�t�@�C�A�E�H�[���\�z(firewalld)

�ŏI�X�V���F 2023.01.13

���T�v

Linux�T�[�o�[��Ƀt�@�C�A�E�H�[�����\�z����B
�����ł́ALinux�̃p�P�b�g�t�B���^�����O�@�\�ł���firewalld���g�p���āAWeb���O���Ɍ��J����T�[�r�X�ȊO�̃|�[�g�ւ̃A�N�Z�X���u���b�N����悤�ɂ���B

���ʏ�̓��[�^�[���ɂ��t�@�C�A�E�H�[���@�\�����邽�߁ALinux�T�[�o�[��Ńt�@�C�A�E�H�[�����\�z��Ƀ|�[�g���J������ꍇ�́A���[�^�[����Linux�T�[�o�[����2�ӏ��Ń|�[�g�J�����s���K�v�����邱�Ƃɒ���

�y�z�肷��l�b�g���[�N�‹��z




��firewalld�ݒ�

�i�P�jfirewalld�ݒ�
[root@centos ~]# vi firewall.sh�@���@�t�@�C�A�E�H�[���ݒ�X�N���v�g�쐬
#!/bin/bash

#---------------------------------------#
# �ݒ�J�n                              #
#---------------------------------------#

# �����l�b�g���[�N�A�h���X��`
LOCALNET=192.168.1.0/24

#---------------------------------------#
# �ݒ�I��                              #
#---------------------------------------#

#
# �t�@�C�A�E�H�[���ݒ菉����
#
systemctl stop firewalld
rm -f /etc/firewalld/zones/*
rm -f /etc/firewalld/ipsets/*
systemctl start firewalld
firewall-cmd --reload >/dev/null

#
# ��������̃A�N�Z�X������
#
firewall-cmd --add-rich-rule="rule family="ipv4" source address="10.0.0.0/8" accept" --permanent >/dev/null
firewall-cmd --add-rich-rule="rule family="ipv4" source address="172.16.0.0/12" accept" --permanent >/dev/null
firewall-cmd --add-rich-rule="rule family="ipv4" source address="192.168.0.0/16" accept" --permanent >/dev/null
firewall-cmd --add-rich-rule="rule family="ipv4" source address="${LOCALNET}" accept" --permanent >/dev/null

#
# SYN Cookies��L���ɂ���
# ��TCP SYN Flood�U���΍�
#
sysctl -w net.ipv4.tcp_syncookies=1 > /dev/null
sed -i '/net.ipv4.tcp_syncookies/d' /etc/sysctl.conf
echo "net.ipv4.tcp_syncookies=1" >> /etc/sysctl.conf

#
# �u���[�h�L���X�g�A�h���X��ping�ɂ͉������Ȃ�
# ��Smurf�U���΍�
#
sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1 > /dev/null
sed -i '/net.ipv4.icmp_echo_ignore_broadcasts/d' /etc/sysctl.conf
echo "net.ipv4.icmp_echo_ignore_broadcasts=1" >> /etc/sysctl.conf

#
# ICMP Redirect�p�P�b�g�͋���
#
sed -i '/net.ipv4.conf.*.accept_redirects/d' /etc/sysctl.conf
for dev in `ls /proc/sys/net/ipv4/conf/`
do
    sysctl -w net.ipv4.conf.$dev.accept_redirects=0 > /dev/null
    echo "net.ipv4.conf.$dev.accept_redirects=0" >> /etc/sysctl.conf
done

#
# Source Routed�p�P�b�g�͋���
#
sed -i '/net.ipv4.conf.*.accept_source_route/d' /etc/sysctl.conf
for dev in `ls /proc/sys/net/ipv4/conf/`
do
    sysctl -w net.ipv4.conf.$dev.accept_source_route=0 > /dev/null
    echo "net.ipv4.conf.$dev.accept_source_route=0" >> /etc/sysctl.conf
done

#
# IP�A�h���X���X�g�擾
#
IP_LIST=/tmp/cidr.txt
CHK_IP_LIST=/tmp/IPLIST
if [ ! -f ${IP_LIST} ]; then
    wget -q http://nami.jp/ipv4bycc/cidr.txt.gz
    gunzip -c cidr.txt.gz > ${IP_LIST}
    rm -f cidr.txt.gz
fi
rm -f ${CHK_IP_LIST}


#
# �]�[��(���{����)�쐬
#

# domestic(���{����)�]�[���쐬
firewall-cmd --new-zone=domestic --permanent >/dev/null

# domestic(���{����)IP�Z�b�g�쐬
firewall-cmd --new-ipset=domestic --type=hash:net --permanent >/dev/null

# ���{������IP�A�h���X���X�g�쐬
domestic_ipset=`mktemp`
for addr in `cat ${IP_LIST} | grep ^JP | awk '{print $2}'`
do
    echo ${addr} >> ${domestic_ipset}
done

