Christoph's iptables script
The following script is a simple template for your own firewall rules script:
#!/bin/bash -e
#
# Sample iptables firewall script
# Christoph Haas <email AT christoph DASH haas DOT de>
#
IPT="/sbin/iptables"
# Enable routing
echo 1 > /proc/sys/net/ipv4/ip_forward
# Clear all chains
cat /proc/net/ip_tables_names | while read table; do
$IPT -t $table -L -n | while read c chain rest; do
if test "X$c" = "XChain" ; then
$IPT -t $table -F $chain
fi
done
$IPT -t $table -X
done
# Create a chain for log + drop
# (logs to syslog and then drops the packet - useful for debugging)
$IPT -N logdrop
$IPT -A logdrop -j LOG --log-level info --log-prefix "IPTABLES: drop "
$IPT -A logdrop -j DROP
# Default policy is to drop packets (implicit last rule)
$IPT -P OUTPUT DROP
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
# Enable stateful inspection
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Firewall rules go below here
...
Examples for rules:
# Block an attacker $IPT -A INPUT -i eth1 -s 217.228.66.237 -j DROP # Log + drop port 135 connections (Micro$oft bullshit - logs a lot) $IPT -A INPUT -i eth0 -p tcp --dport 135 -j logdrop # Allow incoming Ping requests (echo request) on eth1 $IPT -A INPUT -i eth1 -p icmp --icmp-type 8/0 -j ACCEPT # Allow ports 8080 and 8090 from the network 81.4.25.0/24 on the eth1 interface $IPT -A INPUT -i eth1 -s 81.4.25.0/24 -p tcp -m multiport --dport 8080,8888 -j ACCEPT
These are the meanings of the parameters:
-i <interface> |
packet comes in on an interface |
-o <interface> |
packet goes out to an interface |
-A |
append this rule to a chain (at the end) |
-I |
insert this rule to a chain (at the beginning) |
-p <protocol> |
the protocol (tcp, udp or icmp) |
-j <action> |
what you want to do if this rule matches (ACCEPT, DROP, REJECT or a chain) |
-s <ip> |
source IP address |
-d <ip> |
destination IP address |
--sport <port> |
source port |
--dport <port> |
destination port |
