUT -j ACCEPT
Expand All @@ -162,9 +162,9 @@ echo "Firewall reset, adding Ubuntu rules..."
$ipt -P INPUT DROP
$ipt -P FORWARD DROP
$ipt -P OUTPUT ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 22 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 53 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 3306 -j ACCEPT
$ipt -A INPUT -p tcp --dport 22 -j ACCEPT
$ipt -A INPUT -p tcp --dport 53 -j ACCEPT
$ipt -A INPUT -p tcp --dport 3306 -j ACCEPT

echo "Updating sources.list..."
yes | cp -i /etc/apt/sources.list /etc/apt/sources.list.bak
Expand Down Expand Up @@ -218,26 +218,26 @@ echo "Firewall reset, adding Debian rules..."
$ipt -P INPUT DROP
$ipt -P FORWARD DROP
$ipt -P OUTPUT ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 139 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 57193 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 57194 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 389 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 52949 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 3306 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 34891 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 80 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 445 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 143 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 25 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 110 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 123 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 514 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 587 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 636 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 993 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 995 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 1433 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 1434 -j ACCEPT
$ipt -A INPUT -p tcp --dport 139 -j ACCEPT
$ipt -A INPUT -p tcp --dport 57193 -j ACCEPT
$ipt -A INPUT -p tcp --dport 57194 -j ACCEPT
$ipt -A INPUT -p tcp --dport 389 -j ACCEPT
$ipt -A INPUT -p tcp --dport 52949 -j ACCEPT
$ipt -A INPUT -p tcp --dport 3306 -j ACCEPT
$ipt -A INPUT -p tcp --dport 34891 -j ACCEPT
$ipt -A INPUT -p tcp --dport 80 -j ACCEPT
$ipt -A INPUT -p tcp --dport 445 -j ACCEPT
$ipt -A INPUT -p tcp --dport 143 -j ACCEPT
$ipt -A INPUT -p tcp --dport 25 -j ACCEPT
$ipt -A INPUT -p tcp --dport 110 -j ACCEPT
$ipt -A INPUT -p tcp --dport 123 -j ACCEPT
$ipt -A INPUT -p tcp --dport 514 -j ACCEPT
$ipt -A INPUT -p tcp --dport 587 -j ACCEPT
$ipt -A INPUT -p tcp --dport 636 -j ACCEPT
$ipt -A INPUT -p tcp --dport 993 -j ACCEPT
$ipt -A INPUT -p tcp --dport 995 -j ACCEPT
$ipt -A INPUT -p tcp --dport 1433 -j ACCEPT
$ipt -A INPUT -p tcp --dport 1434 -j ACCEPT

echo "Updating sources.list..."
yes | cp -i /etc/apt/sources.list /etc/apt/sources.list-bak
Expand All @@ -248,7 +248,6 @@ passwd -l sync
passwd -l games
passwd -l lp
passwd -l news
passwd -l uuyes | cp -i
passwd -l proxy
passwd -l www-data
passwd -l backup
Expand Down Expand Up @@ -280,26 +279,27 @@ yes | cp -i deb-rsyslog.conf /etc/rsyslog.conf
elif [ $answer1 = "3" ]; then
yes | rm -i /etc/bashrc
yes | rm -i /root/.bashrc

echo "Firewall reset, adding CentOS rules..."

PUB_IF="eth0"
SPAMLIST="blockedip"
SPAMDROPMSG="BLOCKED IP DROP"

