-
Notifications
You must be signed in to change notification settings - Fork 2
/
endwall_nft.sh
executable file
·1517 lines (1300 loc) · 85.1 KB
/
endwall_nft.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/bin/sh
###############################################################################################################################################################
# HEADER AND INSTRUCTIONS
###############################################################################################################################################################
# Program: endwall_nft.sh
# Type: Bourne shell script
# Creation Date: Jan 1 2013
# Branch: wired
# Current Version: 1.45
# Revision Date: July 07, 2022
# Previous Version: 1.44, June 23, 2022
# Author: THE ENDWARE DEVELOPMENT TEAM
# Copyright: THE ENDWARE DEVELOPMENT TEAM, 2016-2023
#
# Changes: - Translate endwall.sh from iptables to nftables
# - Update EULA, fix typo in if statement to loop over interfaces, add client_out_internal() function
# - fixed unfinished call to --open in code (bug fix)
# - Added --version flag, updated acknowledgements
# - Loop over interfaces check that ip is picked up
#
# Instructions: make directory,copy the file and change name to endwall.sh
# make whitelists,blacklist text files, edit the endwall.sh file
# change permisions to make endwall.sh executable, run the file.
#
# Notes: - uncomment the macchanger lines if you want random mac address.
# - requires macchanger (optional)
# - comment out lines starting at 1335 for alternate distributions you don't use
#
# $ mkdir ~/endwall
# $ cp endwall_v1xx.sh endwall.sh
# $ nano endwall.sh # go to the section below labeled GLOBAL VARIABLES
# edit the variables client1_ip,client1_mac,client1_ip,client2_mac
# so that they match your needs and save. ^X
# # uncomment the macchanger lines to use machanger
# # comment out save rules on line 1335 for distributions not used
# $ chmod u+rwx endwall_nft.sh # changer permisions to allow script execution
# $ su # become root
# # ./endwall_nft.sh # execute/run the file
#
# If the firewall fails (bad interface pickup or bad ipv4 pickup) then run ./endwall_nft.sh --open to return to open policies
# $ ./endwall_nft.sh --open
# Then manually set the interface ipv4 for ip1 and ip2 or play with the assignments of the internal variables (Switch 1 to 2 and retry etc)
#
############################################################################################################################################################################
# Note that ip6tables is not enabled by default on some distributions
# for systemd enable and start nftables as follows:
# # systemctl enable nftables
# # systemctl start nftables
#
#########################################################################
#############################################################################################################################################################################
# ACKNOWLEDGMENTS
#############################################################################################################################################################################
# The Endware Development Team would like to acknowledge the work and efforts of OdiliTime, Balrog and SnakeDude who graciously hosted and promoted this software project.
# We would also like to acknowledge the work and efforts of Stephen Lynx, the creator and maintainer of LynxChan.
# Without their efforts and their wonderful web site www.endchan.xyz, The Endware Suite would not exist in the public domain at all in any form.
#
# So thanks to OdiliTime, Balrog, SnakeDude, and Stephen Lynx for inspiring this work and for hosting and promoting it.
#
# The Endware Suite including Endwall,Endsets,Endlists,Endtools,Endloads and Endtube are named in honor of Endchan.
#
# The Endware Suite is available for download at the following locations:
# https://gitgud.io/Endwall/ , https://github.com/endwall2/, https://www.endchan.xyz/os/, http://42xlyaqlurifvvtq.onion,
#
# Special thanks to the designer of the current EndWare logo which replaces the previous logo. It looks great!
# Thank you also to early beta testers including a@a, and to other contributors including Joshua Moon (for user_agents.txt split and other good suggestions)
# as well as to the detractors who helped to critique this work and to ultimately improve it.
#
# We also acknowledge paste.debian.net, ix.io, gitgud and github for their hosting services,
# without which distribution would be limited, so thank you.
#
# https://www.endchan.xyz, http://paste.debian.net, https://gitgud.io, https://github.com, http://ix.io
#
# We salute you!
#
# In the end, may it all end well.
#
# The Endware Development Team
##############################################################################################################################################################################
##############################################################################################################################################################################
# LICENSE AGREEMENT
##############################################################################################################################################################################
# BEGINNING OF LICENSE AGREEMENT
# TITLE: THE ENDWARE END USER LICENSE AGREEMENT (EULA)
# CREATION DATE: MARCH 19, 2016
# VERSION: 1.19
# VERSION DATE: JUNE 23, 2022
# COPYRIGHT: THE ENDWARE DEVELOPMENT TEAM, 2016-2018
# ALL RIGHTS RESERVED
#
# WHAT CONSTITUTES "USE"? WHAT IS A "USER"?
# 0) a) Use of this program means the ability to study, possess, run, copy, modify, publish, distribute and sell the code as included in all lines of this file,
# in text format or as a binary file constituting this particular program or its compiled binary machine code form, as well as the the performance
# of these aforementioned actions and activities.
# 0) b) A user of this program is any individual who has been granted use as defined in section 0) a) of the LICENSE AGREEMENT, and is granted to those individuals listed in section 1.
# WHO MAY USE THIS PROGRAM ?
# 1) a) This program may be used by any living human being, any person, any corporation, any company, and by any sentient individual with the willingness and ability to do so.
# 1) b) This program may be used by any citizen or resident of any country, and by any human being without citizenship or residency.
# 1) c) This program may be used by any civilian, military officer, government agent, private citizen, government official, sovereign, monarch, head of state,
# dignitary, ambassador, legislator,congressional representative, member of parliament, senator, judicial official, judge, prosecutor, lawyer, law enforcement officer,
# police constable, noble, commoner, clergy, laity, and generally all classes and ranks of people, persons, and human beings mentioned and those not mentioned.
# 1) d) This program may be used by any human being of any sex or gender, including men, women, or any other sex, or gender not mentioned.
# 1) e) This program may be used by any human being of any affiliation, political viewpoint, political affiliation, religious belief, religious affiliation, and by those of non-belief or non affiliation.
