This is an old revision of the document!
Iptables/Netfilter classical sample
Netfilter rules example
#!/bin/sh # Interfaces EXTIF1=eth0 EXTIF2=usb0 INTIF1=vboxnet0 INTIF2=wlan0 # Delete all existing rules iptables -F iptables -X iptables -t nat -F iptables -t mangle -F # Always accept loopback traffic iptables -A INPUT -i lo -j ACCEPT # Allow established connections, and those not coming from the outside iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -m conntrack --ctstate NEW -i $INTIF1 -j ACCEPT iptables -A INPUT -m conntrack --ctstate NEW -i $INTIF2 -j ACCEPT # Allow outgoing connections from the LAN side iptables -A FORWARD -i $INTIF1 -j ACCEPT iptables -A FORWARD -i $INTIF2 -j ACCEPT # Connect LANs iptables -A FORWARD -i $INTIF -o $INTIF2 -j ACCEPT iptables -A FORWARD -i $INTIF2 -o $INTIF -j ACCEPT iptables -A FORWARD -i $INTIF -o $INTIF -j ACCEPT iptables -A FORWARD -i $INTIF2 -o $INTIF2 -j ACCEPT # Masquerade iptables -t nat -A POSTROUTING -o $EXTIF1 -j MASQUERADE iptables -t nat -A POSTROUTING -o $EXTIF2 -j MASQUERADE # Don't forward from the outside to the inside iptables -A FORWARD -i $EXTIF1 -j REJECT iptables -A FORWARD -i $EXTIF2 -j REJECT # MTU iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu # Allow IP forward echo 1 > /proc/sys/net/ipv4/ip_forward # Switch On rp_filter for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 1 > $f ; done # Block all outgoing connections from $INTIF2 to all except several ips/subnets iptables -I FORWARD -i $INTIF2 -j DROP iptables -I FORWARD -i $INTIF2 -d 192.168.1.X -j ACCEPT iptables -I FORWARD -i $INTIF2 -d 192.168.1.Y -j ACCEPT iptables -I FORWARD -i $INTIF2 -d 192.168.1.Z -j ACCEPT iptables -I FORWARD -i $INTIF2 ! -d 192.168.0.0/16 -j ACCEPT iptables -I FORWARD -i $INTIF2 ! -s 192.168.3.0/24 -j DROP # bad wi-fi IPs # BROOT FORCE protection on several ports for PORT in 4369 5222 5223 5269 5280 8090 11194 49164; do iptables -A INPUT -p tcp --dport $PORT --syn -m limit --limit 1/m --limit-burst 5 -j ACCEPT iptables -A INPUT -p tcp --dport $PORT --syn -j DROP done