# ���{������IP�A�h���X���X�g��domestic(���{����)IP�Z�b�g�ɓo�^
firewall-cmd --ipset=domestic --add-entries-from-file=${domestic_ipset} --permanent >/dev/null
rm -f ${domestic_ipset}

# domestic(���{����)IP�Z�b�g��domestic(���{����)�]�[���ɓo�^
firewall-cmd --zone=domestic --add-source=ipset:domestic --permanent >/dev/null

# IP�A�h���X�X�V�`�F�b�N�p�ɑޔ�
grep ^JP ${IP_LIST} >> $CHK_IP_LIST

# �ȍ~,���{��������̂݃A�N�Z�X�����‚������ꍇ��domestic�]�[���ɃT�[�r�X��lj�����

# �S���x�@�{�݂ւ̍U������ʂT�J��(���{�E�A�����J������)����̃A�N�Z�X��j��
# ���߂P�T�Ԃ̏� https://www.npa.go.jp/bureau/cyber/koho/observation.html
# ���R�[�h�ꗗ https://ja.wikipedia.org/wiki/ISO_3166-1#%E7%95%A5%E5%8F%B7%E4%B8%80%E8%A6%A7
DROP_COUNTRY_LIST=(BG HK RO CN GB)

# drop_country(�A�N�Z�X�֎~��)IP�Z�b�g�쐬
firewall-cmd --new-ipset=drop_country --type=hash:net --permanent >/dev/null

# �A�N�Z�X�֎~����IP�A�h���X���X�g�쐬
drop_ipset=`mktemp`
for country in "${DROP_COUNTRY_LIST[@]}"
do
    for addr in `cat ${IP_LIST} | grep ^${country} | awk '{print $2}'`
    do
        echo ${addr} >> ${drop_ipset}
    done
    grep ^${country} ${IP_LIST} >> ${CHK_IP_LIST}
done

# �A�N�Z�X�֎~����IP�A�h���X���X�g��drop_country(�A�N�Z�X�֎~��)IP�Z�b�g�ɓo�^
firewall-cmd --ipset=drop_country --add-entries-from-file=${drop_ipset} --permanent >/dev/null
rm -f ${drop_ipset}

# drop_country(�A�N�Z�X�֎~��)IP�Z�b�g��drop�]�[���ɓo�^
firewall-cmd --zone=drop --add-source=ipset:drop_country --permanent >/dev/null

#----------------------------------------------------------#
# �e��T�[�r�X�����J����ꍇ�̐ݒ�(��������)               #
#----------------------------------------------------------#

# �O�������SSH(TCP22�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂݋���
# ��SSH�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --remove-service=ssh --zone=public --permanent >/dev/null
firewall-cmd --add-service=ssh --zone=domestic --permanent >/dev/null

# �O�������DNS(TCP/UDP53�ԃ|�[�g)�ւ̃A�N�Z�X������
# ���O������DNS�T�[�o�[���^�p����ꍇ�̂�
firewall-cmd --add-service=dns --zone=domestic --permanent >/dev/null
firewall-cmd --add-service=dns --zone=public --permanent >/dev/null

# �O�������HTTP(TCP80�ԃ|�[�g)�ւ̃A�N�Z�X������
# ��Web�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --add-service=http --zone=domestic --permanent >/dev/null
firewall-cmd --add-service=http --zone=public --permanent >/dev/null

# �O�������HTTPS(TCP443�ԃ|�[�g)�ւ̃A�N�Z�X������
# ��Web�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --add-service=https --zone=domestic --permanent >/dev/null
firewall-cmd --add-service=https --zone=public --permanent >/dev/null

# �O�������SMTP(TCP25�ԃ|�[�g)�ւ̃A�N�Z�X������
# ��SMTP�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --add-service=smtp --zone=domestic --permanent >/dev/null
firewall-cmd --add-service=smtp --zone=public --permanent >/dev/null

# �O�������SUBMISSION(TCP587�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂݋���
# ��SMTP�T�[�o�[�����J����ꍇ�̂�
# ��SMTPS�T�[�o�[�iTCP465�ԃ|�[�g�j�����J����ꍇ�͕s�v
firewall-cmd --add-service=smtp-submission --zone=domestic --permanent >/dev/null

# �O�������SMTPS(TCP465�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂݋���
# ��SMTPS�T�[�o�[�����J����ꍇ�̂� 2>&1
firewall-cmd --add-service=smtps --zone=domestic --permanent >/dev/null

# �O�������POP3(TCP110�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂݋���
# ��POP3�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --add-service=pop3 --zone=domestic --permanent >/dev/null