# 1) f) This program may be used by any human being of any race, ethnicity, identity, origin, genetic makeup, physical appearance, mental ability, and by those of any other physical
# or non physical characteristics of differentiation.
# 1) g) This program may be used by any human being of any sexual orientation, including heterosexual, homosexual, bisexual, asexual, or any other sexual orientation not mentioned.
# 1) h) This program may be used by all business classes and business entities, including corporations, limited liability companies, sole proprietorships, partnerships, joint venture companies, private companies, publicly owned companies, and any other business class not specifically mentioned.
# 1) i) This program may be used by anyone.
# WHERE MAY A USER USE THIS PROGRAM ?
# 2) a) This program may be used in any country, in any geographic location of the planet Earth, in any marine or maritime environment, at sea, sub-sea, in a submarine, underground,
# in the air, in an airplane, dirigible, blimp, or balloon, in a car, bus, motor vehicle, train, armored transport vehicle, and at any distance from the surface of the planet Earth, including in orbit about the Earth, the Moon, or the planet Mars,
# on a satellite orbiting about the Earth, the Moon, the planet Mars, and about any Solar System planet and its moons, on any space transport vehicle, and anywhere in the Solar System including the Moon, Mars, and all other Solar System planets not listed.
# 2) b) This program may be used in any residential, commercial, business, and governmental property or location and in all public and private spaces.
# 2) c) This program may be used anywhere.
# IN WHAT CONTEXT OR CIRCUMSTANCES MAY A USER USE THIS PROGRAM?
# 3) This program may be used by any person, human being or sentient individual for any purpose and in any context and in any setting including for personal use, academic use,
# business use, commercial use, government use, non-governmental organization use, non-profit organization use, military use, civilian use, and generally any other use
# not specifically mentioned.
# WHAT MAY A "USER" DO WITH THIS PROGRAM ?
# 4) Any user of this program is granted the freedom to read and study the code.
# 5) a) Any user of this program is granted the freedom to distribute, publish, and share the code with any recipient of their choice electronically or by any other method of transmission.
# 5) b) The LICENCSE AGREEMENT, ACKNOWLEDGMENTS, Header and Instructions must remain attached to the code in their entirety when re-distributed.
# 5) c) Any user of this program is granted the freedom to sell this software as distributed or to bundle it with other software or saleable goods.
# 6) a) Any user of this program is granted the freedom to modify the code.
# 6) b) When modified, any user of this program is granted the freedom of re-distribution of their modified code if and only if the user attatchs the LICENSE AGREEMENT
# in its entirety to their modified code before re-distribution.
# 6) c) Any user of this software is granted the freedom to sell their modified copy of this software or to bundle their modified copy with other software or saleable goods.
# 6) d) Any modified code shall be sublicensed by the modifier and distributor only under the original terms of the Endware End User License Agreement as presented in this LICENSE AGREEMENT.
# 6) e) Any user of this software agrees that any derivative works produced as a result of user modification will be sublicensed when re-distributed under the original terms of this LICENSE AGREEMENT exactly as presented.
# 7) a) Any user of this program is granted the freedom to run this code on any computer of their choice.
# 7) b) Any user of this program is granted the freedom to run as many simultaneous instances of this code, on as many computers as they are able to and desire, and for as long as they desire and are
# able to do so with any degree of simultaneity in use.
# WHAT MUST A "USER" NOT DO WITH THIS PROGRAM ?
# 8) Any user of this program is not granted the freedom to procure a patent for the methods presented in this software, and agrees not to do so.
# 9) Any user of this program is not granted the freedom to arbitrarily procure a copyright on this software as presented, and agrees not to do so.
# 10) Any user of this program is not granted the freedom to obtain or retain intellectual property rights on this software as presented and agrees not to do so.
# 11) a) Any user of this program may use this software as part of a patented process, as a substitutable input into the process; however the user agrees not to attempt to patent this software as part of their patented process.
# 11) b) This software is a tool, like a hammer, and may be used in a process which applies for and gains a patent, as a substitutable input into the process;
# however the software tool itself may not be included in the patent or covered by the patent as a novel invention, and the user agrees not to do this and not to attempt to do this.
# 12) a) Any user of this program is not granted the freedom to remove, replace, alter or modify the LICENSE AGREEMENT, ACKNOWLEDGMENTS, or the Header and Instructions from the file, if being distributed without modification of the program code.
# The LICENSE AGREEMENT, ACKKNWLEGEMENTS and Header and Instructions sections must remain attached to the code in their entirety when re-distributed without modification.
# b) If the code is moodified, by a user, as permitted and allowed under section 6) a),b),c),d),e) of this LICENSE AGREEMENT, then
# the user of this program who made the program code modifications may modify or alter the ACKNKOWLEGEMENTS, or the Header and Instructions sections to document these new modifications and their authorship, and to acknowledge any asistance in doing so,
# however, these user modifiers are not granted the freedom to removem, replace, alter or modify the LICENSE AGREEMENT which must remain attached to the code in their entirety when re-distributed without modification.
# WHO GRANTS THESE FREEDOMS ?
# 13) The creators of this software are the original developer,"Endwall", and anyone listed as being a member of "The Endware Development Team" by "Endwall", as well as ancillary contributors, and user modifiers and developers of the software.
# 14) The aforementioned freedoms of use listed in sections 4),5),6),and 7) are granted by the creators of this software and the Endware Development Team to any qualifying user listed in section 1) and
# comporting with any restrictions and qualifications mentioned in sections 2), 3), 8), 9), 10) and 11) of this LICENSE AGREEMENT.
# WHAT RELATIONSHIP DO THE USERS HAVE WITH THE CREATORS OF THE SOFTWARE ?
# 15) This software is distributed "AS IS" without any warranty and without any guaranty and the creators do not imply anything about its usefulness or efficacy.
# 16) If the user suffers or sustains financial loss, informational loss, material loss, physical loss or data loss as a result of using, running, or modifying this software
# the user agrees that they will hold the creators of this software, "The Endware Development Team", "Endwall", and the programmers involved in its creation, free from prosecution,
# free from indemnity, and free from liability, and will not attempt to seek restitution, compensation, or payment for any such loss real or imagined.
