AMINUL ISLAM SHAMIM

cat /usr/local/bin/shield-lockdown.fw

# Heres a bash script I made to stop SYN and other attacks on AVLS OXL-OLX server

#

#!/bin/bash

#

#PRINT= `ifconfig ens13 | fgrep -i inet | cut -d : -f 2 | cut -d \ -f 1`

#echo Primary Interface: $PRINT

#

#/sbin/modprobe ip_tables

#/sbin/modprobe ip_conntrack

/bin/rm -f /root/.dyn*

echo “Setting kernel tcp parameters to reduct DoS effects”

#Reduce DoS'ing ability by reducing timeouts

echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout # Default value 60

echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_time # Default value 7200

echo 1 > /proc/sys/net/ipv4/tcp_window_scaling # default is ON

echo 0 > /proc/sys/net/ipv4/tcp_sack # Default is ON

echo 1024 > /proc/sys/net/ipv4/tcp_max_syn_backlog # Default is 2048

# ANTISPOOFING

for a in /proc/sys/net/ipv4/conf/*/rp_filter;

do

echo 1 > $a

done

##

# NO SOURCE ROUTE

for z in /proc/sys/net/ipv4/conf/*/accept_source_route;

do

echo 0 > $z

done

echo “SYN COOKIES Settings”

#SYN COOKIES

echo 1 > /proc/sys/net/ipv4/tcp_syncookies

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

echo 1 > /proc/sys/net/ipv4/conf/all/accept_redirects

echo 1 > /proc/sys/net/ipv4/conf/all/log_martians

echo 3 > /proc/sys/net/ipv4/tcp_syn_retries ###default 5

echo 3 > /proc/sys/net/ipv4/tcp_synack_retries ###default 5

echo 1 > /proc/sys/net/ipv4/tcp_tw_recycle ### default disable

echo 1 > /proc/sys/net/ipv4/tcp_tw_reuse ### default disable

# NUMBER OF CONNECTIONS TO TRACK

echo “1048560” > /proc/sys/net/nf_conntrack_max

# Set default policies

#

IPTABLES=“/sbin/iptables”

#

$IPTABLES -P INPUT ACCEPT

$IPTABLES -P OUTPUT ACCEPT

$IPTABLES -P FORWARD DROP

#

$IPTABLES -F

$IPTABLES -F -t mangle

$IPTABLES -F -t raw

#

$IPTABLES -X

#

$IPTABLES -N syn-flood

#

# SYN-FLOOD RULES

$IPTABLES -A syn-flood -m limit –limit 1000/second –limit-burst 1250 -j RETURN

$IPTABLES -A syn-flood -j LOG –log-prefix “SYN flood: ”

$IPTABLES -A syn-flood -j DROP

#

$IPTABLES -A INPUT -i lo -j ACCEPT

$IPTABLES -A INPUT -d 127.0.0.0/8 -j REJECT

$IPTABLES -A INPUT -p tcp –tcp-flags SYN,ACK SYN,ACK -m state –state NEW -j REJECT –reject-with tcp-reset

$IPTABLES -A INPUT -p tcp ! –syn -m state –state NEW -j DROP

$IPTABLES -A INPUT -m state –state INVALID -j DROP

#######################

# Drop all Incoming malformed NULL packets:

#

$IPTABLES -A INPUT -p tcp –tcp-flags ALL NONE -j DROP

$IPTABLES -A INPUT -p tcp –tcp-flags ALL ALL -j DROP

#

echo “Port Scan protection is enabling…….”

#

# NMAP (Port SCAN Protection)

#

$IPTABLES -A FORWARD -p tcp -i ens13 -m state –state NEW -m recent –set

$IPTABLES -A FORWARD -p tcp -i ens13 -m state –state NEW -m recent –update –seconds 30 –hitcount 10 -j DROP

#######################

# For mangle

$IPTABLES -t mangle -A PREROUTING -p tcp -m tcp –dport 80 -j ACCEPT

$IPTABLES -t mangle -A PREROUTING -p tcp -m tcp –dport 443 -j ACCEPT

$IPTABLES -t mangle -A PREROUTING -p tcp -m tcp –dport 135:139 -j DROP

$IPTABLES -t mangle -A PREROUTING -p udp -m udp –dport 135:139 -j DROP

$IPTABLES -t mangle -A PREROUTING -p tcp -m tcp –dport 445 -j DROP

$IPTABLES -t mangle -A PREROUTING -p udp -m udp –dport 445 -j DROP

$IPTABLES -t mangle -A PREROUTING -p tcp -m multiport –ports 445,1433,1434,2002,4156,1978,27444,10100,1812,10064,389,6346 -j DROP

$IPTABLES -t mangle -A PREROUTING -p udp -m multiport –ports 445,1433,1434,2002,4156,1978,27444,10100,1812,10064,389,6346 -j DROP

