Christoph's iptables firewall script

You probably have a computer connected to the internet. How else would you be reading this. As the internet is no friendly place any more you should make sure your computer is protected appropriately. For a while I used the Firewall Builder (fwbuilder) but then decided that managing my firewall rules with iptables in a shell script is much easier (and above all does not require to have a computer with a graphical user interface in my vicinity). This article contains a simple shell script to help you maintain firewall rules using the 'iptables' program on Linux. It's a simple way to set up a firewall without any additional tools.

#
# Sample iptables firewall script
# Christoph Haas <email AT christoph DASH haas DOT de>
#

 

IPT="/sbin/iptables"

# Enable routing
echo 1 > /proc/sys/net/ipv4/ip_forward

# Clear all chains
cat /proc/net/ip_tables_names | while read table; do
  $IPT -t $table -L -n | while read c chain rest; do
      if test "X$c" = "XChain" ; then
        $IPT -t $table -F $chain
      fi
  done
  $IPT -t $table -X
done

# Create a chain for log + drop
# (logs to syslog and then drops the packet - useful for debugging)
$IPT -N logdrop

#
# Sample iptables firewall script
# Christoph Haas <email AT christoph DASH haas DOT de>
#

IPT="/sbin/iptables"

# Enable routing
echo 1 > /proc/sys/net/ipv4/ip_forward

# Clear all chains
cat /proc/net/ip_tables_names | while read table; do
  $IPT -t $table -L -n | while read c chain rest; do
      if test "X$c" = "XChain" ; then
        $IPT -t $table -F $chain
      fi
  done
  $IPT -t $table -X
done

# Create a chain for log + drop
# (logs to syslog and then drops the packet - useful for debugging)
$IPT -N logdrop
$IPT -A logdrop -j LOG --log-level info --log-prefix "IPTABLES: drop "
$IPT -A logdrop -j DROP

# Default policy is to drop packets (implicit last rule)
$IPT -P OUTPUT  DROP
$IPT -P INPUT   DROP
$IPT -P FORWARD DROP

# Enable stateful inspection
$IPT -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Firewall rules go below here
...

Examples for rules:

 

# Block an attacker
$IPT -A INPUT -i eth1 -s 217.228.66.237 -j DROP

# Log + drop port 135 connections (Micro$oft bullshit - logs a lot)
$IPT -A INPUT -i eth0 -p tcp --dport 135 -j logdrop

# Allow incoming Ping requests (echo request) on eth1
$IPT -A INPUT -i eth1 -p icmp --icmp-type 8/0 -j ACCEPT

# Allow ports 8080 and 8090 from the network 81.4.25.0/24 on the eth1 interface
$IPT -A INPUT -i eth1 -s 81.4.25.0/24 -p tcp -m multiport --dport 8080,8888 -j ACCEPT

These are the meanings of the parameters:

-i <interface>

packet comes in on an interface

-o <interface>

packet goes out to an interface

-A

append this rule to a chain (at the end)

-I

insert this rule to a chain (at the beginning)

-p <protocol>

the protocol (tcp, udp or icmp)

-j <action>

what you want to do if this rule matches (ACCEPT, DROP, REJECT or a chain)

-s <ip>

source IP address

-d <ip>

destination IP address

--sport <port>

source port

--dport <port>

destination port