# 17) If a user makes a significant improvement to this software, and if this improvement is included in a release, the user agrees not to seek remuneration or payment
# from the creators of this software or from Endwall or from the Endware Development Team, for any such work contribution performed, and the user understands
# that there will be no such remuneration or payment rendered to them for any such contribution.
# END OF LICENSE AGREEMENT
##################################################################################################################################################################################
# ADDITIONAL NOTES:
# 18) If a user finds a significant flaw or makes a significant improvement to this software, please feel free to notify the original developers so that we may also
# include your user improvement in the next release; users are not obligated to do this, but we would enjoy this courtesy tremendously.
#
# 19) Sections 0) a) 0) b) and 1) a) are sufficient for use; however sections 1) b) through 1) i) are presented to clarify 1 a) and to enforce non-discrimination and non-exclusion of use.
# For example some people may choose to redefine the meaning of the words "person" "human being" or "sentient individual" to exclude certain types of people.
# This would be deemed unacceptable and is specifically rejected by the enumeration presented. If the wording presented is problematic please contact us and suggest a change,
# and it will be taken into consideration.
#################################################################################################################################################################################
################################################ BEGINNING OF PROGRAM ##################################################################################
####################################################################################################
# INPUT ARGUMENTS
###################################################################################################
version="1.45"
branch="gnu/linux nft wired"
rev_date="07/07/2022"
state="closed"
for arg in "$@"
do
if [ "$arg" = "--help" ]
then
echo "USAGE: ./endwall --help ## displays usage statements"
echo "USAGE: ./endwall --version ## displays version statements"
echo "USAGE: ./endwall --open ## opens firewall to default open policies"
echo "USAGE: ./endwall ## enable endwall firewall system"
echo "USAGE: ./endwall --default ## default settings"
echo "USAGE: ./endwall --closed ## closed settings"
echo "USAGE: ./endwall --test test settings"
echo "USAGE: ./endwall ## enable endwall firewall system with closed settings"
shift
exit 0
elif [ "$arg" = "--version" ]
then
echo "ENDWALL version:"$version", branch:"$branch", revision date:"$rev_date" "
echo "Copyright: THE ENDWARE DEVELOPMENT TEAM, 2016"
shift
exit 0
elif [ "$arg" = "--open" ]
then
state="open"
shift
elif [ "$arg" = "--default" ]
then
state="default"
shift
elif [ "$arg" = "--test" ]
then
state="test"
shift
elif [ "$arg" = "--closed" ]
then
state="closed"
shift
else
# default state is closed not default
state="closed"
fi
done
############################ CLIENTS ################################################
# change these values but dont leave them blank
# add more clients as you need them use $ arp or $ nmap -sS client_ip to determine values
#client1_mac=00:00:00:00:00:00 # change to be the mac address of client 1
#client2_mac=00:00:00:00:00:00 # change to be the mac address of client 2
#client1_ip=192.168.0.161 # change to be the static ip of your first internal client
#client2_ip=192.168.0.162 # change to be the static ip of your second internal client
####################################################################################################
# GLOBAL VARIABLES
####################################################################################################
### variable for the nft command location
nft="/sbin/nft"
# Grab interface name from ip link and parse
int_if1=$(ip link | grep -a "state " | awk -F: '{ if (FNR==2) print $2}')
int_if2=$(ip link | grep -a "state " | awk -F: '{ if (FNR==3) print $2}')
# Grab Gateway Information
gateway_ip=$(ip route | awk '/via/ {print $3}')
#gateway_mac=$( arp | awk '/gateway/ {print $3}')
gateway_mac=$( nmap -sS "$gateway_ip" -p 53| grep -a "MAC Address:" | awk '{print $3}')
# RUN MAC CHANGER on INTERFACES
#macchanger -A $int_if
#macchanger -A "$int_if2"
# grab host mac addresses from ip link
host_mac1=$(ip link | grep -a "ether" | awk ' {if (FNR==1) print $2}')
host_mac2=$(ip link | grep -a "ether" | awk ' {if (FNR==2) print $2}')
# grab the ip addresses from the interfaces
host_ip1=$(ip addr | grep -a "scope global"|awk 'BEGIN {FS="/"} {if (FNR==1) print $1}'| awk '{print $2}')
host_ip2=$(ip addr | grep -a "scope global"|awk 'BEGIN {FS="/"} {if (FNR==2) print $1}'| awk '{print $2}')
# grab the ipv6 addresses frrom the interfaces
host_ip1v6=$(ip addr | grep -a "inet6"| awk 'BEGIN {FS="/"} {if (FNR==2) print $1}'| awk '{print $2}')
host_ip2v6=$(ip addr | grep -a "inet6"| awk 'BEGIN {FS="/"} {if (FNR==3) print $1}'| awk '{print $2}')
########################### INTERNAL VARIABLES ##################################
int_mac1="$host_mac1" # internal mac address of interface 1
int_mac2="$host_mac2" # internal mac address of interface 2
int_ip1="$host_ip1" # internal ip address of interface 1
int_ip2="$host_ip2" # internal ip address of interface 2
int_ip1v6="$host_ip1v6" # internal ipv6 address of interface 1
int_ip2v6="$host_ip2v6" # internal ipv6 address of interface 2
###################################################################################################################################
# LINUX SECURITY BOOLEANS
###################################################################################################################################
echo "LOADING SYSCTL SECURITY BOOLEANS"
############### KERNEL #############################################################################################
sysctl -w -q kernel.sysrq=0
sysctl -w -q kernel.core_uses_pid=1
sysctl -w -q kernel.randomize_va_space=1
#sysctl -w -q kernel.pid_max=65536
#sysctl -w -q kernel.exec-shield=1
############### IPv4 #############################################################################################
sysctl -w -q net.ipv4.tcp_syncookies=1 # enable tcp syn cookies (prevent against the common 'syn flood attack')
sysctl -w -q net.ipv4.ip_forward=0 # disable Packet forwarding between interfaces