$IPTABLES -t mangle -A PREROUTING -p tcp –tcp-flags SYN,ACK SYN,ACK -m state –state NEW -j DROP

$IPTABLES -t mangle -A PREROUTING -p tcp –tcp-flags ALL NONE -j DROP

$IPTABLES -t mangle -A PREROUTING -p tcp –tcp-flags SYN,FIN SYN,FIN -j DROP

$IPTABLES -t mangle -A PREROUTING -p tcp –tcp-flags SYN,RST SYN,RST -j DROP

$IPTABLES -t mangle -A PREROUTING -p tcp –tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

$IPTABLES -t mangle -A PREROUTING -p tcp –tcp-flags FIN,RST FIN,RST -j DROP

$IPTABLES -t mangle -A PREROUTING -p tcp –tcp-flags ACK,FIN FIN -j DROP

$IPTABLES -t mangle -A PREROUTING -p tcp –tcp-flags ACK,PSH PSH -j DROP

$IPTABLES -t mangle -A PREROUTING -p tcp –tcp-flags ACK,URG URG -j DROP

$IPTABLES -t mangle -A PREROUTING -s 202.96.99.0/24 -j DROP

#############

echo “ICMP Protection is Enabling”

#

# ICMP protection

#

$IPTABLES -A INPUT -p icmp -m limit –limit 10/s –limit-burst 15 -j ACCEPT

#$IPTABLES -A INPUT -p icmp -m limit –limit 1/s –limit-burst 1 -j LOG –log-prefix PING-DROP:

$IPTABLES -A INPUT -p icmp -j DROP

$IPTABLES -A OUTPUT -p icmp -j ACCEPT

#

##

# For DNS Flooding..

#

$IPTABLES -A INPUT -p udp –dport 53 -m limit –limit 200/second –limit-burst 400 -j ACCEPT

$IPTABLES -A INPUT -p udp –dport 53 -j DROP

####################

## FIX_IP_START_SSHD

$IPTABLES -A INPUT -s 210.4.64.0/24 -p tcp -m tcp –dport 10222 -j ACCEPT

$IPTABLES -A INPUT -s 210.4.77.0/24 -p tcp -m tcp –dport 10222 -j ACCEPT

$IPTABLES -A INPUT -s 210.4.66.154/32 -p tcp -m tcp –dport 10222 -j ACCEPT

$IPTABLES -A INPUT -s 114.31.8.210/32 -p tcp -m tcp –dport 10222 -j ACCEPT

$IPTABLES -A INPUT -s 119.40.93.10/32 -p tcp -m tcp –dport 10222 -j ACCEPT

$IPTABLES -A INPUT -s 119.40.80.98/32 -p tcp -m tcp –dport 10222 -j ACCEPT

$IPTABLES -A INPUT -s 5.189.161.189/32 -p tcp -m tcp –dport 10222 -j ACCEPT

#$IPTABLES -A INPUT -s 185.246.241.193/32 -p tcp -m tcp –dport 10222 -j ACCEPT

#$IPTABLES -A INPUT -p tcp -m tcp –dport 10222 -j DROP

#### FIX_IP_END_SSHD

##

# For SSH Connections (Brute protection)

#

$IPTABLES -A INPUT -i ens13 -p tcp -m tcp –dport 10222 -m state –state NEW -m recent –set –name ssh –rsource

$IPTABLES -A INPUT -i ens13 -p tcp -m tcp –dport 10222 -m state –state NEW -m recent –update –seconds 60 –hitcount 8 –rttl –name ssh –rsource -j DROP

######

#

$IPTABLES -A INPUT -p tcp -m state –state NEW -m tcp –dport 443 -j ACCEPT

$IPTABLES -A INPUT -p tcp -m tcp –dport 10222 –syn -m state –state NEW -j ACCEPT

#

### PORT Allow and Deny

$IPTABLES -A INPUT -p tcp -m tcp –dport 80 -j ACCEPT

$IPTABLES -A INPUT -p tcp -m tcp –dport 443 -j ACCEPT

##### End the Default PORT ##############

#

# For MySql

$IPTABLES -A INPUT -s 127.0.0.1 -p tcp -m tcp –dport 3306 -j ACCEPT

#$IPTABLES -A INPUT -s 182.16.159.130/32 -p tcp -m tcp –dport 3306 -j ACCEPT

$IPTABLES -A INPUT -p tcp -m tcp –dport 3306 -j DROP

##

## DROP Rest of Everything

#

$IPTABLES -A INPUT -p udp -m state –state NEW -m udp -j DROP

$IPTABLES -A INPUT -p tcp -m state –state NEW -m tcp -j DROP

#

#

echo “Firewall rule is implemented…”