Page MenuHomeDevCentral
Paste P21

/sbin/setup-network
ActivePublic
Actions

Authored by dereckson on Nov 29 2014, 08:06.
Tags
Referenced Files
F356: sbin_setup-network
Nov 29 2014, 08:06
Subscribers
None
#!/bin/sh
INTERFACE=ens192
WEB_PORTS=80,443
OPEN_PORTS=22,25,${WEB_PORTS}
IFCONFIG=/sbin/ifconfig
IPTABLES=/sbin/iptables
IP_EXEC=/sbin/ip
# Routing
${IP_EXEC} route change 62.210.76.1 dev $INTERFACE
${IP_EXEC} route change default via 62.210.76.1
# Resets and define default policies
$IPTABLES -F
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT
# Allows SSH, HTTP, HTTPS, SMTP
$IPTABLES -A INPUT -p tcp -m multiport --dports ${OPEN_PORTS} -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -p tcp -m multiport --dports ${OPEN_PORTS} -m state --state NEW,ESTABLISHED -j ACCEPT
# To very crudely mitigate DDoS, if we have 100 request by minute, we limit at 25 connections.
$IPTABLES -A INPUT -p tcp -m multiport --dports ${WEB_PORTS} -m limit --limit 25/minute --limit-burst 100 -j ACCEPT
# Allows ping
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
$IPTABLES -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
# Allows loopback
$IPTABLES -A INPUT -i lo -j ACCEPT
#$IPTABLES -A OUTPUT -o lo -j ACCEPT
# Allows DNS
#$IPTABLES -A OUTPUT -p udp --dport 53 -j ACCEPT
$IPTABLES -A INPUT -p udp --sport 53 -j ACCEPT
# Hurricane Electric tunnel
$IPTABLES -A INPUT -p 41 -j ACCEPT
${IP_EXEC} tunnel add he-ipv6 mode sit remote 216.66.84.42 local 212.129.32.223 ttl 255
${IP_EXEC} link set he-ipv6 up
${IP_EXEC} addr add 2001:470:1f12:ce7::2/64 dev he-ipv6
${IP_EXEC} addr add 2001:470:1f13:ce7:ca5:cade:fab:1e/64 dev he-ipv6
${IP_EXEC} route change ::/0 dev he-ipv6
# Drake peering with Ysul
${IP_EXEC} tunnel add tun0 mode gre remote 212.83.187.132 local 212.129.32.223
$IFCONFIG tun0 172.27.26.49
$IFCONFIG tun0 up
$IFCONFIG tun0 pointopoint 172.27.26.33
$IFCONFIG tun0 multicast

Event Timeline

dereckson edited the content of this paste. (Show Details)Nov 29 2014, 08:06
dereckson changed the title of this paste from untitled to /sbin/setup-network.
dereckson updated the paste's language from autodetect to bash.
dereckson added a project: Servers.
dereckson mentioned this in T169: Ensure /root/setup-network.service is installed and works correctly on Dwellers.
Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator