void

- enter the void 🪐
git clone git://git.acid.vegas/archlinux.git
pmf (1820B)
      1 #!/bin/sh
      2 # poor mans firewall - developed by acidvegas (https://git.acid.vegas/void)
      3 
      4 set -xev
      5 
      6 # Configuration
      7 PORT_SSH='22'
      8 
      9 # Kernel hardening settings
     10 mkdir -p /etc/sysctl.d
     11 {
     12   printf "net.ipv4.conf.all.accept_source_route = 0\n"
     13   printf "net.ipv6.conf.all.accept_source_route = 0\n"
     14   printf "net.ipv4.conf.all.rp_filter = 1\n"
     15   printf "net.ipv4.conf.default.rp_filter = 1\n"
     16   printf "net.ipv4.conf.all.accept_redirects = 0\n"
     17   printf "net.ipv6.conf.all.accept_redirects = 0\n"
     18   printf "net.ipv4.conf.default.accept_redirects = 0\n"
     19   printf "net.ipv6.conf.default.accept_redirects = 0\n"
     20   printf "net.ipv4.conf.all.log_martians = 1\n"
     21   printf "kernel.randomize_va_space = 2\n"
     22   printf "fs.suid_dumpable = 0\n"
     23 } > /etc/sysctl.d/99-custom-hardening.conf
     24 
     25 # Apply hardening settings
     26 sysctl -p /etc/sysctl.d/99-custom-hardening.conf
     27 
     28 # Flush existing rules
     29 iptables -F
     30 iptables -X
     31 iptables -t nat -F
     32 iptables -t nat -X
     33 iptables -t mangle -F
     34 iptables -t mangle -X
     35 
     36 # Default chain policies
     37 iptables -P INPUT DROP
     38 iptables -P FORWARD DROP
     39 iptables -P OUTPUT ACCEPT
     40 
     41 # Common Firewall rules
     42 iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
     43 iptables -A INPUT -p icmp --icmp-type echo-request     -j DROP # Disable response to ping requests
     44 iptables -A INPUT -p icmp --icmp-type port-unreachable -j DROP
     45 iptables -A INPUT -i lo -j ACCEPT
     46 
     47 # Allow SSH access from the Pi server
     48 iptables -A INPUT -p tcp --dport $PORT_SSH -j ACCEPT
     49 
     50 # Save rules
     51 iptables-save > /etc/iptables/iptables.rules
     52 
     53 # Create and configure the iptables service
     54 printf '#!/bin/sh\nexec 2>&1\niptables-restore < /etc/iptables/iptables.rules\nexec chpst -b iptables pause\n' > /etc/sv/iptables/run
     55 chmod +x /etc/sv/iptables/run
     56 ln -sf /etc/sv/iptables /var/service/ && sv restart iptables
     57 
     58 # Show rules
     59 iptables -L -v -n