# Disable Source Routed Packets,Redirect Acceptance, Redirect Sends, Log all Martian IP addresses
for f in $(ls /proc/sys/net/ipv4/conf/); do
sysctl -w -q net.ipv4.conf.$f.rp_filter=1 # do source validation by reversed path (Recommended option for single homed hosts)
sysctl -w -q net.ipv4.conf.$f.accept_source_route=0 # Disable source routed packets redirects
sysctl -w -q net.ipv4.conf.$f.accept_redirects=0 # don't accept redirects
sysctl -w -q net.ipv4.conf.$f.send_redirects=0 # don't send redirects
sysctl -w -q net.ipv4.conf.$f.log_martians=1 # log packets with impossible addresses to kernel log
done
sysctl -w -q net.ipv4.icmp_echo_ignore_broadcasts=1 # ignore all ICMP ECHO and TIMESTAMP requests sent to it via broadcast/multicast
sysctl -w -q net.ipv4.icmp_ignore_bogus_error_responses=1 # disable logging of bogus responses to broadcast frames
################## IPv6 ##############################################################################################
for f in $(ls /proc/sys/net/ipv6/conf/); do
sysctl -w -q net.ipv6.conf.$f.accept_source_route=0
sysctl -w -q net.ipv6.conf.$f.accept_redirects=0
sysctl -w -q net.ipv6.conf.$f.router_solicitations=0
sysctl -w -q net.ipv6.conf.$f.accept_ra_rtr_pref=0
sysctl -w -q net.ipv6.conf.$f.accept_ra_pinfo=0
sysctl -w -q net.ipv6.conf.$f.accept_ra_defrtr=0
sysctl -w -q net.ipv6.conf.$f.autoconf=0
sysctl -w -q net.ipv6.conf.$f.dad_transmits=0
sysctl -w -q net.ipv6.conf.$f.max_addresses=1
done
##################### OTHER ##################################################################################################
#setsebool httpd_can_network_connect on #needed for squirelmail if you are on selinux
#setsebool httpd_can_sendmail on #needed for squirelmail send if you are on selinux
sysctl -p # load settings
echo "SYSCTL SECURITY BOOLEANS LOADED"
###########################################################################################################################
###################### FLUSH OLD RULES #####################################################################
## Flush old rules
nft flush ruleset;
#################################################################################################################################
###################################### FUNCTIONS ####################################################################
# RULES
# {add | insert} rule [family] table chain [handle handle | index index] statement ... [comment comment]
# replace rule [family] table chain handle handle statement ... [comment comment]
# delete rule [family] table chain handle handle
# nft add rule filter input ip saddr { 10.0.0.0/8, 192.168.0.0/16 } tcp dport { 22, 443 } accept
########## LOCAL HOST FUNCTIONS
lo_open()
{
proto=$1
ports=$2
# add rule fam table chain statement
nft add rule inet filter input iifname lo ip protocol "$proto" "$proto" dport { "$ports" } accept
nft add rule inet filter input iifname lo ip protocol "$proto" "$proto" sport { "$ports" } accept
nft add rule inet filter output oifname lo ip protocol "$proto" "$proto" dport { "$ports" } accept
nft add rule inet filter output oifname lo ip protocol "$proto" "$proto" sport { "$ports" } accept
}
##
lo6_open()
{
proto=$1
ports=$2
nft add rule inet filter input iifname lo ip6 daddr "::1/128" "$proto" dport { "$ports" } accept
nft add rule inet filter input iifname lo ip6 daddr "::1/128" "$proto" sport { "$ports" } accept
nft add rule inet filter output oifname lo ip6 saddr "::1/128" "$proto" dport { "$ports" } accept
nft add rule inet filter output oifname lo ip6 saddr "::1/128" "$proto" sport { "$ports" } accept
}
### ICMP on localhost
lo_icmp()
{
### ICMP Outbound
nft add rule inet filter output oifname lo ip protocol icmp icmp type { echo-reply, echo-request, destination-unreachable, router-solicitation, router-advertisement, time-exceeded, parameter-problem } counter accept
### ICMP Inbound
nft add rule inet filter input iifname lo ip protocol icmp icmp type { echo-reply, echo-request, destination-unreachable, router-solicitation, router-advertisement, time-exceeded, parameter-problem } counter accept
}
lo_icmp6()
{
interface=$1
### ICMP Outbound
nft add rule inet filter output oifname lo icmpv6 type { echo-reply, echo-request, destination-unreachable, nd-router-solicit, nd-router-advert, nd-neighbor-advert, time-exceeded, parameter-problem } counter accept
### ICMP Inbound
nft add rule inet filter input iifname lo icmpv6 type { echo-reply, echo-request, destination-unreachable, nd-router-solicit, nd-router-advert, nd-neighbor-advert ,time-exceeded, parameter-problem } counter accept
}
############ CLIENT OUTBOUND CONNECTIONS ###################
### only allow new and established connections, to or from specified ports
client_out()
{
proto=$1
ports=$2
# add rule fam table chain statement
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" ip saddr "$int_ip" "$proto" sport { "$ports" } ct state { new, established } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" ip daddr "$int_ip" "$proto" dport { "$ports" } ct state { established } counter accept
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" ip saddr "$int_ip" "$proto" dport { "$ports" } ct state { new, established } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" ip daddr "$int_ip" "$proto" sport { "$ports" } ct state { established } counter accept
}
### allow related connections more permisive
client_out_rel()
{
proto=$1
ports=$2
# add rule fam table chain statement
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" ip saddr "$int_ip" "$proto" sport { "$ports" } ct state { new, established, related } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" ip daddr "$int_ip" "$proto" dport { "$ports" } ct state { established, related } counter accept
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" ip saddr "$int_ip" "$proto" dport { "$ports" } ct state { new, established, related } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" ip daddr "$int_ip" "$proto" sport { "$ports" } ct state { established, related } counter accept
}
### only allow new and established connections, to or from specified ports
client6_out()
{
proto=$1
ports=$2
# add rule fam table chain statement
nft add rule inet filter output oifname "$int_if" ip6 saddr "$int_ipv6" "$proto" sport { "$ports" } ct state { new, established } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip6 daddr "$int_ipv6" "$proto" dport { "$ports" } ct state { established } counter accept
nft add rule inet filter output oifname "$int_if" ip6 saddr "$int_ipv6" "$proto" dport { "$ports" } ct state { new, established } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip6 daddr "$int_ipv6" "$proto" sport { "$ports" } ct state { established } counter accept
