e-router/e-router

#!/bin/bash -x
((EUID == 0 )) || { echo "Need root"; exit 1; }
set -euo pipefail
confd=/etc/e-router
source $confd/config

base() {
    /usr/lib/systemd/scripts/iptables-flush
    ${iptables} -P INPUT DROP
    ${iptables} -P FORWARD DROP
    ${iptables} -P OUTPUT ACCEPT
    ${iptables} -A INPUT -i lo -j ACCEPT
    ${iptables} -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    ${iptables} -A INPUT -m conntrack --ctstate INVALID -j DROP
    ${iptables} -N END-RESET
    ${iptables} -A END-RESET -p tcp -j REJECT --reject-with tcp-reset
    ${iptables} -A END-RESET -p udp -j REJECT --reject-with icmp-port-unreachable
    ${iptables} -A END-RESET -j REJECT --reject-with icmp-proto-unreachable
}

final(){
    if $loginput; then
        droplog "FINAL" "INPUT"
    fi
}

droplog() {
    ${iptables} -N ${1}-LOG-DROP
    if $debugtcp; then
        ${iptables} -A ${1}-LOG-DROP -p tcp  -j LOG --log-prefix "${1}-LOG-DROP TCP: " --log-level 7
    fi
    if $debugudp; then
        ${iptables} -A ${1}-LOG-DROP -p udp  -j LOG --log-prefix "${1}-LOG-DROP UDP: " --log-level 7
    fi
    if $debugicmp; then
        ${iptables} -A ${1}-LOG-DROP -p icmp -j LOG --log-prefix "${1}-LOG-DROP ICMP: " --log-level 7
    fi
    ${iptables} -A ${2} -j ${1}-LOG-DROP
}

forward() {
    while read -r ip public private ; do
        [[ "$ip" =~ ^[0-9]{1,}.[0-9]{1,}.[0-9]{1,}.[0-9]{1,}$ ]] || continue
        [[ "$public" =~ ^[0-9]{1,}|[0-9]{1,}:[0-9]{1,}$ ]] || continue
        [[ "$private" =~ ^[0-9]{1,}|[0-9]{1,}:[0-9]{1,}$ ]] || continue
        if [[ "$public" =~ ^[0-9]{1,}$ ]] ; then
            ${iptables} -A PREROUTING -t nat -i ${wan} -p tcp --dport ${public} -j DNAT --to ${ip}:${private}
            ${iptables} -A FORWARD -i ${wan} -p tcp --syn -d ${ip} --dport ${private} -m conntrack --ctstate NEW --ctproto TCP -j ACCEPT
        else
            ${iptables} -A PREROUTING -t nat -i ${wan} -p tcp --dport ${public} -j DNAT --to ${ip}
            ${iptables} -A FORWARD -i ${wan} -p tcp --syn -d ${ip} --dport ${public} -m conntrack --ctstate NEW --ctproto TCP -j ACCEPT
        fi
    done < $confd/FORWARD.tcp

    while read -r ip public private ; do
        [[ "$ip" =~ ^[0-9]{1,}.[0-9]{1,}.[0-9]{1,}.[0-9]{1,}$ ]] || continue
        [[ "$public" =~ ^[0-9]{1,}|[0-9]{1,}:[0-9]{1,}$ ]] || continue
        [[ "$private" =~ ^[0-9]{1,}|[0-9]{1,}:[0-9]{1,}$ ]] || continue
        if [[ "$public" =~ ^[0-9]{1,}$ ]] ; then
            ${iptables} -A PREROUTING -t nat -i ${wan} -p udp --dport ${public} -j DNAT --to ${ip}:${private}
            ${iptables} -A FORWARD -i ${wan} -p udp -d ${ip} --dport ${private} -m conntrack --ctstate NEW --ctproto UDP -j ACCEPT
        else
            ${iptables} -A PREROUTING -t nat -i ${wan} -p udp --dport ${public} -j DNAT --to ${ip}
            ${iptables} -A FORWARD -i ${wan} -p udp -d ${ip} --dport ${public} -m conntrack --ctstate NEW --ctproto UDP -j ACCEPT
        fi
    done < $confd/FORWARD.udp

    if $logforward ; then
        droplog "FORWARD" "FORWARD"
    fi
    ${iptables} -A FORWARD -j END-RESET
}

lan() {
    ${iptables} -A INPUT -i ${eth0} -j ACCEPT
    ${iptables} -t nat -A POSTROUTING -o ${wan} -s ${locnet} -j MASQUERADE
    ${iptables} -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    ${iptables} -A FORWARD -i ${eth0} -o ${wan} -j ACCEPT
}

