Code:
#!/bin/sh
#
# APF 0.9.6 [apf@r-fx.org]
#
# NOTE: This file should be edited with word/line wrapping off,
# if your using pico please start it with the -w switch
# (e.g: pico -w filename)
#
##
# [Devel Mode]
# !!! Do not leave set to (1) !!!
# When set to enabled; 5 minute cronjob is set to stop the firewall. Set # this mode off (0) when firewall determined to be operating as desired.
##
# Set firewall cronjob (devel mode)
# 1 = enabled / 0 = disabled
DEVEL_MODE="0"
##
# [Main]
##
# The installation path of APF; this can be changed but it has not # been tested what would happen.
INSTALL_PATH="/etc/apf"
# Untrusted Network interface(s); all traffic on defined interface will be # subject to all firewall rules. This should be your internet exposed # interfaces. Only one interface is accepted for each value.
# NOTE: The interfacing structure is being worked towards support of MASQ/NAT IFACE_IN="eth0"
IFACE_OUT="eth0"
# Trusted Network interface(s); all traffic on defined interface(s) will by-pass # ALL firewall rules, format is white space or comma seperated list.
IFACE_TRUSTED=""
# Enable virtual network subsystem; creats independent policy ruleset for each # ip on a system (pulls data from 'ip addr list') to /etc/apf/vnet/ip.rules # Template is located in the vnet/ folder for rule files. This feature can # reduce apf start/stop performance and is not recommend for systems with more # than 255 (/24) ip's. [0 = Disabled / 1 = Enabled] SET_VNET="0"
# Support Monolithic kernel builds [no LKM's]. This mode of operation is # not really supported and you use at your own risk.
SET_MONOKERN="0"
# Verifies that all inbound traffic is sourced from a defined local gateway MAC # address. All other traffic that does not match this source MAC address will be # rejected as untrusted traffic. It is quite trivial to forge a MAC address and as # such this feature executes NO default accept policy against this MAC address.
VF_LGATE=""
# Verifies that the IF and IFACE_TRUSTED interfaces are actually routed (/sbin/route) # to something. If not then chances are APF will not start properly if at all.
VF_ROUTE="1"
# Verifies that crond service is running when DEVEL_MODE=1; if not then APF will not # try to load as if lock-up occures no cron service to flush firewall VF_CROND="1"
# Verifies that the current system uptime is greater than this value before APF # can activate. This is to prevent on-boot lockup issues or delays due to excessive # amount of firewall rules. Value is in seconds; should you wish to disable this # feature, simply set VF_UTIME to 0 value. !! NOTE: APF WILL NOT START ON IT's OWN; # IT WILL EXIT WITH FATAL ERROR BELOW SET UPTIME !!
VF_UTIME="0"
##
# [Packet Filtering/Handling]
##
# How to handle TCP packet filtering?
#
# RESET (sends a tcp-reset; TCP/IP default) # DROP (drop the packet; stealth ?) # REJECT (reject the packet) TCP_STOP="DROP"
# How to handle UDP packet filtering?
#
# RESET (sends a icmp-port-unreachable; TCP/IP default) # DROP (drop the packet; stealth ?) # REJECT (reject the packet) # PROHIBIT (send an icmp-host-prohibited) UDP_STOP="DROP"
# How to handle all other packet filtering? (icmp,arp,igmp) # # DROP (drop the packet) # REJECT (reject the packet) DSTOP="DROP"
# The sanity options control the way packets are scrutinized as # they flow through the firewall. The main PKT_SANITY option is a # top level toggle for all SANITY options and provides general # packet flag sanity as a pre-scrub for the other sanity options PKT_SANITY="1"
# Block any packets that do not conform as VALID; this feature # is safe for most but some may experience protocol issues with # broken remote clients PKT_SANITY_INV="0"
# Block any fragmented UDP packets; this is safe and no UDP # packets should ever be fragmented PKT_SANITY_FUDP="1"
# Block packets destination too or sourced from port 0 (Zero); this # is safe as nothing should communicate on port 0 (Zero) PKT_SANITY_PZERO="1"
# Block packets with stuffed routing
PKT_SANITY_STUFFED="0"
# Default Type of Service (TOS)
#
# These values should be set to a comma seperated list of ports # which you would like marked with the given TOS level #
# Set the default TOS value # Set the default TOS port range
TOS_DEF_TOS="4" TOS_DEF_RANGE="512:65535"
# 0: Ports for Normal-Service # 2: Ports for Minimize-Cost
TOS_0="" TOS_2=""
# 4: Ports for Minimize Delay - Maximize Reliability TOS_4="110,1110,465,993,995"
# 8: Ports for Maximum Throughput - Minimum Delay TOS_8="20,21"
# 16: Ports for No Delay - Moderate Throughput - High Reliability TOS_16="53,80,443"
# Allow traceroute requests on the defined range of ports. This feature # is not required for normal operations and some even desire it disabled.