}
### allow related connections more permisive
client6_out_rel()
{
proto=$1
ports=$2
# add rule fam table chain statement
nft add rule inet filter output oifname "$int_if" protocol "$proto" ip6 saddr "$int_ipv6" "$proto" sport { "$ports" } ct state { new, established, related } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" protocol "$proto" ip6 daddr "$int_ipv6" "$proto" dport { "$ports" } ct state { established, related } counter accept
nft add rule inet filter output oifname "$int_if" protocol "$proto" ip6 saddr "$int_ipv6" "$proto" dport { "$ports" } ct state { new, established, related } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" protocol "$proto" ip6 daddr "$int_ipv6" "$proto" sport { "$ports" } ct state { established, related } counter accept
}
######### Use this to lock to a specific internal server (DNS,SMTP,IMAP) by client_ip and client_mac of the host machine
client_out_internal()
{
proto=$1
ports=$2
client_ip=$3
client_mac=$4
# add rule fam table chain statement
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" ip saddr "$int_ip" "$proto" sport { "$ports" } ip daddr "$client_ip" counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" ip daddr "$int_ip" "$proto" dport { "$ports" } ether saddr "$client_mac" ip saddr "$client_ip" ct state { established, related } counter accept
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" ip saddr "$int_ip" "$proto" dport { "$ports" } ip daddr "$client_ip" counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" ip daddr "$int_ip" "$proto" sport { "$ports" } ether saddr "$client_mac" ip saddr "$client_ip" ct state { established, related } counter accept
}
client_out_wifi()
{
proto=$1
ports=$2
int_if="wlan0"
# add rule fam table chain statement
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" "$proto" sport { "$ports" } ct state { new, established } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" "$proto" dport { "$ports" } ct state { established } counter accept
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" "$proto" dport { "$ports" } ct state { new, established } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" "$proto" sport { "$ports" } ct state { established } counter accept
}
client6_out_wifi()
{
proto=$1
ports=$2
int_if="wlan0"
# add rule fam table chain statement
nft add rule inet filter output oifname "$int_if" ip6 saddr "$int_ipv6" "$proto" sport { "$ports" } ct state { new, established } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip6 daddr "$int_ipv6" "$proto" dport { "$ports" } ct state { established } counter accept
nft add rule inet filter output oifname "$int_if" ip6 saddr "$int_ipv6" "$proto" dport { "$ports" } ct state { new, established } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip6 daddr "$int_ipv6" "$proto" sport { "$ports" } ct state { established } counter accept
}
client_out_rel_wifi()
{
proto=$1
ports=$2
int_if="wlan0"
# add rule fam table chain statement
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" "$proto" sport { "$ports" } ct state { new, established, related } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" "$proto" dport { "$ports" } ct state { established, related } counter accept
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" "$proto" dport { "$ports" } ct state { new, established, related } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" "$proto" sport { "$ports" } ct state { established, related } counter accept
}
client6_out_rel_wifi()
{
proto=$1
ports=$2
int_if="wlan0"
# add rule fam table chain statement
nft add rule inet filter output oifname "$int_if" ip6 saddr "$int_ipv6" "$proto" sport { "$ports" } ct state { new, established, related } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip6 daddr "$int_ipv6" "$proto" dport { "$ports" } ct state { established, related } counter accept
nft add rule inet filter output oifname "$int_if" ip6 saddr "$int_ipv6" "$proto" dport { "$ports" } ct state { new, established, related } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip6 daddr "$int_ipv6" "$proto" sport { "$ports" } ct state { established, related } counter accept
}
### only allow new and established connections, to or from specified ports to a specific ip and mac address
client_out_internal()
{
proto=$1
ports=$2
client_ip=$3
client_mac=$4
# add rule fam table chain statement
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" ip saddr "$int_ip" ip daddr "$client_ip" "$proto" sport { "$ports" } ct state { new, established } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" ip daddr "$int_ip" ip saddr "$client_ip" "$proto" dport { "$ports" } ether saddr "$client_mac" ct state { established } counter accept
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" ip saddr "$int_ip" ip daddr "$client_ip" "$proto" dport { "$ports" } ct state { new, established } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" ip daddr "$int_ip" ip saddr "$client_ip" "$proto" sport { "$ports" } ether saddr "$client_mac" ct state { established } counter accept
}
############################ ICMP ###################################
icmp_out()
{
interface=$1
### ICMP Outbound
nft add rule inet filter output oifname "$interface" ip protocol icmp icmp type { echo-reply, echo-request, destination-unreachable, router-solicitation, router-advertisement, time-exceeded, parameter-problem } counter accept
### ICMP Inbound
nft add rule inet filter input iifname "$interface" ip protocol icmp icmp type { echo-reply, echo-request, destination-unreachable, router-solicitation, router-advertisement, time-exceeded, parameter-problem } ct state {established, related } counter accept
}
############# ICMPv6 #####################################
icmp6_out()
{
interface=$1
### ICMP Outbound
nft add rule inet filter output oifname "$interface" icmpv6 type { echo-reply, echo-request, destination-unreachable, nd-router-solicit, nd-router-advert, nd-neighbor-advert, time-exceeded, parameter-problem } counter accept
### ICMP Inbound
nft add rule inet filter input iifname "$interface" icmpv6 type { echo-reply, echo-request, destination-unreachable, nd-router-solicit, nd-router-advert, nd-neighbor-advert ,time-exceeded, parameter-problem } ct state {established, related } counter accept
}
######### SERVER INBOUND CONNECTIONS ############################
## basic inbound rules
server_in()
{
proto=$1
ports=$2