whitenets() {
    ipset create -! $whiteset hash:net hashsize 4096 timeout $whitettl maxelem $whitemaxelems
    while read -r net ; do
        [[ "$net" =~ ^[0-9]{1,}.[0-9]{1,}.[0-9]{1,}.[0-9]{1,}/[0-9]{1,}$ ]] || continue
        ipset -! add  $whiteset $net timeout 0
    done < $confd/WHITE.nets
}

badips() {
    ipset create -! $banset hash:ip hashsize 4096 timeout $banttl  maxelem $badmaxelems
    if $logbad ; then
        droplog "BAD" "INPUT"
    fi
    ${iptables} -A INPUT -i ${wan} -p udp -m set --match-set $banset src -m conntrack --ctstate NEW --ctproto UDP -j END-RESET
    ${iptables} -A INPUT -i ${wan} -p tcp --syn -m set --match-set $banset src -m conntrack --ctstate NEW --ctproto TCP -j END-RESET
}

scanips() {
    ipset create -! $scanset hash:ip hashsize 4096 timeout $scanttl maxelem $scanmaxelems
    ${iptables} -A INPUT -i ${wan} -p udp -m conntrack --ctstate NEW --ctproto UDP -j SET --add-set $scanset src --exist  --timeout $scanttl
    ${iptables} -A INPUT -i ${wan} -p tcp --syn -m conntrack --ctstate NEW --ctproto TCP -j SET --add-set $scanset src --exist  --timeout $scanttl
    if $logscan ; then
        droplog "SCAN" "INPUT"
    fi
    ${iptables} -A INPUT -i ${wan} -p udp -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto UDP -j END-RESET
    ${iptables} -A INPUT -i ${wan} -p tcp --syn -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto TCP -j END-RESET
}

white() {
    ${iptables} -N FW-FILTERED
    while read -r port ; do
        [[ "$port" =~ ^[0-9]{1,}$ ]] || continue
        ${iptables} -A FW-FILTERED -p udp -m conntrack --ctstate NEW --ctproto UDP --dport $port -j ACCEPT
    done < $confd/WHITE.udp
    while read -r port ; do
        [[ "$port" =~ ^[0-9]{1,}$ ]] || continue
        ${iptables} -A FW-FILTERED -p tcp -m conntrack --ctstate NEW --ctproto TCP --dport $port -j ACCEPT
    done < $confd/WHITE.tcp
    ${iptables} -A INPUT -i ${wan} -p udp -m set --match-set $whiteset src -m conntrack --ctstate NEW --ctproto UDP -j FW-FILTERED
    ${iptables} -A INPUT -i ${wan} -p tcp --syn -m set --match-set $whiteset src -m conntrack --ctstate NEW --ctproto TCP -j FW-FILTERED
    ${iptables} -A INPUT -i ${wan} -p icmp --icmp-type 8 -m set --match-set $whiteset src -m conntrack --ctstate NEW --ctproto ICMP -j ACCEPT
}

public() {
    ${iptables} -N FW-PUBLIC
    while read -r port ; do
        [[ "$port" =~ ^[0-9]{1,}$ ]] || continue
        ${iptables} -A FW-PUBLIC -p udp -m conntrack --ctstate NEW --ctproto UDP --dport $port -j ACCEPT
    done < $confd/PUBLIC.udp
    while read -r port ; do
        [[ "$port" =~ ^[0-9]{1,}$ ]] || continue
        ${iptables} -A FW-PUBLIC -p tcp -m conntrack --ctstate NEW --ctproto TCP --dport $port -j ACCEPT
    done < $confd/PUBLIC.tcp
    ${iptables} -A INPUT -i ${wan} -p udp -m conntrack --ctstate NEW --ctproto UDP -j FW-PUBLIC
    ${iptables} -A INPUT -i ${wan} -p tcp --syn -m conntrack --ctstate NEW --ctproto TCP -j FW-PUBLIC
}

cast() {
    ${iptables} -N FW-CAST
    if $logcast; then
        ${iptables} -A FW-CAST -m pkttype --pkt-type multicast -m conntrack --ctstate NEW  -j LOG --log-prefix "CAST-LOG MULTI: " --log-level 7
        ${iptables} -A FW-CAST -m pkttype --pkt-type broadcast -m conntrack --ctstate NEW  -j LOG --log-prefix "CAST-LOG BROAD: " --log-level 7
    fi
    ${iptables} -A FW-CAST -m pkttype --pkt-type multicast -m conntrack --ctstate NEW -j ACCEPT
    ${iptables} -A FW-CAST -m pkttype --pkt-type broadcast -m conntrack --ctstate NEW -j ACCEPT
    ${iptables} -A INPUT -i ${wan} -j FW-CAST
}

main () {
    for hook in "${hooks[@]}" ; do
        $hook
    done
}

main