[root@centos ~]# vi firewall.sh�@���@�t�@�C�A�E�H�[���ݒ�X�N���v�g�쐬
#!/bin/bash
#---------------------------------------#
# �ݒ�J�n #
#---------------------------------------#
# �����l�b�g���[�N�A�h���X��`
LOCALNET=192.168.1.0/24
#---------------------------------------#
# �ݒ�I�� #
#---------------------------------------#
#
# �t�@�C�A�E�H�[���ݒ菉����
#
systemctl stop firewalld
rm -f /etc/firewalld/zones/*
rm -f /etc/firewalld/ipsets/*
systemctl start firewalld
firewall-cmd --reload >/dev/null
#
# ��������̃A�N�Z�X������
#
firewall-cmd --add-rich-rule="rule family="ipv4" source address="10.0.0.0/8" accept" --permanent >/dev/null
firewall-cmd --add-rich-rule="rule family="ipv4" source address="172.16.0.0/12" accept" --permanent >/dev/null
firewall-cmd --add-rich-rule="rule family="ipv4" source address="192.168.0.0/16" accept" --permanent >/dev/null
firewall-cmd --add-rich-rule="rule family="ipv4" source address="${LOCALNET}" accept" --permanent >/dev/null
#
# SYN Cookies��L���ɂ���
# ��TCP SYN Flood�U����
#
sysctl -w net.ipv4.tcp_syncookies=1 > /dev/null
sed -i '/net.ipv4.tcp_syncookies/d' /etc/sysctl.conf
echo "net.ipv4.tcp_syncookies=1" >> /etc/sysctl.conf
#
# �u���[�h�L���X�g�A�h���X��ping�ɂ͉������Ȃ�
# ��Smurf�U����
#
sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1 > /dev/null
sed -i '/net.ipv4.icmp_echo_ignore_broadcasts/d' /etc/sysctl.conf
echo "net.ipv4.icmp_echo_ignore_broadcasts=1" >> /etc/sysctl.conf
#
# ICMP Redirect�p�P�b�g�͋���
#
sed -i '/net.ipv4.conf.*.accept_redirects/d' /etc/sysctl.conf
for dev in `ls /proc/sys/net/ipv4/conf/`
do
sysctl -w net.ipv4.conf.$dev.accept_redirects=0 > /dev/null
echo "net.ipv4.conf.$dev.accept_redirects=0" >> /etc/sysctl.conf
done
#
# Source Routed�p�P�b�g�͋���
#
sed -i '/net.ipv4.conf.*.accept_source_route/d' /etc/sysctl.conf
for dev in `ls /proc/sys/net/ipv4/conf/`
do
sysctl -w net.ipv4.conf.$dev.accept_source_route=0 > /dev/null
echo "net.ipv4.conf.$dev.accept_source_route=0" >> /etc/sysctl.conf
done
#
# IP�A�h���X���X�g�擾
#
IP_LIST=/tmp/cidr.txt
CHK_IP_LIST=/tmp/IPLIST
if [ ! -f ${IP_LIST} ]; then
wget -q http://nami.jp/ipv4bycc/cidr.txt.gz
gunzip -c cidr.txt.gz > ${IP_LIST}
rm -f cidr.txt.gz
fi
rm -f ${CHK_IP_LIST}
#
# �]�[��(���{����)�쐬
#
# domestic(���{����)�]�[���쐬
firewall-cmd --new-zone=domestic --permanent >/dev/null
# domestic(���{����)IP�Z�b�g�쐬
firewall-cmd --new-ipset=domestic --type=hash:net --permanent >/dev/null
# ���{������IP�A�h���X���X�g�쐬
domestic_ipset=`mktemp`
for addr in `cat ${IP_LIST} | grep ^JP | awk '{print $2}'`
do
echo ${addr} >> ${domestic_ipset}
done
# ���{������IP�A�h���X���X�g��domestic(���{����)IP�Z�b�g�ɓo�^
firewall-cmd --ipset=domestic --add-entries-from-file=${domestic_ipset} --permanent >/dev/null
rm -f ${domestic_ipset}
# domestic(���{����)IP�Z�b�g��domestic(���{����)�]�[���ɓo�^
firewall-cmd --zone=domestic --add-source=ipset:domestic --permanent >/dev/null
# IP�A�h���X�X�V�`�F�b�N�p�ɑޔ�
grep ^JP ${IP_LIST} >> $CHK_IP_LIST
# �ȍ~,���{��������̂݃A�N�Z�X�����������ꍇ��domestic�]�[���ɃT�[�r�X��lj�����
# �S���x�@�{�݂ւ̍U������ʂT�J��(���{�E�A�����J������)����̃A�N�Z�X��j��
# ���߂P�T�Ԃ̏� https://www.npa.go.jp/bureau/cyber/koho/observation.html
# ���R�[�h�ꗗ https://ja.wikipedia.org/wiki/ISO_3166-1#%E7%95%A5%E5%8F%B7%E4%B8%80%E8%A6%A7
DROP_COUNTRY_LIST=(BG HK RO CN GB)
# drop_country(�A�N�Z�X�֎~��)IP�Z�b�g�쐬
firewall-cmd --new-ipset=drop_country --type=hash:net --permanent >/dev/null
# �A�N�Z�X�֎~����IP�A�h���X���X�g�쐬
drop_ipset=`mktemp`
for country in "${DROP_COUNTRY_LIST[@]}"
do
for addr in `cat ${IP_LIST} | grep ^${country} | awk '{print $2}'`
do
echo ${addr} >> ${drop_ipset}
done
grep ^${country} ${IP_LIST} >> ${CHK_IP_LIST}
done
# �A�N�Z�X�֎~����IP�A�h���X���X�g��drop_country(�A�N�Z�X�֎~��)IP�Z�b�g�ɓo�^
firewall-cmd --ipset=drop_country --add-entries-from-file=${drop_ipset} --permanent >/dev/null
rm -f ${drop_ipset}
# drop_country(�A�N�Z�X�֎~��)IP�Z�b�g��drop�]�[���ɓo�^
firewall-cmd --zone=drop --add-source=ipset:drop_country --permanent >/dev/null
