Introduction: Raspberry Pi Personal Firewall
CU ITP Hackathon project
Step 1: Set Up Raspberry Pi
Following the instructions provided with the Raspberry Pi, set it up using Raspbian.
Step 2: Setup Raspberry Pi As Gateway
sudo nano /etc/network/interfaces
edit to look like this, then save:
auto lo
iface lo inet loopback
pre-up iptables-restore < /etc/iptables.rules
auto eth0
allow-hotplug eth0
iface eth0 inet static
address 192.168.0.1
netmask 255.255.255.0
network 192.168.0.0
broadcast 192.168.0.255
auto wlan0
allow-hotplug wlan0
iface wlan0 inet manual
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
Enable IP forwarding:
nano -w /etc/sysctl.conf
net.ipv4.ip_forward=1
Install and configure DNSMASQ
To install:
sudo apt-get install dnsmasq
To configure:
nano -w /etc/dnsmasq.conf
interface=eth0
listen-address=127.0.0.1
domain=example.com
dhcp-range=192.168.0.1,192.168.0.110,12h
Reboot the system.
Step 3: Configure and Activate Iptables
nano -w /etc/iptables.rules
*nat
-A PREROUTING -i eth0 -p tcp -m tcp --dport 50000 -j DNAT --to-destination 192.168.0.3:50000
-A POSTROUTING -o eth0 -j MASQUERADE COMMIT
*filter
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i eth0 -j DROP -A FORWARD -i eth0 -p tcp -m tcp --dport 50000 -m state --state NEW -j ACCEPT COMMIT
Activate:
iptables-restore < /etc/iptables.rules
Ensure iptables restart on boot:
Add to /etc/network/interfaces after lo:
nano -w /etc/network/interfaces
pre-up iptables-restore < /etc/iptables.rules
Step 4: Write a Script to Get Malicious IPs and Add Them to IP Tables to DROP
1 #!/usr/bin/python
2 import requests
3 import re
4 import subprocess
5 import os
6 r = requests.get("http://www.malwaredomainlist.com/mdl.php?search=&colsearch=All&quantity=A ll")
7
8 data = r.text
9
10 datasplit=data.split('\n')
11 malIP=[]
12 for d in datasplit:
13 d1=d.split('')
14 if len(d1) > 3:
15 s=re.search('\d+\.\d+\.\d+\.\d+', d1[2])
16 if hasattr(s, 'group'):
17 malIP.append(str(s.group(0)))
18
19
20 malIP1=malIP[:100]
21
22
23 print(len(malIP1))
24 os.system("iptables -F FORWARD")
25 for IP in malIP1:
26 os.system("iptables -A FORWARD -d "+IP+" -j DROP")
27 os.system("iptables -A FORWARD -j ACCEPT")
Step 5: Set Script to Run Every 5 Minutes
crontab -e
Add a rule at the bottom:
*/5 * * * * /usr/bin/python /home/pi/scriptname.py
Save and quit
Step 6: Set Up Flask Web Server
The web server enumerates the list of wifi networks and allows us to connect to any of them.
pip install flask
pip install wifi
Python server code attached.
Step 7: Create Index.html for Web Server
This index.html file will go inside the flask file structure in the "templates" directory.
Attachments
Step 8: You Are Now Blocked From Connecting to Malicious Websites Listed at the Url Specified in Python Script in Step 4
