Christoph's iptables script

The following script is a simple template for your own firewall rules script:

#!/bin/bash -e
#
# Sample iptables firewall script
# Christoph Haas <email AT christoph DASH haas DOT de>
#

IPT="/sbin/iptables"

# Enable routing
echo 1 > /proc/sys/net/ipv4/ip_forward

# Clear all chains
cat /proc/net/ip_tables_names | while read table; do
  $IPT -t $table -L -n | while read c chain rest; do
      if test "X$c" = "XChain" ; then
        $IPT -t $table -F $chain
      fi
  done
  $IPT -t $table -X
done

# Create a chain for log + drop
# (logs to syslog and then drops the packet - useful for debugging)
$IPT -N logdrop
$IPT -A logdrop -j LOG --log-level info --log-prefix "IPTABLES: drop "
$IPT -A logdrop -j DROP

# Default policy is to drop packets (implicit last rule)
$IPT -P OUTPUT  DROP
$IPT -P INPUT   DROP
$IPT -P FORWARD DROP

# Enable stateful inspection
$IPT -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Firewall rules go below here
...

Examples for rules:

# Block an attacker
$IPT -A INPUT -i eth1 -s 217.228.66.237 -j DROP

# Log + drop port 135 connections (Micro$oft bullshit - logs a lot)
$IPT -A INPUT -i eth0 -p tcp --dport 135 -j logdrop

# Allow incoming Ping requests (echo request) on eth1
$IPT -A INPUT -i eth1 -p icmp --icmp-type 8/0 -j ACCEPT

# Allow ports 8080 and 8090 from the network 81.4.25.0/24 on the eth1 interface
$IPT -A INPUT -i eth1 -s 81.4.25.0/24 -p tcp -m multiport --dport 8080,8888 -j ACCEPT

These are the meanings of the parameters:

-i <interface>

packet comes in on an interface

-o <interface>

packet goes out to an interface

-A

append this rule to a chain (at the end)

-I

insert this rule to a chain (at the beginning)

-p <protocol>

the protocol (tcp, udp or icmp)

-j <action>

what you want to do if this rule matches (ACCEPT, DROP, REJECT or a chain)

-s <ip>

source IP address

-d <ip>

destination IP address

--sport <port>

source port

--dport <port>

destination port

WorkaroundOrg: IptablesScript (last edited 2005-06-27 08:56:06 by ChristophHaas)