88 lines
2.2 KiB
Bash
88 lines
2.2 KiB
Bash
#!/bin/bash
|
|
|
|
### Firewall get info
|
|
|
|
printf "Do you want to set up firewall rules by iptables? [Y/n]: \n"
|
|
read ansFirewallSetup
|
|
|
|
|
|
if [[ "$ansFirewallSetup" =~ ("N"|"n") ]]; then
|
|
|
|
printf "+ Thanks, working on next bit\n"
|
|
|
|
|
|
elif [[ "$ansFirewallSetup" =~ ("Y"|"y") || -z $ansFirewallSetup ]]; then
|
|
|
|
printf "Do you want to block non-Tailscale ssh connections? [Y/n]: "
|
|
read sshBlockRange
|
|
|
|
|
|
if [[ "$sshBlockRange" =~ ("n"|"N") ]]; then
|
|
|
|
printf "If you want, input your own IP range [N/range]\n"
|
|
read sshRange
|
|
|
|
if [[ "$sshRange" =~ ("n"|"N") || -z $sshRange ]]; then
|
|
printf "+ Making your SSH connections wide and open. After we are done, do somethink with it. /n"
|
|
ipList="*"
|
|
else
|
|
printf "+ Accepting SSH connections only on these ip's: $sshRange\n"
|
|
ipList="$sshRange"
|
|
fi
|
|
|
|
fi
|
|
fi
|
|
|
|
|
|
### integration of Maxopoly's instructions on firewall
|
|
|
|
if [[ "$ansFirewallSetup" =~ ("Y"|"y") || -z "$ansFirewallSetup" ]]; then
|
|
|
|
printf "+ Executing firewall setup"
|
|
|
|
iptables -P INPUT ACCEPT #Clears existing rules
|
|
|
|
iptables -A INPUT -i lo -j ACCEPT #Allow loopback
|
|
|
|
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #Allow continuing connections
|
|
|
|
iptables -A INPUT -p tcp --dport 25577 -j ACCEPT #Allow Velocity port
|
|
|
|
if [[ "$ipList" = "*" ]]; then
|
|
|
|
### Wide and open
|
|
|
|
iiptables -A INPUT -p tcp --dport 22 j ACCEPT # Allow wide and open ssh on port 22
|
|
|
|
elif [[! "$ipList" -z ]]; then
|
|
|
|
### Manual IP range
|
|
|
|
iptables -A INPUT -p tcp --dport 22 --source $ipList -j ACCEPT # Allow limited ssh port 22
|
|
fi
|
|
|
|
iptables -L ### Good place to paste a manual check to not lock yourself out
|
|
|
|
printf "\n Does it looks right? [Y/n]: "
|
|
read ansFirewallOK
|
|
|
|
if [[ "$ansFirewallOK" =~ ("Y"|"y") || -z "$ansFirewallOK" ]]; then
|
|
|
|
iptables -P INPUT DROP #Disallow everythink else
|
|
|
|
iptables -P FORWARD DROP #Block all forwarding
|
|
|
|
iptables -P OUTPUT ACCEPT #Allow all outgouing
|
|
|
|
apt install iptables-persistent -y
|
|
|
|
else
|
|
|
|
printf "\nOK it is time for manual configuration"
|
|
printf "\nAfter you are done ramamber to run 'apt install iptables-persistent' to save your config. System will automaticly remove your work after restart"
|
|
|
|
fi
|
|
fi
|
|
|
|
|