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" ip daddr "$int_ip" "$proto" dport { "$ports" } counter log accept
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" ip saddr "$int_ip" "$proto" sport { "$ports" } ct state { established, related } counter log accept
}
### extended / more permisive inbound rules
server_in_x()
{
proto=$1
ports=$2
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" ip daddr "$int_ip" "$proto" dport { "$ports" } counter log accept
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" ip saddr "$int_ip" "$proto" sport { "$ports" } ct state { established, related } counter log accept
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" ip daddr "$int_ip" "$proto" sport { "$ports" } counter log accept
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" ip saddr "$int_ip" "$proto" dport { "$ports" } ct state { established, related } counter log accept
}
#### extended / permisive but locked to a specifice machine by client_ip and client_mac on your internal network
#### only allow access to services based on specific ip/mac address combinations
server_in_internal()
{
proto=$1
ports=$2
client_ip=$3
client_mac=$4
# add rule fam table chain statement
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" ip daddr "$int_ip" "$proto" dport { "$ports" } ether saddr "$client_mac" ip saddr "$client_ip" ct state { new, established } counter accept
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" ip saddr "$int_ip" "$proto" sport { "$ports" } ip daddr "$client_ip" ct state { established } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" ip daddr "$int_ip" "$proto" sport { "$ports" } ether saddr "$client_mac" ip saddr "$client_ip" ct state { new, established } counter accept
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" ip saddr "$int_ip" "$proto" dport { "$ports" } ip daddr "$client_ip" ct state { established } counter accept # jump PASS
}
## basic inbound rules
server_in_wifi()
{
proto=$1
ports=$2
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" "$proto" dport { "$ports" } counter log accept
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" "$proto" sport { "$ports" } ct state { established, related } counter log accept
}
## basic inbound rules
server6_in_wifi()
{
proto=$1
ports=$2
nft add rule inet filter input iifname "$int_if" ip6 daddr "$int_ipv6" "$proto" dport { "$ports" } counter log accept
nft add rule inet filter output oifname "$int_if" ip6 saddr "$int_ipv6" "$proto" sport { "$ports" } ct state { established, related } counter log accept
}
server_internal_2p()
{
proto=$1
port1=$2
port2=$3
client_ip=$4
client_mac=$5
# add rule fam table chain statement
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" ip daddr "$int_ip" "$proto" sport { "$port1" } dport { "$port2" } ether saddr "$client_mac" ip saddr "$client_ip" ct state { new, established } counter accept
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" ip saddr "$int_ip" "$proto" dport { "$port1"} sport { "$port2" } ip daddr "$client_ip" ct state { established } counter accept # jump PASS
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" ip daddr "$int_ip" "$proto" dport { "$sport1" } sport { "$port2" } ether saddr "$client_mac" ip saddr "$client_ip" ct state { new, established } counter accept
nft add rule inet filter output oifname "$int_if" ip protocol "$proto" ip saddr "$int_ip" "$proto" sport{ "$port1" } dport { "$port2" } ip daddr "$client_ip" ct state { established } counter accept # jump PASS
}
server_internal_1way()
{
proto="udp"
ports=$1
client_ip=$2
client_mac=$3
nft add rule inet filter input iifname "$int_if" ip protocol "$proto" ip daddr "$int_ip" "$proto" dport { "$ports" } ether saddr "$client_mac" ip saddr "$client_ip" ct state { new, established } counter accept
}
############################# NOT FIXED / TRANSLATE THESE LATER ###########################################33
########### CLIENT OUTBOUND
### limit the burst rate / number of requests per second to stop DDOS
client_out_lim()
{
proto=$1
ports=$2
limrate=$3
limburst=$4
#iptables -A OUTPUT -o $int_if -s "$int_ip" -p "$proto" -m multiport --dports "$ports" -m limit --limit "$limrate"/s --limit-burst "$limburst" -m state --state NEW,ESTABLISHED -j PASS
#iptables -A INPUT -i $int_if -d "$int_ip" -p "$proto" -m multiport --sports "$ports" -m state --state ESTABLISHED -j PASS
#iptables -A OUTPUT -o $int_if -s "$int_ip" -p "$proto" -m multiport --sports "$ports" -m limit --limit "$limrate"/s --limit-burst "$limburst" -m state --state NEW,ESTABLISHED -j PASS
#iptables -A INPUT -i $int_if -d "$int_ip" -p "$proto" -m multiport --dports "$ports" -m state --state ESTABLISHED -j PASS
}
############## SERVER INBOUND
server_in_lim()
{
proto=$1
ports=$2
limrate=$3
limburst=$4
#iptables -A INPUT -i $int_if -d "$int_ip" -p "$proto" -m multiport --sports "$ports" -m limit --limit "$limrate"/s --limit-burst "$limburst" -m state --state NEW,ESTABLISHED -j PASS
#iptables -A OUTPUT -o $int_if -s "$int_ip" -p "$proto" -m multiport --dports "$ports" -m state --state ESTABLISHED -j PASS
#iptables -A INPUT -i $int_if -d "$int_ip" -p "$proto" -m multiport --dports "$ports" -m limit --limit "$limrate"/s --limit-burst "$limburst" -m state --state NEW,ESTABLISHED -j PASS
#iptables -A OUTPUT -o $int_if -s "$int_ip" -p "$proto" -m multiport --sports "$ports" -m state --state ESTABLISHED -j PASS
}
##################################### END OF FUNCTIONS #####################################################################################
######## THERE ARE 4 models slectable from the commandline
# $ ./endwall_nft_raspi --open
# $ ./endwall_nft_raspi --default
# $ ./endwall_nft_raspi --test
# $ ./endwall_nft_raspi --closed
# $ ./endwall_nft_raspi # this selects the closed model settings
# The model settings follow below
####################################### OPEN WALL ########################################################################
# Disable firewall if --open flag
if [ "$state" = "open" ]
then
################################ DISABLE THE FIREWALL #################################################################
# Policies
############################ DEFUALT POLICY ####################################################################
# make a new table called filter
nft add table inet filter #inet does both ip and ip6
#nft add table ip filter # ip filter table
#nft add table ip6 filter # ip6 filter table
# Make some default chains
nft add chain inet filter input '{ type filter hook input priority 0 ; policy drop ; }'
nft add chain inet filter forward '{ type filter hook forward priority 0 ; policy drop ; }'