$ipt -A INPUT -i ${PUB_IF} -p tyes | cp -i ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Drop Sync"
$ipt -A INPUT -i ${PUB_IF} -p tyes | cp -i ! --syn -m state --state NEW -j DROP
$ipt -A INPUT -i ${PUB_IF} -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Drop Sync"
$ipt -A INPUT -i ${PUB_IF} -p tcp ! --syn -m state --state NEW -j DROP
$ipt -A INPUT -i ${PUB_IF} -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Fragments Packets"
$ipt -A INPUT -i ${PUB_IF} -f -j DROP
$ipt -A INPUT -i ${PUB_IF} -p tyes | cp -i --tyes | cp -i-flags ALL FIN,URG,PSH -j DROP
$ipt -A INPUT -i ${PUB_IF} -p tyes | cp -i --tyes | cp -i-flags ALL ALL -j DROP
$ipt -A INPUT -i ${PUB_IF} -p tyes | cp -i --tyes | cp -i-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "NULL Packets"
$ipt -A INPUT -i ${PUB_IF} -p tyes | cp -i --tyes | cp -i-flags ALL NONE -j DROP # NULL packets
$ipt -A INPUT -i ${PUB_IF} -p tyes | cp -i --tyes | cp -i-flags SYN,RST SYN,RST -j DROP
$ipt -A INPUT -i ${PUB_IF} -p tyes | cp -i --tyes | cp -i-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "XMAS Packets"
$ipt -A INPUT -i ${PUB_IF} -p tyes | cp -i --tyes | cp -i-flags SYN,FIN SYN,FIN -j DROP #XMAS
$ipt -A INPUT -i ${PUB_IF} -p tyes | cp -i --tyes | cp -i-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Fin Packets Scan"
$ipt -A INPUT -i ${PUB_IF} -p tyes | cp -i --tyes | cp -i-flags FIN,ACK FIN -j DROP # FIN packet scans
$ipt -A INPUT -i ${PUB_IF} -p tyes | cp -i --tyes | cp -i-flags ALL SYN,RST,ACK,FIN,URG -j DROP
$ipt -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
$ipt -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL ALL -j DROP
$ipt -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "NULL Packets"
$ipt -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL NONE -j DROP # NULL packets
$ipt -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$ipt -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "XMAS Packets"
$ipt -A INPUT -i ${PUB_IF} -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS
$ipt -A INPUT -i ${PUB_IF} -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Fin Packets Scan"
$ipt -A INPUT -i ${PUB_IF} -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans
$ipt -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
$ipt -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
$ipt -A OUTPUT -o eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$ipt -A INPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
Expand All @@ -308,18 +308,18 @@ $ipt -A OUTPUT -p icmp --icmp-type 0 -m state --state ESTABLISHED,RELATED -j ACC
## ADD YOUR RULES BELOW

# Allow ssh only within network
$ipt -A INPUT -p tyes | cp -i --dport 22 -s 172.20.0.0/16 -m state --state NEW,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT -p tyes | cp -i --sport 22 -d 172.20.0.0/16 -m state --state ESTABLISHED -j ACCEPT
$ipt -A INPUT -p tcp --dport 22 -s 172.20.0.0/16 -m state --state NEW,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT -p tcp --sport 22 -d 172.20.0.0/16 -m state --state ESTABLISHED -j ACCEPT

# Allow http/https in/output
$ipt -A INPUT -p tyes | cp -i --destination-port 80 -j ACCEPT
$ipt -A OUTPUT -p tyes | cp -i --dport 80 -j ACCEPT
$ipt -A INPUT -p tyes | cp -i --dport 443 -j ACCEPT
$ipt -A OUTPUT -p tyes | cp -i --dport 443 -j ACCEPT
$ipt -A INPUT -p tcp --destination-port 80 -j ACCEPT
$ipt -A OUTPUT -p tcp --dport 80 -j ACCEPT
$ipt -A INPUT -p tcp --dport 443 -j ACCEPT
$ipt -A OUTPUT -p tcp --dport 443 -j ACCEPT

# Limit connection limits. Prevent dos attacks.
$ipt -I INPUT -p tyes | cp -i --dport 80 -m connlimit --connlimit-above 20 --connlimit-mask 32 -j DROP
$ipt -I INPUT -p tyes | cp -i --dport 443 -m connlimit --connlimit-above 20 --connlimit-mask 32 -j DROP
$ipt -I INPUT -p tcp --dport 80 -m connlimit --connlimit-above 20 --connlimit-mask 32 -j DROP
$ipt -I INPUT -p tcp --dport 443 -m connlimit --connlimit-above 20 --connlimit-mask 32 -j DROP

# Log input and logs and drop all others.
$ipt -A INPUT -j LOG
Expand Down

0 comments on commit 8d8aad0

Please sign in to comment.