#!/bin/bash # Standardwerte setzen FQDN="" ADDR="" GW="" NS="" USE_DHCP=0 # Optionen mit getopts parsen while getopts "f:a:g:n:d" opt; do case $opt in f) FQDN="$OPTARG" ;; a) ADDR="$OPTARG" ;; g) GW="$OPTARG" ;; n) NS="$OPTARG" ;; d) USE_DHCP=1 ;; *) echo "Ungültige Option" >&2; exit 1 ;; esac done # Gültigkeit prüfen if [[ -z "$FQDN" ]]; then echo "Fehlender FQDN! Nutzung:" echo "$0 -f [-d | -a -g -n ]" exit 1 fi if (( USE_DHCP == 1 )); then if [[ -n "$ADDR" || -n "$GW" || -n "$NS" ]]; then echo "Fehler: -d darf nicht mit -a, -g oder -n kombiniert werden." >&2 exit 1 fi else if [[ -z "$ADDR" || -z "$GW" || -z "$NS" ]]; then echo "Fehlende Argumente für statische Konfiguration! Nutzung:" echo "$0 -f [-d | -a -g -n ]" exit 1 fi fi # SHORT und DOM aus FQDN berechnen SHORT=$(echo "$FQDN" | cut -d'.' -f1) DOM=$(echo "$FQDN" | cut -d'.' -f2-) ADDR1=$(echo "$ADDR" | cut -d'/' -f 1) OKT4=$(echo "$ADDR1" | cut -d'.' -f 4) OKT123=$(echo "$ADDR1" | cut -d'.' -f -3) ADDR2=$OKT123.$((OKT4+20)) DNSGW=$OKT123.88 cat< /etc/network/interfaces # This file describes the network interfaces available on your system # and how to activate them. For more information, see interfaces(5). source /etc/network/interfaces.d/* auto lo iface lo inet loopback auto enp0s3 HERE if (( USE_DHCP == 1 )); then echo "iface enp0s3 inet dhcp" >> /etc/network/interfaces else cat <> /etc/network/interfaces iface enp0s3 inet static address $ADDR gateway $GW dns-nameservers $NS dns-search $DOM post-up ip addr add $ADDR2/24 dev enp0s3 post-up ip route add 10.88.0.0/16 via $DNSGW auto enp0s8 iface enp0s8 inet static address 10.0.10.1/24 HERE fi echo "Hostname setzen" hostnamectl set-hostname "$FQDN" echo "Fiirewall konfigurieren" cat< /etc/nftables.conf #!/usr/sbin/nft -f # Variablen define DMZ = 10.0.10.0/24 define WANIP = $ADDR1 define WANIP2 = $ADDR2 define OPFER = 10.0.10.104 define VICTIM = 10.0.10.123 # Alte Regeln löschen flush ruleset table inet filter { chain input { type filter hook input priority filter; policy drop; ct state established,related accept ct state new iif "lo" accept ct state new iif enp0s8 accept ct state new icmp type echo-request accept ct state new iif enp0s3 tcp dport { 22, 443 } accept log prefix " --nftables-drop-input-- " } chain forward { type filter hook forward priority filter; policy drop; ct state established,related accept ct state new iif enp0s8 oif enp0s3 accept ct state new iif enp0s3 oif enp0s8 ip daddr \$OPFER tcp dport { 22, 25, 143, 445, 465, 993, 2049, 3128 } accept ct state new iif enp0s3 oif enp0s8 ip daddr \$VICTIM tcp dport { 22, 25, 143, 445, 465, 993, 389 } accept log prefix "--nftables-drop-forward--" } chain output { type filter hook output priority filter; policy drop; ct state established,related accept ct state new accept log prefix " --nftables-drop-output-- " } } # NAT-Tabelle mit Regeln table inet nat { chain prerouting { type nat hook prerouting priority dstnat; policy accept; ip daddr \$WANIP2 tcp dport { 25, 143, 445, 465, 993, 2049, 3128 } dnat ip to \$OPFER ip daddr \$WANIP tcp dport { 25, 143, 445, 465, 993, 389 } dnat ip to \$VICTIM ip daddr \$WANIP2 tcp dport 9922 dnat ip to \$OPFER:22 ip daddr \$WANIP tcp dport 9922 dnat ip to \$VICTIM:22 } chain postrouting { type nat hook postrouting priority 100; policy accept; ip saddr \$DMZ oif enp0s3 snat to \$WANIP } } HERE echo "HAProxy konfigurieren" cat /etc/ssl/own.crt /etc/ssl/own.key > /etc/haproxy/ssl/revproxy.pem cat< /etc/haproxy/haproxy.cfg global log /dev/log local0 log /dev/log local1 notice chroot /var/lib/haproxy stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners stats timeout 30s user haproxy group haproxy daemon ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets defaults log global mode http option httplog option dontlognull timeout connect 5000 timeout client 50000 timeout server 50000 errorfile 400 /etc/haproxy/errors/400.http errorfile 403 /etc/haproxy/errors/403.http errorfile 408 /etc/haproxy/errors/408.http errorfile 500 /etc/haproxy/errors/500.http errorfile 502 /etc/haproxy/errors/502.http errorfile 503 /etc/haproxy/errors/503.http errorfile 504 /etc/haproxy/errors/504.http # Frontend: HTTPS frontend ft_https bind $ADDR1:443 ssl crt /etc/haproxy/ssl/revproxy.pem mode http option http-keep-alive http-request set-header X-Forwarded-Proto https if { ssl_fc } option forwardfor timeout client 30s acl acl_victim hdr_beg(host) -i victim use_backend backend_victim if acl_victim acl acl_opfer hdr_beg(host) -i opfer use_backend backend_opfer if acl_opfer acl acl_dvwa hdr_beg(host) -i dvwa use_backend backend_dvwa if acl_dvwa acl acl_juice hdr_beg(host) -i juice use_backend backend_juice if acl_juice acl acl_owasp hdr_beg(host) -i owasp use_backend backend_owasp if acl_owasp # Frontend: HTTP → HTTPS Redirect frontend ft_http bind $ADDR1:80 mode http option http-keep-alive timeout client 30s acl acl_http req.proto_http http-request redirect code 301 scheme https if acl_http backend backend_victim server victim 10.0.10.123:443 ssl verify none check backend backend_opfer server opfer 10.0.10.104:80 check backend backend_dvwa server dvwa 10.0.10.104:81 check backend backend_juice server juice 10.0.10.104:83 check backend backend_owasp server owasp 10.0.10.104:5080 check HERE