Unfortunately there is no such script that I've ever seen that can run in a learning mode or passive mode logging all your network usage, taking its results and generating an actual firewall using
iptables from its logs.
Your best bet is going to be to start simple and continuously keep adding the various pieces as you begin to fully understand what services your system is providing. You'll need to make use of tools such as
netstat to see what ports are in use for the various services you host, as well as what IP addresses are accessing them.
$ sudo netstat -tlpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 26292/sendmail
tcp 0 0 0.0.0.0:890 0.0.0.0:* LISTEN 26149/ypbind
tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN 26321/smbd
tcp 0 0 127.0.0.1:2207 0.0.0.0:* LISTEN 26226/python
tcp 0 0 127.0.0.1:2208 0.0.0.0:* LISTEN 26221/./hpiod
tcp 0 0 127.0.0.1:199 0.0.0.0:* LISTEN 26237/snmpd
tcp 0 0 0.0.0.0:809 0.0.0.0:* LISTEN 26067/rpc.statd
tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN 26321/smbd
tcp 0 0 0.0.0.0:587 0.0.0.0:* LISTEN 26292/sendmail
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 26038/portmap
tcp 0 0 0.0.0.0:35604 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 26249/sshd
tcp 0 0 0.0.0.0:631 0.0.0.0:* LISTEN 26257/cupsd
tcp 0 0 :::22 :::* LISTEN 26249/sshd
tcp 0 0 :::631 :::* LISTEN 26257/cupsd
NOTE: In the above you can see what services I have running on a server that are accepting TCP connections, i.e. they're "listening" for connections on various ports.
It's a no-brainier to start with things like SSH (port 22) and HTTP (port 80), if these are typical to your system, so I would do these types of services in mass all at once. For other services such as LDAP or NIS you may want to do these in a more controlled manner, making sure things do not break as you introduce them.
Tools such as FireHOL, Firewall Builder (fwbuilder), and eztables may be helpful as you attack this project, since they provide a nice layer of abstraction from having to build custom
iptable rules by hand, which can be tricky.
FireHOL is a language (and a program to run it) which builds secure, stateful firewalls of any complexity from easy to understand, human-readable configurations.
transparent_squid 8080 "squid root" inface eth0
interface eth0 mylan
interface ppp+ internet
server smtp accept
server http accept
server ftp accept
server ssh accept src example.firehol.org
client all accept
router mylan2internet inface eth0 outface ppp+
route all accept
Fwbuilder is a unique graphical firewall tool that allows the user to create objects and then drag and drop those objects into firewalls, to build a powerful security system for a single PC or a network of PCs. Fwbuilder supports a wide range of firewalls (Cisco ASA/PIX, Linux iptables, FreeBSD's ipfilter, OpenBSD's pf, and more), so its rules can be deployed on multiple platforms. Let's take a look at using Fwbuilder on Linux, which might just become a life-long affair with a powerful security system.
Eztables allows you to quickly configure a firewall without ever touching iptables. The firewall rule syntax is designed to be easy to read and to apply.
This is how you allow the entire internet to access your webserver on TCP-port 80:
allow_in any $eth0 any 80/tcp
Eztables is designed to be simple, yet powerful. It doesn't matter if you want to protect your laptop, are setting up a home router, or building a company firewall.
With a rudimentary
iptables firewall in place you'll likely want to compliment it using a tool such as Fail2Ban.
Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email) could also be configured. Out of the box Fail2Ban comes with filters for various services (apache, courier, ssh, etc).
Using tools such as this will help limit the exposure that your system will have to endure as you continue to harden it. Even after you're fairly convinced that your system has been hardened, you may still want to continue using Fail2Ban as part of your security measures.