#!/bin/bash
# ═══════════════════════════════════════════════════
# 服务器防火墙基线模板
# ═══════════════════════════════════════════════════

set -e

# ─── 变量定义 ───
IPT="/usr/sbin/iptables"
IP6T="/usr/sbin/ip6tables"
SSH_SOURCES="10.0.0.0/8"        # SSH 允许的源网段
LOG_LIMIT="10/minute"            # 日志速率限制
LOG_BURST="30"                   # 日志突发上限

# ─── 清空规则 ───
$IPT -F && $IPT -t nat -F && $IPT -t mangle -F && $IPT -t raw -F && $IPT -X
$IP6T -F && $IP6T -X

# ─── IPv4 INPUT 链 ───

$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT ACCEPT

# 1. 已建立的连接（最高优先级）
$IPT -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# 2. 丢弃无效包
$IPT -A INPUT -m conntrack --ctstate INVALID -j DROP

# 3. 回环接口
$IPT -A INPUT -i lo -j ACCEPT

# 4. 防端口扫描
$IPT -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

# 5. SSH（限速 + 来源限制）
$IPT -A INPUT -p tcp --dport 22 -s $SSH_SOURCES --syn \
  -m hashlimit --hashlimit-above 4/minute --hashlimit-burst 4 \
  --hashlimit-mode srcip --hashlimit-name ssh_rate -j DROP
$IPT -A INPUT -p tcp --dport 22 -s $SSH_SOURCES \
  -m connlimit --connlimit-above 3 -j DROP
$IPT -A INPUT -p tcp --dport 22 -s $SSH_SOURCES -j ACCEPT

# 6. ICMP（限速）
$IPT -A INPUT -p icmp --icmp-type echo-request \
  -m limit --limit 5/sec --limit-burst 10 -j ACCEPT

# 7. 日志
$IPT -A INPUT -m limit --limit $LOG_LIMIT --limit-burst $LOG_BURST \
  -j LOG --log-prefix "IPT-INPUT-DROP: " --log-level 4

# 8. 最终拒绝
$IPT -A INPUT -j DROP

# ─── IPv6 INPUT 链 ───

$IP6T -P INPUT DROP
$IP6T -P FORWARD DROP
$IP6T -P OUTPUT ACCEPT

# 已建立的连接
$IP6T -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
$IP6T -A INPUT -m conntrack --ctstate INVALID -j DROP
$IP6T -A INPUT -i lo -j ACCEPT

# ICMPv6（必须允许关键类型）
$IP6T -A INPUT -p ipv6-icmp --icmpv6-type neighbor-solicitation -j ACCEPT
$IP6T -A INPUT -p ipv6-icmp --icmpv6-type neighbor-advertisement -j ACCEPT
$IP6T -A INPUT -p ipv6-icmp --icmpv6-type router-solicitation -j ACCEPT
$IP6T -A INPUT -p ipv6-icmp --icmpv6-type router-advertisement -j ACCEPT
$IP6T -A INPUT -p ipv6-icmp --icmpv6-type echo-request \
  -m limit --limit 5/sec -j ACCEPT
$IP6T -A INPUT -p ipv6-icmp --icmpv6-type destination-unreachable -j ACCEPT
$IP6T -A INPUT -p ipv6-icmp --icmpv6-type packet-too-big -j ACCEPT
$IP6T -A INPUT -p ipv6-icmp --icmpv6-type time-exceeded -j ACCEPT
$IP6T -A INPUT -p ipv6-icmp -j DROP

# SSH
$IP6T -A INPUT -p tcp --dport 22 -s 2001:db8::/32 -j ACCEPT

# 日志
$IP6T -A INPUT -m limit --limit $LOG_LIMIT --limit-burst $LOG_BURST \
  -j LOG --log-prefix "IP6-INPUT-DROP: " --log-level 4

$IP6T -A INPUT -j DROP

# ─── 内核安全参数 ───
sysctl -w net.ipv4.tcp_syncookies=1
sysctl -w net.ipv4.conf.all.rp_filter=1
sysctl -w net.ipv4.conf.default.rp_filter=1
sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
sysctl -w net.ipv6.conf.all.accept_ra=0
sysctl -w net.ipv6.conf.default.accept_ra=0

echo "Baseline firewall applied."