nft add chain inet filter output '{ type filter hook output priority 0 ; policy drop ; }'
nft add rule inet filter input accept
nft add rule inet filter forward accept
nft add rule inet filter output accept
############################## SAVE RULES ##############################################################
echo SAVING RULES
#DEBIAN
nft list ruleset > /etc/nftables.conf
echo "ENDWALL NFT DISABLED"
############################## PRINT RULES ################################################################
#list the rules
nft list ruleset;
#
#
############################# PRINT ADDRESSES ########################################################################
echo "GATEWAY_1 : MAC:"$gateway_mac1" IPv4:"$gateway_ip1" "
echo "INTERFACE_1: "$int_if1" MAC:"$int_mac1" IPv4:"$int_ip1" IPv6:"$int_ip1v6" "
echo "GATEWAY_2 : MAC:"$gateway_mac2" IPv4:"$gateway_ip2" "
echo "INTERFACE_2: "$int_if2" MAC:"$int_mac2" IPv4:"$int_ip2" IPv6:"$int_ip2v6" "
# print the time the script finishes
date
exit 0
fi
if [ "$state" = "default" ]
then
### This is a compact set of rules for testing
### This should actually be a better default ruleset rather than all open
### acces with --test option
############################ DEFUALT POLICY ####################################################################
# make a new table called filter
nft add table inet filter #inet does both ip and ip6
#nft add table ip filter # ip filter table
#nft add table ip6 filter # ip6 filter table
# Make some default chains
nft add chain inet filter input '{ type filter hook input priority 0 ; policy drop ; }'
nft add chain inet filter forward '{ type filter hook forward priority 0 ; policy drop ; }'
nft add chain inet filter output '{ type filter hook output priority 0 ; policy drop ; }'
### Accept all loopback
nft add rule inet filter input iifname lo accept
### Accept all output
nft add rule inet filter output accept
################# wlan0 #########################################################################
## Accept all input from icmp
nft add rule inet filter input iifname wlan0 ip protocol icmp accept
### Accept all input from gateway (will make redundant rules if a gatweay is missing)
nft add rule inet filter input iifname wlan0 ip protocol tcp ip saddr "$gateway_ip1" accept
nft add rule inet filter input iifname wlan0 ip protocol udp ip saddr "$gateway_ip1" accept
nft add rule inet filter input iifname wlan0 ip protocol tcp ip saddr "$gateway_ip2" accept
nft add rule inet filter input iifname wlan0 ip protocol udp ip saddr "$gateway_ip2" accept
## Accept all input from DNS,BOOTP,HTTP,HTTPS
nft add rule inet filter input iifname wlan0 ip protocol tcp tcp sport { 53,67,68,80,443 } accept
nft add rule inet filter input iifname wlan0 ip protocol udp udp sport { 53,67,68,80,443 } accept
nft add rule inet filter input iifname wlan0 ip protocol tcp tcp dport { 53,67,68,80,443 } accept
nft add rule inet filter input iifname wlan0 ip protocol udp udp dport { 53,67,68,80,443 } accept
################ eth0 ###########################################################################
## Accept all input from icmp
nft add rule inet filter input iifname eth0 ip protocol icmp accept
### Accept all input from gateway (will make redundant rules if a gateway is missing)
nft add rule inet filter input iifname eth0 ip protocol tcp ip saddr "$gateway_ip1" accept
nft add rule inet filter input iifname eth0 ip protocol udp ip saddr "$gateway_ip1" accept
nft add rule inet filter input iifname eth0 ip protocol tcp ip saddr "$gateway_ip2" accept
nft add rule inet filter input iifname eth0 ip protocol udp ip saddr "$gateway_ip2" accept
## Accept all input from DNS,BOOTP,HTTP,HTTPS
nft add rule inet filter input iifname eth0 ip protocol tcp tcp sport { 53,67,68,80,443 } accept
nft add rule inet filter input iifname eth0 ip protocol udp udp sport { 53,67,68,80,443 } accept
nft add rule inet filter input iifname eth0 ip protocol tcp tcp dport { 53,67,68,80,443 } accept
nft add rule inet filter input iifname eth0 ip protocol udp udp dport { 53,67,68,80,443 } accept
##################################################################################################
######################## FINAL DROP ################################################################
nft add rule inet filter input drop
nft add rule inet filter forward drop
nft add rule inet filter output drop
############################## SAVE RULES ##############################################################
echo SAVING RULES
#DEBIAN
nft list ruleset > /etc/nftables.conf
echo "ENDWALL NFT DISABLED"
############################## PRINT RULES ################################################################
#list the rules
nft list ruleset;
#
#
############################# PRINT ADDRESSES ########################################################################
echo "GATEWAY_1 : MAC:"$gateway_mac1" IPv4:"$gateway_ip1" "
echo "INTERFACE_1: "$int_if1" MAC:"$int_mac1" IPv4:"$int_ip1" IPv6:"$int_ip1v6" "
echo "GATEWAY_2 : MAC:"$gateway_mac2" IPv4:"$gateway_ip2" "
echo "INTERFACE_2: "$int_if2" MAC:"$int_mac2" IPv4:"$int_ip2" IPv6:"$int_ip2v6" "
# print the time the script finishes
date
exit 0
fi
if [ "$state" = "test" ]
then
### This is a compact set of rules for testing
### This should actually be a better default ruleset rather than all open
### acces with --test option
############################ DEFUALT POLICY ####################################################################
# make a new table called filter
nft add table inet filter #inet does both ip and ip6
#nft add table ip filter # ip filter table
#nft add table ip6 filter # ip6 filter table
# Make some default chains
nft add chain inet filter input '{ type filter hook input priority 0 ; policy drop ; }'
nft add chain inet filter forward '{ type filter hook forward priority 0 ; policy drop ; }'
nft add chain inet filter output '{ type filter hook output priority 0 ; policy drop ; }'
############################## TEST RULES #############################################################################
# Drop invalid
nft add rule inet filter input ct state invalid drop;
nft add rule inet filter output ct state invalid drop;
### Accept all loopback
#nft add rule inet filter input iifname lo accept
lo_open udp 53,67,68,80,443
lo_open tcp 53,67,68,80,443
lo_icmp
nft add rule inet filter input iifname lo counter log drop
nft add rule inet filter output oifname lo counter log drop
### Accept all output
#nft add rule inet filter output accept
client_out_wifi tcp 53,67,68,80,443
client_out_wifi udp 53,67,68,80,443