# �O�������POP3S(TCP995�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂݋���
# ��POP3S�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --add-service=pop3s --zone=domestic --permanent >/dev/null

# �O�������IMAP(TCP143�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂݋���
# ��IMAP�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --add-service=imap --zone=domestic --permanent >/dev/null

# �O�������IMAPS(TCP993�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂݋���
# ��IMAPS�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --add-service=imaps --zone=domestic --permanent >/dev/null

# �O�������L2TP over IPsec(UDP500�ԃ|�[�g�AUDP4500�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂݋���
# ��SoftEther VPN Server�����J����ꍇ�̂�
firewall-cmd --add-service=ipsec --zone=domestic --permanent >/dev/null

# �O�������Usermin(TCP20000�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂݋���
# ��Usermin�T�[�o�[�����J����ꍇ�̂�
firewall-cmd --add-port=20000/tcp --zone=domestic --permanent >/dev/null

# �O�������Jpsonic(TCP8080�ԃ|�[�g)�ւ̃A�N�Z�X����{��������̂݋���
# ��Jpsonic�����J����ꍇ�̂�
firewall-cmd --add-port=8080/tcp --zone=domestic --permanent >/dev/null

# �O�������Mattermost server Calls�v���O�C��(UDP8443�ԃ|�[�g)�ւ̃A�N�Z�X������
# ��Mattermost server�����J����ꍇ�̂�
firewall-cmd --add-port=8443/udp --zone=domestic --permanent >/dev/null
firewall-cmd --add-port=8443/udp --zone=public --permanent >/dev/null

#----------------------------------------------------------#
# �e��T�[�r�X�����J����ꍇ�̐ݒ�(�����܂�)               #
#----------------------------------------------------------#

# ����IP�A�h���X����̃A�N�Z�X�̓��O���L�^�����ɔj��
# ������IP�A�h���X��/root/deny_ip��1�s���ƂɋL�q���Ă�������
# (/root/deny_ip���Ȃ���΂Ȃɂ����Ȃ�)
if [ -s /root/deny_ip ]; then
    for ip in `cat /root/deny_ip`
    do
        firewall-cmd --zone=drop --permanent --add-source=${ip} --permanent >/dev/null
    done
fi


# �t�@�C�A�E�H�[���ݒ蔽�f
firewall-cmd --reload >/dev/null



�i�Q�jIP�A�h���X���X�g�X�V�`�F�b�N
IP�A�h���X���X�g�͕p�ɂɍX�V�����̂ŁA����������IP�A�h���X���X�g�̍X�V�L�����`�F�b�N���A�X�V������ꍇ�̓t�@�C�A�E�H�[���ݒ�X�N���v�g���ċN������悤�ɂ���B
[root@centos ~]# vi /etc/cron.daily/iplist_check.sh�@���@IP�A�h���X���X�g�`�F�b�N�X�N���v�g�쐬
#!/bin/bash

PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# �V��IPLIST�����`�F�b�N����(0���w�肷��ƃ`�F�b�N���Ȃ�)
# ���V��IPLIST������SABUN_CHK�Ŏw�肵���������z����ꍇ��firewall�ݒ�X�N���v�g�����s���Ȃ�
# ���V��IPLIST�����`�F�b�N���R��http://centossrv.com/bbshtml/webpatio/1592.shtml���Q��
SABUN_CHK=100
[ $# -ne 0 ] && SABUN_CHK=${1}

# IP�A�h���X���X�g�擾
IP_LIST=/tmp/cidr.txt
CHK_IP_LIST=/tmp/IPLIST
wget -q http://nami.jp/ipv4bycc/cidr.txt.gz
gunzip -c cidr.txt.gz > $IP_LIST
rm -f cidr.txt.gz

# �`�F�b�N�Ώ�IP�A�h���X���X�g�ŐV��
rm -f IPLIST.new
for country in `awk '{print $1}' $CHK_IP_LIST |uniq`
do
    grep ^$country $IP_LIST >> IPLIST.new
done

# �`�F�b�N�Ώ�IP�A�h���X���X�g�X�V�`�F�b�N
diff -q $CHK_IP_LIST IPLIST.new > /dev/null 2>&1
if [ $? -ne 0 ]; then
    if [ ${SABUN_CHK} -ne 0 ]; then
        if [ $(diff $CHK_IP_LIST IPLIST.new | egrep -c '<|>') -gt ${SABUN_CHK} ]; then
            (
             diff $CHK_IP_LIST IPLIST.new
             echo
             echo "firewall.sh not executed."
            ) | mail -s 'IPLIST UPDATE' root
            rm -f IPLIST.new
            exit
        fi
    fi
    /bin/mv IPLIST.new $CHK_IP_LIST
    sh /root/firewall.sh > /dev/null
else
    rm -f IPLIST.new
fi