# /etc/sysctl.d/99-firewall-baseline.conf

# ─── IPv4 安全参数 ───
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# ─── IPv6 安全参数 ───
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_ra = 0
net.ipv6.conf.default.accept_ra = 0

# ─── conntrack 优化 ───
net.netfilter.nf_conntrack_max = 262144
net.netfilter.nf_conntrack_tcp_timeout_established = 1800
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 15
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 15
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 10
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 15
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 10
net.netfilter.nf_conntrack_udp_timeout = 10
net.netfilter.nf_conntrack_udp_timeout_stream = 60

# ─── 注释规范 ───
# 格式：# [日期] [负责人] [用途] [工单号]
# 示例：
iptables -A INPUT -p tcp --dport 80 -m comment \
  --comment "2026-05-10/zhangsan/Web服务/TICKET-1234" -j ACCEPT

# ─── 自定义链命名规范 ───
# 格式：服务名_方向_动作
# 示例：
iptables -N WEB_INPUT_ACCEPT     # Web 入站允许
iptables -N DB_INPUT_ACCEPT       # 数据库入站允许
iptables -N MGMT_INPUT_ACCEPT     # 管理入站允许
iptables -N MONITOR_INPUT_ACCEPT  # 监控入站允许

#!/bin/bash
# /usr/local/bin/firewall-audit.sh
# 防火墙规则定期审计脚本

REPORT="/var/log/firewall-audit-$(date +%Y%m%d).txt"

{
echo "========================================"
echo "防火墙审计报告 - $(date)"
echo "========================================"
echo ""

echo "一、规则统计"
echo "----------------------------------------"
echo "INPUT 链规则数: $(iptables -L INPUT -n | tail -n +3 | wc -l)"
echo "FORWARD 链规则数: $(iptables -L FORWARD -n | tail -n +3 | wc -l)"
echo "OUTPUT 链规则数: $(iptables -L OUTPUT -n | tail -n +3 | wc -l)"
echo "NAT PREROUTING 规则数: $(iptables -t nat -L PREROUTING -n | tail -n +3 | wc -l)"
echo "NAT POSTROUTING 规则数: $(iptables -t nat -L POSTROUTING -n | tail -n +3 | wc -l)"
echo ""

echo "二、默认策略"
echo "----------------------------------------"
iptables -L INPUT -n | head -1
iptables -L FORWARD -n | head -1
iptables -L OUTPUT -n | head -1
echo ""

echo "三、未命中的规则（潜在无用规则）"
echo "----------------------------------------"
iptables -L INPUT -n -v | awk 'NR>2 && $2+0 == 0 {print}'
echo ""

echo "四、最常命中的规则"
echo "----------------------------------------"
iptables -L INPUT -n -v --line-numbers | sort -k2 -n -r | head -10
echo ""

echo "五、连接跟踪状态"
echo "----------------------------------------"
echo "当前连接数: $(conntrack -C)"
echo "最大连接数: $(sysctl -n net.netfilter.nf_conntrack_max)"
COUNT=$(conntrack -C)
MAX=$(sysctl -n net.netfilter.nf_conntrack_max)
echo "使用率: $(( COUNT * 100 / MAX ))%"
echo ""

echo "六、内核安全参数"
echo "----------------------------------------"
for param in net.ipv4.tcp_syncookies \
             net.ipv4.conf.all.rp_filter \
             net.ipv4.icmp_echo_ignore_broadcasts \
             net.ipv4.conf.all.accept_redirects \
             net.ipv6.conf.all.accept_ra; do
    echo "$param = $(sysctl -n $param)"
done
echo ""

echo "七、自定义链列表"
echo "----------------------------------------"
iptables -L -n | grep "^Chain" | grep -v -E "(INPUT|OUTPUT|FORWARD)"
echo ""

echo "八、端口扫描防护规则"
echo "----------------------------------------"
iptables -L INPUT -n | grep -E "(FIN,PSH,URG|SYN,FIN|SYN,RST|ALL NONE)"
echo ""

} > "$REPORT"

echo "审计报告已生成: $REPORT"

# playbook: deploy-firewall.yml
---
- name: Deploy iptables firewall rules
  hosts: all
  become: yes
  vars:
    ssh_sources:
      - "10.0.0.0/8"
      - "192.168.1.0/24"
    web_ports:
      - "80"
      - "443"
    db_ports:
      - "3306"
      - "5432"
    log_limit: "10/minute"
    log_burst: "30"

  tasks:
    - name: Install iptables-persistent
      apt:
        name: iptables-persistent
        state: present
      when: ansible_os_family == "Debian"