# [0 = Disabled / 1 = Enabled]
# Enable Traceroute # Traceroute ports
TCR_PASS="1" TCR_PORTS="33434:33534"
# Set a reasonable packet/time ratio for ICMP packets; exceeding # such packet flow ratio will result in dropped packets.
# pkt/s (packets/seconds), pkt/m (packets/minutes) # Set value to 0 to disable, anything above is enabled ICMP_LIM="30/s"
# Use a dynamic discovery routine to parse and create rules based # on the local name servers defined in /etc/resolv.conf.
# [0 = Disabled / 1 = Enabled]
RESV_DNS="1"
# With RESV_DNS enabled; all untrusted name server traffic can fill # the logs with sport 53 traffic. This can be suppressed with an # implicit drop of all such traffic (sport 53 ingress) as so to avoid # the log chain.
RESV_DNS_DROP="1"
# A default drop for common p2p networks defined in the BLK_P2P_PORTS var; this # should be used on any server hosting and offering public services such as # web hosting and email services.
# [0 = Disabled / 1 = Enabled]
BLK_P2P="1"
BLK_P2P_PORTS="1214,2323,4660_4678,6257,6699,6346,6347,6881_6889,6346,7778"
# You need multicasting if you intend to participate in the MBONE, a # high bandwidth network on top of the Internet which carries audio # and video broadcasts. More about MBONE at: www-itg.lbl.gov/mbone/, # this is generally safe to enable. [0 = Disabled / 1 = Enabled] BLK_MCATNET="0"
# Block all private ipv4 addresses; this is address space reserved # for private networks; or otherwise unroutable on the internet.
# If this host resides behind a firewall with NAT or routing scheme # that otherwise uses private addressing; leave this option off.
# Refer to the 'internals/private.networks' file for listing of # address space. [0 = Disabled / 1 = Enabled] BLK_PRVNET="0"
# Block all ipv4 address space marked reserved for future use or # unassigned; such networks have no business communicating with us.
# However they may at some point become live address space. Refer to # the 'internals/reserved.networks' file for listing of address space.
# [0 = Disabled / 1 = Enabled]
BLK_RESNET="0"
# Block all ident (tcp 113) requests in and out of the server IF the # port is not opened in *_TCP_CPORTS. This uses a reject target to # make sure the ident requests terminate quickly. You can see a marked # increase in irc and ftp connection performance with this feature.
BLK_IDENT="0"
# This is the maximum number of "sessions" (connection tracking entries) # that can be handled simultaneously by the firewall in kernel memory.
# Increasing this value too high will simply waste memory; setting it # too low may result in some or all connections being refused, in paticular # during denial of service attacks.
SYSCTL_CONNTRACK="34576"
# These are sysctl hook changes to further harden the kernel from # network attack trends by lowering standard time-out values and other # time based packet responces. [0 = Disabled / 1 = Enabled] SYSCTL_TCP="1"
# These are sysctl hook changes intended to help mitigate syn-flood # attacks by lowering syn retry, syn backlog & syn time-out values.
# [0 = Disabled / 1 = Enabled]
SYSCTL_SYN="1"
# These are sysctl hook changes to provide protection from spoofed # packets, and arp/route redirection. [0 = Disabled / 1 = Enabled] SYSCTL_ROUTE="0"
# This sysctl hook will log all network traffic that is otherwise # not to/from a local interface and not multicast.
# [0 = Disabled / 1 = Enabled]
SYSCTL_LOGMARTIANS="0"
# This sysctl hook will allow you to enable or disable ECN support # (Explicit Congestion Notification); this feature provides an # improved method for congestion avoidance by allowing the network # to mark packets for transmission later, rather than dropping them # from the queue. [0 = Disabled / 1 = Enabled] SYSCTL_ECN="0"
# This sysctl hook will allow you to enable or disable SynCookies # support; this feature will send out a 'syn-cookie' when the syn # backlog for a socket becomes overflowed. The cookie is used to # interrupt the flow of syn transmissions with a hashed sequence # number that must be corrilated with the sending host. The hash # is made up of the sending host address, packet flags etc...; # if the sending host does not validate against the hash then the # tcp hand-shake is terminated. [0 = Disabled / 1 = Enabled] # Note: syncookies seriously violates TCP protocol and can result
# in serious degradation of some services (i.e. SMTP);
# visible not by you, but your clients and relays whom are
# contacting your system.
SYSCTL_SYNCOOKIES="1"
# This sysctl hook will allow you to toggle Abort_On_Overflow support; # This feature will help mitigate burst floods if a listening service # is too slow to accept new connections. This option is an alternative # for SynCookies and both should NEVER be enabled at once.
# [0 = Disabled / 1 = Enabled]
# Note: This option can harm clients contacting your system. Enable
# option only if you are sure that the listening daemon can not
# be tunned to accept connections faster.
SYSCTL_OVERFLOW="0"
# Common drop ports; these are implicit ports you do not want logged # with the default drop chains. Format is comma seperated and underscore # seperator for ranges (135_139). Ports are droped and ignored for both # TCP & UDP as well as inbound and outbound.
CDPORTS="135_139,111,513,520,445,1433,1434,1234,1524,3127"
##
# [Ingress]
# Configure ingress (inbound) accepted services. This is an optional # feature; services and customized entries may be made directly to an ip's # virtual net file located in the vnet/ directory. Format is comma seperated # and underscore seperator for ranges.
#
# Example:
# IG_TCP_CPORTS="21,22,25,53,80,443,110,143,6000_7000"
# IG_UDP_CPORTS="20,21,53,123"
# IG_ICMP_TYPES="3,5,11,0,30,8"
##
# Common ingress (inbound) TCP ports
IG_TCP_CPORTS="21,53,80,106,110,111,113,143,443,465,993,995,2705,3306,8443,32768"
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS="53,111,631,789,32768,32769"
# Common ICMP (inbound) types
# 'internals/icmp.types' for type definition; 'all' is wildcard for any IG_ICMP_TYPES="3,5,11,0,30,8"
##
# [Egress]
# Configure egress (outbound) accepted services. This is an optional # feature; services and customized entries may be made directly to an ip's # virtual net file located in the vnet/ directory.
#
# Egress filtering is not required but makes your firewall setup complete # by providing full inbound and outbound packet filtering. You can toggle # egress filtering on or off with the EGF variable. Format is comma seperated # and underscore seperator for ranges.
#
# Example:
# EG_TCP_CPORTS="21,80,443,43"
# EG_UDP_CPORTS="20,21,53"
# EG_ICMP_TYPES="all"
##
# Egress filtering [0 = Disabled / 1 = Enabled] EGF="0"
# Common egress (outbound) TCP ports
EG_TCP_CPORTS="21,80,443,43"
# Common egress (outbound) UDP ports
EG_UDP_CPORTS="20,21,53"
# Common ICMP egress (outbound) types
# 'internals/icmp.types' for type definition; 'all' is wildcard for any EG_ICMP_TYPES="all"
##
# [Egress UID match]
# Configure user-id specific egress (outbound) port access. This is a # more granular feature to limit the scope of egress packet flows with uid # conditioning. Format is comma seperated and underscore seperator for ranges.