#----------------------------------------------------------#
# �e��T�[�r�X�����J����ꍇ�̐ݒ�(��������) #
#----------------------------------------------------------#
# �O�������SSH(TCP22�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂���
# ��SSH�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --remove-service=ssh --zone=public --permanent >/dev/null
firewall-cmd --add-service=ssh --zone=domestic --permanent >/dev/null
# �O�������DNS(TCP/UDP53�ԃ|�[�g)�ւ̃A�N�Z�X������
# ���O������DNS�T�[�o�[���^�p����ꍇ�̂�
firewall-cmd --add-service=dns --zone=domestic --permanent >/dev/null
firewall-cmd --add-service=dns --zone=public --permanent >/dev/null
# �O�������HTTP(TCP80�ԃ|�[�g)�ւ̃A�N�Z�X������
# ��Web�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --add-service=http --zone=domestic --permanent >/dev/null
firewall-cmd --add-service=http --zone=public --permanent >/dev/null
# �O�������HTTPS(TCP443�ԃ|�[�g)�ւ̃A�N�Z�X������
# ��Web�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --add-service=https --zone=domestic --permanent >/dev/null
firewall-cmd --add-service=https --zone=public --permanent >/dev/null
# �O�������SMTP(TCP25�ԃ|�[�g)�ւ̃A�N�Z�X������
# ��SMTP�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --add-service=smtp --zone=domestic --permanent >/dev/null
firewall-cmd --add-service=smtp --zone=public --permanent >/dev/null
# �O�������SUBMISSION(TCP587�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂���
# ��SMTP�T�[�o�[�����J����ꍇ�̂�
# ��SMTPS�T�[�o�[�iTCP465�ԃ|�[�g�j�����J����ꍇ�͕s�v
firewall-cmd --add-service=smtp-submission --zone=domestic --permanent >/dev/null
# �O�������SMTPS(TCP465�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂���
# ��SMTPS�T�[�o�[�����J����ꍇ�̂� 2>&1
firewall-cmd --add-service=smtps --zone=domestic --permanent >/dev/null
# �O�������POP3(TCP110�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂���
# ��POP3�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --add-service=pop3 --zone=domestic --permanent >/dev/null
# �O�������POP3S(TCP995�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂���
# ��POP3S�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --add-service=pop3s --zone=domestic --permanent >/dev/null
# �O�������IMAP(TCP143�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂���
# ��IMAP�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --add-service=imap --zone=domestic --permanent >/dev/null
# �O�������IMAPS(TCP993�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂���
# ��IMAPS�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --add-service=imaps --zone=domestic --permanent >/dev/null
# �O�������L2TP over IPsec(UDP500�ԃ|�[�g�AUDP4500�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂���
# ��SoftEther VPN Server�����J����ꍇ�̂�
firewall-cmd --add-service=ipsec --zone=domestic --permanent >/dev/null
# �O�������Usermin(TCP20000�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂���
# ��Usermin�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --add-port=20000/tcp --zone=domestic --permanent >/dev/null
# �O�������Jpsonic(TCP8080�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂���
# ��Jpsonic�����J����ꍇ�̂�
firewall-cmd --add-port=8080/tcp --zone=domestic --permanent >/dev/null
# �O�������Mattermost server Calls�v���O�C��(UDP8443�ԃ|�[�g)�ւ̃A�N�Z�X������
# ��Mattermost server�����J����ꍇ�̂�
firewall-cmd --add-port=8443/udp --zone=domestic --permanent >/dev/null
firewall-cmd --add-port=8443/udp --zone=public --permanent >/dev/null
#----------------------------------------------------------#
# �e��T�[�r�X�����J����ꍇ�̐ݒ�(�����܂�) #
#----------------------------------------------------------#
# ����IP�A�h���X����̃A�N�Z�X�̓��O���L�^�����ɔj��
# ������IP�A�h���X��/root/deny_ip��1�s���ƂɋL�q���Ă�������
# (/root/deny_ip���Ȃ���Ȃɂ����Ȃ�)
if [ -s /root/deny_ip ]; then
for ip in `cat /root/deny_ip`
do
firewall-cmd --zone=drop --permanent --add-source=${ip} --permanent >/dev/null
done
fi
# �t�@�C�A�E�H�[���ݒ蔽�f
firewall-cmd --reload >/dev/null
|
|