    - name: Create iptables rules directory
      file:
        path: /etc/iptables
        state: directory
        mode: '0755'

    - name: Deploy IPv4 rules file
      template:
        src: templates/rules.v4.j2
        dest: /etc/iptables/rules.v4
        mode: '0600'
      notify: Restore iptables

    - name: Deploy IPv6 rules file
      template:
        src: templates/rules.v6.j2
        dest: /etc/iptables/rules.v6
        mode: '0600'
      notify: Restore ip6tables

    - name: Deploy sysctl security params
      template:
        src: templates/99-firewall.conf.j2
        dest: /etc/sysctl.d/99-firewall.conf
        mode: '0644'
      notify: Apply sysctl

    - name: Deploy firewall management scripts
      copy:
        src: "files/{{ item }}"
        dest: "/usr/local/bin/{{ item }}"
        mode: '0755'
      loop:
        - firewall-save.sh
        - firewall-restore.sh
        - firewall-audit.sh

    - name: Set up audit cron job
      cron:
        name: "Firewall audit"
        minute: "0"
        hour: "8"
        job: "/usr/local/bin/firewall-audit.sh"
        user: root

  handlers:
    - name: Restore iptables
      shell: iptables-restore < /etc/iptables/rules.v4

    - name: Restore ip6tables
      shell: ip6tables-restore < /etc/iptables/rules.v6

    - name: Apply sysctl
      shell: sysctl --system

# manifests/init.pp
class firewall_baseline (
  Array[String] $ssh_sources = ['10.0.0.0/8'],
  Array[String] $web_ports   = ['80', '443'],
) {

  package { 'iptables-persistent':
    ensure => installed,
  }

  file { '/etc/iptables/rules.v4':
    ensure  => file,
    owner   => 'root',
    group   => 'root',
    mode    => '0600',
    content => epp('firewall/rules.v4.epp', {
      'ssh_sources' => $ssh_sources,
      'web_ports'   => $web_ports,
    }),
    notify  => Exec['restore-iptables'],
  }

  exec { 'restore-iptables':
    command     => '/sbin/iptables-restore < /etc/iptables/rules.v4',
    refreshonly => true,
  }

  sysctl { 'net.ipv4.tcp_syncookies': value => '1' }
  sysctl { 'net.ipv4.conf.all.rp_filter': value => '1' }
  sysctl { 'net.ipv4.icmp_echo_ignore_broadcasts': value => '1' }
}

#!/bin/bash
# /usr/local/bin/firewall-manager.sh
# 防火墙管理工具

CONF="/etc/iptables/firewall.conf"
BACKUP_DIR="/etc/iptables/backup"
LOG_FILE="/var/log/firewall-manager.log"

log() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') $1" >> "$LOG_FILE"
}

backup() {
    mkdir -p "$BACKUP_DIR"
    local ts=$(date +%Y%m%d_%H%M%S)
    iptables-save > "$BACKUP_DIR/rules.v4.$ts"
    ip6tables-save > "$BACKUP_DIR/rules.v6.$ts"
    # 保留最近 50 个备份
    ls -t "$BACKUP_DIR"/rules.v4.* | tail -n +51 | xargs -r rm
    ls -t "$BACKUP_DIR"/rules.v6.* | tail -n +51 | xargs -r rm
    log "Backup created: $ts"
}

apply() {
    backup
    iptables-restore < /etc/iptables/rules.v4
    ip6tables-restore < /etc/iptables/rules.v6
    log "Rules applied from files"
}

save() {
    backup
    iptables-save > /etc/iptables/rules.v4
    ip6tables-save > /etc/iptables/rules.v6
    log "Rules saved to files"
}

rollback() {
    local latest=$(ls -t "$BACKUP_DIR"/rules.v4.* 2>/dev/null | head -1)
    if [ -z "$latest" ]; then
        echo "No backup found"
        exit 1
    fi
    local v6=$(echo "$latest" | sed 's/rules.v4/rules.v6/')
    iptables-restore < "$latest"
    [ -f "$v6" ] && ip6tables-restore < "$v6"
    log "Rollback to: $(basename $latest)"
}

status() {
    echo "=== IPv4 INPUT 规则 ==="
    iptables -L INPUT -n -v --line-numbers
    echo ""
    echo "=== 连接跟踪状态 ==="
    echo "当前: $(conntrack -C) / 最大: $(sysctl -n net.netfilter.nf_conntrack_max)"
}

case "$1" in
    apply)    apply ;;
    save)     save ;;
    rollback) rollback ;;
    status)   status ;;
    backup)   backup ;;
    *)
        echo "Usage: $0 {apply|save|rollback|status|backup}"
        exit 1
        ;;
esac