### ICMP
icmp_out "wlan0"
icmp_out "eth0"
## Accept all input from icmp
#nft add rule inet filter input iifname wlan0 ip protocol icmp accept
#nft add rule inet filter input iifname eth0 ip protocol icmp accep
#######################################################################################
######################## FINAL DROP ###################################################
nft add rule inet filter input drop
nft add rule inet filter forward drop
nft add rule inet filter output drop
############################## SAVE RULES ##############################################################
echo SAVING RULES
#DEBIAN
nft list ruleset > /etc/nftables.conf
echo "ENDWALL NFT DISABLED"
############################## PRINT RULES ################################################################
#list the rules
nft list ruleset;
#
#
############################# PRINT ADDRESSES ########################################################################
echo "GATEWAY_1 : MAC:"$gateway_mac1" IPv4:"$gateway_ip1" "
echo "INTERFACE_1: "$int_if1" MAC:"$int_mac1" IPv4:"$int_ip1" IPv6:"$int_ip1v6" "
echo "GATEWAY_2 : MAC:"$gateway_mac2" IPv4:"$gateway_ip2" "
echo "INTERFACE_2: "$int_if2" MAC:"$int_mac2" IPv4:"$int_ip2" IPv6:"$int_ip2v6" "
# print the time the script finishes
date
exit 0
fi
if [ "$state" = "closed" ]
then
########################### DEFUALT POLICY ####################################################################
# make a new table called filter
nft add table inet filter #inet does both ip and ip6
#nft add table ip filter # ip filter table
#nft add table ip6 filter # ip6 filter table
# Make some default chains
nft add chain inet filter input '{ type filter hook input priority 0 ; policy drop ; }'
nft add chain inet filter forward '{ type filter hook forward priority 0 ; policy drop ; }'
nft add chain inet filter output '{ type filter hook output priority 0 ; policy drop ; }'
##########################################################################################################################
# load the previously saved rules
# DEBIAN
#nft -f /etc/nftables.conf
############################ DEFINE CUSTOM CHAINS #####################################################################
#iptables -N LnD # Define custom DROP chain
## create a new table. Error if this already exists
#nft create table inet endtable
## add a new base chain: get input packets
#nft add chain inet endtable LnD { type filter hook input priority filter; policy drop; }
## count traffic in the chain
#nft add rule inet endtable LnD counter
## Log traffic in the chain
#nft add rule inet endtable LnD comment "LnD"
# drop
#nft add rule innet endtable LnD drop
#iptables -N LnD # Define custom DROP chain
#iptables -A LnD -p tcp -m limit --limit 1/s -j LOG --log-prefix "[TCP drop] "
#iptables -A LnD -p udp -m limit --limit 1/s -j LOG --log-prefix "[UDP drop] "
#iptables -A LnD -p icmp -m limit --limit 1/s -j LOG --log-prefix "[ICMP drop] "
#iptables -A LnD -f -m limit --limit 1/s -j LOG --log-prefix "[FRAG drop] "
#iptables -A LnD -j DROP
# iptables -N LnR # Define custom REJECT chain
# iptables -N PASS # Define PASS chain
#######################################################################################################################
# BASIC FIRST LINE SECURITY
#######################################################################################################################
echo "LOADING FIRST LINE SECURITY"
###########################################################################################
#######################################################################################################################
# DROP RESTRICTED SPECIAL USE IPv4 NETWORKS / IP SPOOFING
#######################################################################################################################
############################# DROP LINK-LOCAL ADDRESSES ###############################################################
# Drop invalid
nft add rule inet filter input ct state invalid drop;
nft add rule inet filter output ct state invalid drop;
#
nft add rule inet filter input ip saddr 169.254.0.0/16 drop
nft add rule inet filter input ip daddr 169.254.0.0/16 drop
############################### DROP OUTBOUND BROADCAST ###############################################################
# drop broadcast outbound
nft add rule inet filter output ip daddr 255.255.255.255 drop
##################### DROP PRIVATE LAN INPUT OF WRONG CLASS/TYPE ################################################
# nft add rule filter input ip saddr 10.0.0.0/8 drop;
# nft add rule filter input ip saddr 172.16.0.0/12 drop;
# nft add rule filter input ip saddr 192.168.0.0/16 drop;
# uncomment private lan network classss that are not not applicable to your network to drop them
# use an if statement to check gateway ip against 10,172,192 (not implemented currently)
echo "FIRST LINE SECURITY LOADED"
#####################################################################################################################################################
#####################################################################################################################################################
# LOCAL HOST RULES
#############################################################################################
echo "LOADING LOCALHOST RULES"
##################################### BOOTP ############################################
lo_open udp 67,68
##################################### DHCPv6 ###########################################
lo_open tcp 546,547
lo_open udp 546,547
################################## DNS ###################################################
lo_open udp 53,953
lo_open tcp 53,953
########################### TELNET SSH #####################################################
lo_open tcp 22,23
########################### SMTP ############################################################
lo_open tcp 25,587,465
############################ FTP ############################################################
lo_open tcp 20,21,989,990,2121
lo_open udp 20,21,989,990,2121
# 50000-55663
lo_open tcp 50000-55663
lo_open udp 50000-55663
lo_open tcp 60000-60100
lo_open udp 60000-60100
########################### HTTP,HTTPS ######################################################
lo_open tcp 80,443
#lo6_open tcp 80,443
########################### GOPHER ##########################################################
lo_open tcp 70
lo_open udp 70
############################ IMAP,IMAPS #####################################################