e-router/e-router

#!/bin/bash -x
((EUID == 0 )) || { echo "Need root"; exit 1; }
set -euo pipefail
confd=/etc/e-router
source $confd/config

_broken(){
    ${iptables} -N BROKENLOGDROP
    if $logbroken; then
        ${iptables} -A BROKENLOGDROP -j LOG --log-prefix "BROKENLOGDROP TCP: " --log-level 7
    fi
    ${iptables} -A BROKENLOGDROP -j ENDRESET

    ${iptables} -N STRANGELOG
    if $logstrange; then
        ${iptables} -A STRANGELOG -j LOG --log-prefix "STRANGELOG TCP: " --log-level 7
    fi

    ${iptables} -N FWSUSPICIOUS

    ${iptables} -A FWSUSPICIOUS -p tcp --sport 0:19                                                           -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --dport 0:19                                                           -j BROKENLOGDROP

    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     ACK             -m conntrack --ctstate ESTABLISHED -j RETURN
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     ACK             -m conntrack --ctstate NEW,RELATED -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     PSH,ACK         -m conntrack --ctstate ESTABLISHED -j RETURN
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     PSH,ACK         -m conntrack --ctstate NEW         -j RETURN
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     PSH,ACK         -m conntrack --ctstate RELATED     -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     NONE                                               -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     ALL                                                -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags SYN,FIN SYN,FIN                                            -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags SYN,RST SYN,RST                                            -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags RST,FIN RST,FIN                                            -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags SYN,URG SYN,URG                                            -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     SYN,PSH                                            -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     SYN,ACK,PSH                                        -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ACK,FIN FIN                                                -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ACK,PSH PSH                                                -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ACK,URG URG                                                -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     RST             -m conntrack --ctstate ESTABLISHED -j RETURN
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     RST             -m conntrack --ctstate NEW,RELATED -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags SYN,ACK NONE                                               -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     SYN             -m conntrack --ctstate NEW         -j RETURN
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     SYN             -m conntrack --ctstate RELATED     -j RETURN
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     SYN             -m conntrack --ctstate ESTABLISHED -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     SYN,ACK         -m conntrack --ctstate ESTABLISHED -j RETURN
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     SYN,ACK         -m conntrack --ctstate NEW,RELATED -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     FIN,ACK         -m conntrack --ctstate ESTABLISHED -j RETURN
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     FIN,ACK         -m conntrack --ctstate NEW,RELATED -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     RST,ACK         -m conntrack --ctstate ESTABLISHED -j RETURN
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     RST,ACK         -m conntrack --ctstate NEW         -j RETURN
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     RST,ACK         -m conntrack --ctstate RELATED     -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     ACK,PSH,RST     -m conntrack --ctstate ESTABLISHED -j RETURN
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     ACK,PSH,RST     -m conntrack --ctstate NEW,RELATED -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     FIN,PSH,ACK     -m conntrack --ctstate ESTABLISHED -j RETURN
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     FIN,PSH,ACK     -m conntrack --ctstate NEW,RELATED -j BROKENLOGDROP
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     RST,ACK,PSH                                        -j STRANGELOG
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     RST,ACK,URG                                        -j STRANGELOG
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     RST,ACK,PSH,URG                                    -j STRANGELOG
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     FIN,PSH,ACK,URG                                    -j STRANGELOG
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     ACK,URG                                            -j STRANGELOG
    ${iptables} -A FWSUSPICIOUS -p tcp --tcp-flags ALL     ACK,URG,FIN                                        -j STRANGELOG
}

_droplog() {
    ${iptables} -N ${1}LOGDROP
    if $debugtcp; then
        ${iptables} -A ${1}LOGDROP -p tcp  -j LOG --log-prefix "${1}LOGDROP TCP: " --log-level 7
    fi
    if $debugudp; then
        ${iptables} -A ${1}LOGDROP -p udp  -j LOG --log-prefix "${1}LOGDROP UDP: " --log-level 7
    fi
    if $debugicmp; then
        ${iptables} -A ${1}LOGDROP -p icmp -j LOG --log-prefix "${1}LOGDROP ICMP: " --log-level 7
    fi
}