#!/bin/bash
# /usr/local/bin/generate-firewall-doc.sh
# 自动生成防火墙规则文档

DOC="/var/doc/firewall-rules-$(date +%Y%m%d).md"

{
echo "# 防火墙规则文档"
echo ""
echo "生成时间: $(date)"
echo "主机名: $(hostname)"
echo ""

echo "## IPv4 INPUT 规则"
echo ""
echo "\`\`\`"
iptables -L INPUT -n -v --line-numbers
echo "\`\`\`"
echo ""

echo "## IPv4 FORWARD 规则"
echo ""
echo "\`\`\`"
iptables -L FORWARD -n -v --line-numbers
echo "\`\`\`"
echo ""

echo "## NAT PREROUTING 规则"
echo ""
echo "\`\`\`"
iptables -t nat -L PREROUTING -n -v --line-numbers
echo "\`\`\`"
echo ""

echo "## NAT POSTROUTING 规则"
echo ""
echo "\`\`\`"
iptables -t nat -L POSTROUTING -n -v --line-numbers
echo "\`\`\`"
echo ""

echo "## IPv6 INPUT 规则"
echo ""
echo "\`\`\`"
ip6tables -L INPUT -n -v --line-numbers
echo "\`\`\`"
echo ""

echo "## 内核参数"
echo ""
echo "\`\`\`"
sysctl net.ipv4.tcp_syncookies
sysctl net.ipv4.conf.all.rp_filter
sysctl net.ipv4.icmp_echo_ignore_broadcasts
sysctl net.netfilter.nf_conntrack_max
echo "\`\`\`"
echo ""

echo "## 连接跟踪统计"
echo ""
echo "\`\`\`"
conntrack -S 2>/dev/null || echo "conntrack 工具未安装"
echo "\`\`\`"

} > "$DOC"

echo "文档已生成: $DOC"

#!/bin/bash
# /usr/local/bin/conntrack-monitor.sh
# 连接跟踪监控脚本

THRESHOLD_WARNING=80
THRESHOLD_CRITICAL=95

COUNT=$(cat /proc/sys/net/netfilter/nf_conntrack_count)
MAX=$(cat /proc/sys/net/netfilter/nf_conntrack_max)
USAGE=$(( COUNT * 100 / MAX ))

if [ $USAGE -ge $THRESHOLD_CRITICAL ]; then
    echo "CRITICAL: conntrack 使用率 ${USAGE}% ($COUNT/$MAX)"
    logger -t conntrack-monitor -p crit "conntrack usage CRITICAL: ${USAGE}%"
    # 发送告警（根据实际告警系统调整）
    # curl -X POST https://alert.example.com/api/send ...
    exit 2
elif [ $USAGE -ge $THRESHOLD_WARNING ]; then
    echo "WARNING: conntrack 使用率 ${USAGE}% ($COUNT/$MAX)"
    logger -t conntrack-monitor -p warning "conntrack usage WARNING: ${USAGE}%"
    exit 1
else
    echo "OK: conntrack 使用率 ${USAGE}% ($COUNT/$MAX)"
    exit 0
fi

#!/bin/bash
# /usr/local/bin/firewall-change-detector.sh
# 检测防火墙规则是否被修改

HASH_FILE="/var/lib/iptables/rules.sha256"
CURRENT_HASH=$(iptables-save | sha256sum | awk '{print $1}')

if [ ! -f "$HASH_FILE" ]; then
    echo "$CURRENT_HASH" > "$HASH_FILE"
    exit 0
fi

SAVED_HASH=$(cat "$HASH_FILE")

if [ "$CURRENT_HASH" != "$SAVED_HASH" ]; then
    echo "WARNING: Firewall rules have been modified!"
    logger -t firewall-monitor -p warning "Firewall rules modified unexpectedly"
    