#
# Format: EG_[TCP|UDP]_UID="uid:port"
# Example:
# Allow outbound access to destination port 22 for uid 0 # EG_TCP_UID="0:22"
##
# UID-Match egress (outbound) TCP ports
EG_TCP_UID=""
# UID-Match egress (outbound) UDP ports
EG_UDP_UID=""
##
# [Egress DROP CMD match]
# Configure executbale program names to DROP outgoing traffic for. This feature # denies the packets and logs them based on the CMD process field being passed # onto the netfilter functions so it can make use of the information.
#
# Format is comma seperated list of executable names you wish to ban from being # able to transmit data out of your server.
##
# CMD-Match egress (outbound) denied applications EG_DROP_CMD="eggdrop psybnc bitchx BitchX init udp.pl"
##
# [Imports]
# Configure importable rules
##
# DShield.org's "block" list of top networks that have exhibited # suspicious activity. [0 = Disabled / 1 = Enabled] USE_DS="1"
DS_URL="feeds.dshield.org/top10-2.txt" # block.txt url (no *://)
DS_URL_PROT="http" # protocol to use for wget
# This is an implamentation of the trust rules (allow/deny_hosts) but # on a global perspective. You can define below remote addresses from # which the glob_allow/deny.rules files should be downloaded from on # a daily basis. The files can be maintained in a static fashion by # leaving USE_RGT=0, appopriate for host serving the files.
# [0 = Disabled / 1 = Enabled]
USE_RGT="0"
GA_URL="yourhost.com/glob_allow.rules" # glob_allow.rules url (no *://)
GA_URL_PROT="http" # protocol for use with wget
GD_URL="yourhost.com/glob_deny.rules" # glob_deny.rules url (no *://)
GD_URL_PROT="http" # protocol for use with wget
# Update the reserved networks list in order to prevent new # ip assignments on the internet from getting blocked; this # option is only important when BLK_RESNET is set to enabled.
# [0 = Disabled / 1 = Enabled]
USE_RD="1"
RD_URL_PROT="http" # protocol to use for wget
RD_URL="r-fx.ca/downloads/reserved.networks" # reserved.networks url
# Import /etc/apf/ad/ad.rules ban list generated by antidos; # this is essentialy a quick enable/disable feature for # the insertion of such bans. [0 = Disabled / 1 = Enabled] USE_AD="0"
##
# [Logs]
# Logging and control settings
##
# Log traffic marked for log-drop or that reaches # the end of the firewall with no match. Disable # this option to reduce most output logging # [0 = Disabled / 1 = Enabled] LOG_DROP="0"
# What log level should we send all log data too?
# refer to syslog.conf for levels
LOG_LEVEL="crit"
# Where should we send all the logging data?
# ULOG (Allow ulogd to handle the logging) # LOG (Default; sends logging to kernel log) LOG_TARGET="LOG"
# Log interactive access over telnet & ssh; uses # custom log prefix of ** SSH ** & ** TELNET ** # [0 = Disabled / 1 = Enabled] LOG_IA="1"
# Log all forign gateway traffic
# [0 = Disabled / 1 = Enabled]
LOG_LGATE="0"
# Extended logging information; this forces the output of tcp options and # ip options for packets passing through the log chains # [0 = Disabled / 1 = Enabled] LOG_EXT="0"
# Max firewall events to log per/minute. Log events exceeding these limits # will be lost (1440 minutes/day * 30 events/minute = 43200 events per/day) LOG_RATE="30"
# Location of the apf status log; all startup, shutdown and runtime status # sends outputs to this file LOG_APF="/var/log/apf_log"
##
# [Import misc. vars]
##
#
# Internal vars file
CNFINT="$INSTALL_PATH/internals/internals.conf"
# Import internal vars file
. $CNFINT
Likes: 
Quote