_forward() {
    while read -r ip public private ; do
        [[ "$ip" =~ ^[0-9]{1,}.[0-9]{1,}.[0-9]{1,}.[0-9]{1,}$ ]] || continue
        [[ "$public" =~ ^[0-9]{1,}|[0-9]{1,}:[0-9]{1,}$ ]] || continue
        [[ "$private" =~ ^[0-9]{1,}|[0-9]{1,}:[0-9]{1,}$ ]] || continue
        if [[ "$public" =~ ^[0-9]{1,}$ ]] ; then
            ${iptables} -A PREROUTING -t nat -i ${wan} -p tcp --dport ${public} -j DNAT --to ${ip}:${private}
            ${iptables} -A FORWARD -i ${wan} -p tcp --syn -d ${ip} --dport ${private} -m conntrack --ctstate NEW --ctproto TCP -j ACCEPT
        else
            ${iptables} -A PREROUTING -t nat -i ${wan} -p tcp --dport ${public} -j DNAT --to ${ip}
            ${iptables} -A FORWARD -i ${wan} -p tcp --syn -d ${ip} --dport ${public} -m conntrack --ctstate NEW --ctproto TCP -j ACCEPT
        fi
    done < $confd/FORWARD.tcp

    while read -r ip public private ; do
        [[ "$ip" =~ ^[0-9]{1,}.[0-9]{1,}.[0-9]{1,}.[0-9]{1,}$ ]] || continue
        [[ "$public" =~ ^[0-9]{1,}|[0-9]{1,}:[0-9]{1,}$ ]] || continue
        [[ "$private" =~ ^[0-9]{1,}|[0-9]{1,}:[0-9]{1,}$ ]] || continue
        if [[ "$public" =~ ^[0-9]{1,}$ ]] ; then
            ${iptables} -A PREROUTING -t nat -i ${wan} -p udp --dport ${public} -j DNAT --to ${ip}:${private}
            ${iptables} -A FORWARD -i ${wan} -p udp -d ${ip} --dport ${private} -m conntrack --ctstate NEW --ctproto UDP -j ACCEPT
        else
            ${iptables} -A PREROUTING -t nat -i ${wan} -p udp --dport ${public} -j DNAT --to ${ip}
            ${iptables} -A FORWARD -i ${wan} -p udp -d ${ip} --dport ${public} -m conntrack --ctstate NEW --ctproto UDP -j ACCEPT
        fi
    done < $confd/FORWARD.udp

    if $logforward ; then
        ${iptables} -A FORWARD -j FORWARDLOGDROP
    fi
}

_init(){
    /usr/lib/systemd/scripts/iptables-flush
    ${iptables} -P INPUT DROP
    ${iptables} -P FORWARD DROP
    ${iptables} -P OUTPUT ACCEPT
    ${iptables} -N ENDRESET
    ${iptables} -A ENDRESET -p tcp -j REJECT --reject-with tcp-reset
    ${iptables} -A ENDRESET -p udp -j REJECT --reject-with icmp-port-unreachable
    ${iptables} -A ENDRESET -j REJECT --reject-with icmp-proto-unreachable
}

_whitenets() {
    ipset create -! $whiteset hash:net hashsize 4096 timeout $whitettl maxelem $whitemaxelems
    while read -r net ; do
        [[ "$net" =~ ^[0-9]{1,}.[0-9]{1,}.[0-9]{1,}.[0-9]{1,}/[0-9]{1,}$ ]] || continue
        ipset -! add  $whiteset $net timeout 0
    done < $confd/WHITE.nets
}

base() {
    _init
    ${iptables} -A INPUT -i lo -j ACCEPT
    if $logbroken; then
        _broken
        ${iptables} -A INPUT -i ${wan} -p tcp -j FWSUSPICIOUS
    fi
    ${iptables} -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    if $loginvalid; then
        _droplog "INVALID"
        ${iptables} -A INPUT -m conntrack --ctstate INVALID -j INVALIDLOGDROP
    fi
    ${iptables} -A INPUT -m conntrack --ctstate INVALID -j DROP
}

cast() {
    ${iptables} -N FWCAST
    if $logcast; then
        ${iptables} -A FWCAST -m pkttype --pkt-type multicast -m conntrack --ctstate NEW  -j LOG --log-prefix "CASTLOG MULTI: " --log-level 7
        ${iptables} -A FWCAST -m pkttype --pkt-type broadcast -m conntrack --ctstate NEW  -j LOG --log-prefix "CASTLOG BROAD: " --log-level 7
    fi
    ${iptables} -A FWCAST -m pkttype --pkt-type multicast -m conntrack --ctstate NEW -j ACCEPT
    ${iptables} -A FWCAST -m pkttype --pkt-type broadcast -m conntrack --ctstate NEW -j ACCEPT
    ${iptables} -A INPUT -i ${wan} -j FWCAST
}

lan() {
    if $logforward ; then
        _droplog "FORWARD"
    fi
    ${iptables} -A INPUT -i ${eth0} -j ACCEPT
    ${iptables} -t nat -A POSTROUTING -o ${wan} -s ${locnet} -j MASQUERADE
    ${iptables} -A FORWARD -i ${eth0} -o ${wan} -j ACCEPT
    if $logbroken; then
        ${iptables} -A FORWARD -i ${wan} -p tcp -j FWSUSPICIOUS
    fi
    ${iptables} -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    if $loginvalid; then
        _droplog "FWDINVALID"
        ${iptables} -A FORWARD -m conntrack --ctstate INVALID -j FWDINVALIDLOGDROP
    fi
    ${iptables} -A FORWARD -m conntrack --ctstate INVALID -j  DROP
    _forward
}