    # 对比差异
    iptables-save > /tmp/current-rules.v4
    diff /etc/iptables/rules.v4 /tmp/current-rules.v4
    
    # 更新哈希
    echo "$CURRENT_HASH" > "$HASH_FILE"
    exit 1
else
    echo "OK: Firewall rules unchanged."
    exit 0
fi

#!/bin/bash
# /usr/local/bin/firewall-emergency-reset.sh
# 应急恢复：清空所有规则，恢复到完全开放状态
# ⚠️ 仅在紧急情况下使用！

echo "WARNING: This will reset all firewall rules to ACCEPT!"
echo "Press Ctrl+C within 10 seconds to abort..."
sleep 10

# 备份当前规则
iptables-save > /tmp/emergency-backup-$(date +%Y%m%d%H%M%S).rules.v4
ip6tables-save > /tmp/emergency-backup-$(date +%Y%m%d%H%M%S).rules.v6

# 清空所有规则
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -t raw -F
iptables -X

ip6tables -F
ip6tables -X

# 设置默认策略为 ACCEPT
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

ip6tables -P INPUT ACCEPT
ip6tables -P FORWARD ACCEPT
ip6tables -P OUTPUT ACCEPT

echo "All firewall rules have been reset to ACCEPT."
echo "Backup saved to /tmp/emergency-backup-*.rules.v4"
echo ""
echo "⚠️  REMEMBER: Re-apply proper firewall rules ASAP!"

#!/bin/bash
# /usr/local/bin/firewall-rollback.sh
# 回滚到最近的备份

BACKUP_DIR="/etc/iptables/backup"

# 查找最近的备份
LATEST_V4=$(ls -t "$BACKUP_DIR"/rules.v4.* 2>/dev/null | head -1)
LATEST_V6=$(ls -t "$BACKUP_DIR"/rules.v6.* 2>/dev/null | head -1)

if [ -z "$LATEST_V4" ]; then
    echo "ERROR: No backup found in $BACKUP_DIR"
    exit 1
fi

echo "Rolling back to: $(basename $LATEST_V4)"
echo "Press Ctrl+C within 5 seconds to abort..."
sleep 5

iptables-restore < "$LATEST_V4"
echo "IPv4 rules restored from $(basename $LATEST_V4)"

if [ -n "$LATEST_V6" ]; then
    ip6tables-restore < "$LATEST_V6"
    echo "IPv6 rules restored from $(basename $LATEST_V6)"
fi

echo "Rollback complete."

# Ansible inventory 分组示例
# inventory/hosts.yml

all:
  children:
    web_servers:
      hosts:
        web-prod-01:
          ansible_host: 10.0.0.10
        web-prod-02:
          ansible_host: 10.0.0.11
      vars:
        firewall_web_ports: [80, 443]

    db_servers:
      hosts:
        db-prod-01:
          ansible_host: 10.0.0.200
      vars:
        firewall_db_ports: [3306]
        firewall_ssh_sources: ["10.0.0.0/24"]

    monitoring:
      hosts:
        mon-prod-01:
          ansible_host: 10.0.2.10
      vars:
        firewall_mon_ports: [9090, 3000, 9100]

#!/bin/bash
# /usr/local/bin/docker-firewall-setup.sh
# Docker 环境的防火墙初始化
# 在 Docker 启动后执行

# 等待 Docker 启动
sleep 5

# 清空 DOCKER-USER 链
iptables -F DOCKER-USER

# 允许已建立的连接
iptables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN

# 允许内部网络
iptables -A DOCKER-USER -i eth1 -j RETURN

# 允许外部访问 Web 端口
iptables -A DOCKER-USER -i eth0 -p tcp -m multiport --dports 80,443 -j RETURN

# 拒绝其他外部访问
iptables -A DOCKER-USER -i eth0 -j DROP

# 默认返回
iptables -A DOCKER-USER -j RETURN

echo "Docker firewall rules applied."

# /etc/systemd/system/docker-firewall.service
# 在 Docker 启动后执行防火墙配置

[Unit]
Description=Docker Firewall Rules
After=docker.service
Requires=docker.service

[Service]
Type=oneshot
ExecStart=/usr/local/bin/docker-firewall-setup.sh
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target