generate iptables rules dynamically from docker-compose.yml

bin/rules.sh

@@ -0,0 +1,78 @@
+#!/bin/bash
+
+### Vars, Ports for Standard services
+myHOSTPORTS="64295"
+myDOCKERCOMPOSEYML="$1"
+myRULESFUNCTION="$2"
+
+function fuCHECKFORARGS {
+### Check if args are present, if not throw error
+
+if [ "$myDOCKERCOMPOSEYML" != "" ] && ([ "$myRULESFUNCTION" == "set" ] || [ "$myRULESFUNCTION" == "unset" ]);
+  then
+    echo "All arguments met. Continuing."
+  else
+    echo "Usage: rules.sh <docker-compose.yml> <[set, unset]>"
+    exit
+fi
+}
+
+function fuNFQCHECK {
+### Check if honeytrap is actively enabled in docker-compose.yml
+	
+myNFQCHECK=$(grep -e '^\s*honeytrap:' $myDOCKERCOMPOSEYML | tr -d ': ' | wc -l)
+
+if [ "$myNFQCHECK" == "0" ];
+  then
+    echo "No NFQ related honeypot detected, no firewall rules needed. Exiting."
+    exit
+  else
+    echo "Detected at least one NFQ based honeypot, firewall rules needed. Continuing."
+fi
+}
+
+function fuGETPORTS {
+### Get ports from docker-compose.yml
+	
+myDOCKERCOMPOSEPORTS=$(cat $myDOCKERCOMPOSEYML | yq -r '.services[].ports' | grep ':' | sed -e s/127.0.0.1// | tr -d '", ' | sed -e s/^:// | cut -f1 -d ':' )
+myDOCKERCOMPOSEPORTS+=" $myHOSTPORTS"
+myRULESPORTS=$(for i in $myDOCKERCOMPOSEPORTS; do echo $i; done | sort -gu)
+}
+
+function fuSETRULES {
+### Setting up iptables rules
+
+/sbin/iptables -w -A INPUT -s 127.0.0.1 -j ACCEPT
+/sbin/iptables -w -A INPUT -d 127.0.0.1 -j ACCEPT
+
+for myPORT in $myRULESPORTS; do
+  /sbin/iptables -w -A INPUT -p tcp --dport $myPORT -j ACCEPT
+done
+  
+/sbin/iptables -w -A INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
+}
+
+function fuUNSETRULES {
+### Removing iptables rules
+
+/sbin/iptables -w -D INPUT -s 127.0.0.1 -j ACCEPT
+/sbin/iptables -w -D INPUT -d 127.0.0.1 -j ACCEPT
+
+for myPORT in $myRULESPORTS; do
+  /sbin/iptables -w -D INPUT -p tcp --dport $myPORT -j ACCEPT
+done
+
+/sbin/iptables -w -D INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
+}
+
+# Main
+fuCHECKFORARGS
+fuNFQCHECK
+fuGETPORTS
+
+if [ "$myRULESFUNCTION" == "set" ];
+  then
+    fuSETRULES
+  else
+    fuUNSETRULES
+fi