badips() {
    ipset create -! $banset hash:ip hashsize 4096 timeout $banttl  maxelem $badmaxelems
    ${iptables} -N FWBAD
    if $logbad ; then
        _droplog "BAD"
        ${iptables} -A FWBAD -i ${wan} -p udp -m set --match-set $banset src -m conntrack --ctstate NEW --ctproto UDP -j BADLOGDROP
        ${iptables} -A FWBAD -i ${wan} -p tcp -m set --match-set $banset src -m conntrack --ctstate NEW --ctproto TCP -j BADLOGDROP
    fi
    ${iptables} -A FWBAD -i ${wan} -p udp -m set --match-set $banset src -m conntrack --ctstate NEW --ctproto UDP -j ENDRESET
    ${iptables} -A FWBAD -i ${wan} -p tcp -m set --match-set $banset src -m conntrack --ctstate NEW --ctproto TCP -j ENDRESET
    ${iptables} -A INPUT -j FWBAD
}

scanips() {
    ipset create -! $scanset hash:ip hashsize 4096 timeout $scanttl maxelem $scanmaxelems forceadd
    ${iptables} -N FWSCAN
    ${iptables} -A FWSCAN -i ${wan} -p udp -j SET --add-set $scanset src --exist --timeout $scanttl
    ${iptables} -A FWSCAN -i ${wan} -p tcp -j SET --add-set $scanset src --exist --timeout $scanttl
    if $logscan ; then
        _droplog "SCAN"
        ${iptables} -A FWSCAN -i ${wan} -p udp -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto UDP -j SCANLOGDROP
        ${iptables} -A FWSCAN -i ${wan} -p tcp -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto TCP -j SCANLOGDROP
    fi
    ${iptables} -A FWSCAN -i ${wan} -p udp -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto UDP -j ENDRESET
    ${iptables} -A FWSCAN -i ${wan} -p tcp -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto TCP -j ENDRESET
    ${iptables} -A BROKENLOGDROP -j FWSCAN
    ${iptables} -D BROKENLOGDROP -j ENDRESET
    ${iptables} -A BROKENLOGDROP -j ENDRESET
    ${iptables} -A INPUT -j FWSCAN
}

white() {
    _whitenets
    ${iptables} -N FWFILTERED
    while read -r port ; do
        [[ "$port" =~ ^[0-9]{1,}$ ]] || continue
        ${iptables} -A FWFILTERED -p udp -m conntrack --ctstate NEW --ctproto UDP --dport $port -j ACCEPT
    done < $confd/WHITE.udp
    while read -r port ; do
        [[ "$port" =~ ^[0-9]{1,}$ ]] || continue
        ${iptables} -A FWFILTERED -p tcp -m conntrack --ctstate NEW --ctproto TCP --dport $port -j ACCEPT
    done < $confd/WHITE.tcp
    ${iptables} -A INPUT -i ${wan} -p udp       -m set --match-set $whiteset src -m conntrack --ctstate NEW --ctproto UDP -j FWFILTERED
    ${iptables} -A INPUT -i ${wan} -p tcp --syn -m set --match-set $whiteset src -m conntrack --ctstate NEW --ctproto TCP -j FWFILTERED

    ${iptables} -A INPUT -i ${wan} -p icmp --icmp-type 8 -m set --match-set $whiteset src -m conntrack --ctstate NEW --ctproto ICMP -j ACCEPT
}

public() {
    ${iptables} -N FWPUBLIC
    while read -r port ; do
        [[ "$port" =~ ^[0-9]{1,}$ ]] || continue
        ${iptables} -A FWPUBLIC -p udp -m conntrack --ctstate NEW --ctproto UDP --dport $port -j ACCEPT
    done < $confd/PUBLIC.udp
    while read -r port ; do
        [[ "$port" =~ ^[0-9]{1,}$ ]] || continue
        ${iptables} -A FWPUBLIC -p tcp -m conntrack --ctstate NEW --ctproto TCP --dport $port -j ACCEPT
    done < $confd/PUBLIC.tcp
    ${iptables} -A INPUT -i ${wan} -p udp       -m conntrack --ctstate NEW --ctproto UDP -j FWPUBLIC
    ${iptables} -A INPUT -i ${wan} -p tcp --syn -m conntrack --ctstate NEW --ctproto TCP -j FWPUBLIC
}

final(){
    if $loginput; then
        _droplog "FINAL"
        ${iptables} -A INPUT -j FINALLOGDROP
    fi
    ${iptables} -A INPUT -i ${wan} -j ENDRESET
}

main () {
    for hook in "${hooks[@]}" ; do
        $hook
    done
}

main