[root@centos ~]# chmod +x /etc/cron.daily/iplist_check.sh�@���@IP�A�h���X���X�g�`�F�b�N�X�N���v�g�Ɏ��s�����t��
��CRON���/root/firewall.sh not executed.�Ƃ������e�̃��[�����͂����ꍇ�̑Ώ�
�Ȃ�炩�̗��R�ŁAhttp://nami.jp/ipv4bycc/����擾�����ŐV��IP�A�h���X���X�g�ƁA�O��擾����IP�A�h���X���X�g�Ƃ̍�����100���𒴂������߁Afirewall�ݒ�X�N���v�g�����s���Ȃ��������Ƃ������B
�T�[�o�[�𒷎��Ԓ�~���Ă������A�O��擾����IP�A�h���X���X�g�Ƃ̍�����100���𒴂��闝�R�����m�ȏꍇ�ɂ́A�u/etc/cron.daily/iplist_check.sh 0�v�Ǝ��s���邱�Ƃɂ�苭���I��firewall�ݒ�X�N���v�g�����s����B


��firewalld�N��

[root@centos ~]# bash firewall.sh�@���@�t�@�C�A�E�H�[���ݒ�X�N���v�g���s

[root@centos ~]# systemctl enable firewalld�@���@firewall�����N���ݒ�


��firewalld�m�F

[root@centos ~]# firewall-cmd --get-default-zone�@���@�f�t�H���g�]�[���m�F
public

[root@centos ~]# firewall-cmd --get-active-zones�@���@�A�N�e�B�u�]�[���m�F
domestic
  sources: ipset:domestic
drop
  sources: ipset:drop_country
public
  interfaces: br0 ens3
  
[root@centos ~]# firewall-cmd --list-all --zone=domestic�@���@domestic�]�[�����m�F
domestic (active)
  target: default�@���@���‚��Ă��Ȃ��A�N�Z�X�͋���
  icmp-block-inversion: no
  interfaces:
  sources: ipset:domestic�@���@IP�Z�b�g(���{����)
  services: imap imaps ipsec pop3 pop3s smtp-submission smtps ssh�@���@�T�[�r�X
  ports: 20000/tcp 4040/tcp�@���@�|�[�g
  protocols:
  forward: no
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
���{��������̂ݎw��T�[�r�X�A�|�[�g�ւ̃A�N�Z�X�����‚���

[root@centos ~]# firewall-cmd --list-all --zone=drop�@���@drop�]�[�����m�F
drop (active)
  target: DROP�@���@�A�N�Z�X��j��
  icmp-block-inversion: no
  interfaces:
  sources: ipset:drop_country�@���@IP�Z�b�g(�A�N�Z�X�֎~��)
  services:
  ports:
  protocols:
  forward: no
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
�A�N�Z�X�֎~������̃A�N�Z�X��j������

[root@centos ~]# firewall-cmd --list-all --zone=public�@���@public�]�[�����m�F
public (active)
  target: default�@���@���‚��Ă��Ȃ��A�N�Z�X�͋���
  icmp-block-inversion: no
  interfaces: br0 ens3
  sources:
  services: cockpit dhcpv6-client dns http https smtp�@���@�T�[�r�X
�w��T�[�r�X�ւ̃A�N�Z�X�����‚���
  ports:
  protocols:
  forward: no
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
        rule family="ipv4" source address="10.0.0.0/8" accept
        rule family="ipv4" source address="192.168.0.0/16" accept
        rule family="ipv4" source address="192.168.1.0/24" accept
        rule family="ipv4" source address="172.16.0.0/12" accept
�w��l�b�g���[�N�A�h���X����̃A�N�Z�X�����‚���

[root@centos ~]# firewall-cmd --permanent --ipset=domestic --get-entries�@���@domesticIP�Z�b�g�m�F
���{������IP�A�h���X�ꗗ���o�͂����

[root@centos ~]# firewall-cmd --permanent --ipset=drop_country --get-entries�@���@drop_countryIP�Z�b�g�m�F
�w�肵���A�N�Z�X�֎~����IP�A�h���X�ꗗ���o�͂����

Shields UP! - Internet Vulnerability Profiling�ŁuProceed�v�{�^��(�Q�‚��邪�ǂ���ł��悢)���N���b�N�ˁuAll Service Ports�v�{�^�����N���b�N���āA�O������̃A�N�Z�X�����‚܂��͋��ۉ������Ă���|�[�g�̂�OPEN�܂���CLOSED�ŁA���̑��̃|�[�g��STEALTH�ł��邱�Ƃ��m�F


���֘A�R���e���c




�����̃y�[�W�̃g�b�v�֖߂�

�v���C�o�V�[�|���V�[
centossrv.com