Differences

This shows you the differences between two versions of the page.

--- gnu_linux:iptables:sample [2014/10/20 07:20] – Configure ip_forward and rp_filter through sysctl. kolan
+++ gnu_linux:iptables:sample [2015/11/25 08:59] (current) – kolan
@@ Line 1: / Line 1: @@
-====== Iptables/Netfilter classical sample ======
+====== Iptables/Netfilter server sample ======
-<code bash | Netfilter rules example>#!/bin/sh
+<code bash | Netfilter rules for server>#!/bin/sh
-# Interfaces
+# -- INTERFACES --
-EXTIF1=eth0
+WAN0=wan0
-EXTIF2=usb0
+LAN0=lan0
-INTIF1=vboxnet0
+VIRBR0=virbr0
-INTIF2=wlan0
-# Delete all existing rules
+# -- DEFAULT POLICIES --
+iptables -P INPUT DROP
+iptables -P FORWARD DROP
+iptables -P OUTPUT ACCEPT
+# -- CLEAR --
 iptables -F
 iptables -X
 iptables -t nat -F
 iptables -t mangle -F
+iptables -t nat -X
+iptables -t mangle -X
-# Always accept loopback traffic
+# -- SYN FLOOD --
+iptables -N SYN-FLOOD
+for PORT in 21 22 25 80 139 143 443 445 3128 3130 5222 5223 5269 5280 6080 9418 11194 49164; do
+        iptables -A SYN-FLOOD -p tcp --dport $PORT --syn -m hashlimit --hashlimit 10/min --hashlimit-burst 10 \
+                --hashlimit-htable-expire 3600 --hashlimit-mode srcip  --hashlimit-name synflood -j ACCEPT
+        iptables -A SYN-FLOOD -p tcp --dport $PORT --syn -j LOG --log-prefix "IPTables SYN-FLOOD: " --log-level 4
+        iptables -A SYN-FLOOD -p tcp --dport $PORT --syn -j DROP
+        iptables -A SYN-FLOOD -p tcp --dport $PORT ! --syn -j RETURN
+done
+# -- INPUT --
 iptables -A INPUT -i lo -j ACCEPT
+iptables -A INPUT -i $WAN0 -s 192.168.1.1 -j ACCEPT # Allow Router
+iptables -A INPUT -i $WAN0 -s xx.yy.zz.123 -j ACCEPT # Allow someone
+iptables -A INPUT -i $LAN0 -s 192.168.0.0/16 -j ACCEPT # Allow LAN0
+iptables -A INPUT -i $VIRBR0 -s 192.168.0.0/16 -j ACCEPT # Allow VIRBR0
-# Allow established connections, and those not coming from the outside
+# Allow packets for established connections
 iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+# http://www.mauromascia.com/blog/limiting-concurrent-connections-per-ip/
+iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
+iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
+iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
+iptables -A INPUT -f -j DROP
+#iptables -I INPUT -m conntrack --ctstate INVALID -j DROP
+# SYN-flood
+iptables -A INPUT -i $WAN0 -p tcp --syn -j SYN-FLOOD
+# Open several ports
+iptables -A INPUT -i $WAN0 -p tcp -m tcp -m multiport --dports \
+,22,25,80,143,443,3130,5222,5223,5269,6080,9418,11194,49164 \
+        -d 192.168.1.22 \
+        -m conntrack --ctstate NEW -j ACCEPT
+iptables -A INPUT -i $LAN0 -p tcp -m tcp -m multiport --dports \
+,25,53,139,445,3128,5280 \
+        -d 192.168.1.2 \
+        -m conntrack --ctstate NEW -j ACCEPT
+iptables -A INPUT -i $VIRBR0 -p tcp -m tcp -m multiport --dports \
+,139,445,3128 \
+        -m conntrack --ctstate NEW -j ACCEPT
+# Allow ping for local subnets
+iptables -A INPUT -i $LAN0 -p icmp --icmp-type echo-request -d 192.168.1.2 -m limit --limit 2/s --limit-burst 3 -j ACCEPT
+iptables -A INPUT -i $VIRBR0 -p icmp --icmp-type echo-request -d 192.168.122.1 -m limit --limit 2/s --limit-burst 3 -j ACCEPT
+# Game Servers
+iptables -A INPUT -i $WAN0 -p udp --dport 27960 -j ACCEPT
+iptables -A INPUT -i $WAN0 -p udp --dport 30000 -j ACCEPT
+# DHCP/DNS for LAN0 and VIRBR0
+iptables -A INPUT -i $LAN0 -p udp --dport 53 -j ACCEPT
+iptables -A INPUT -i $VIRBR0 -p udp --dport 53 -j ACCEPT
+iptables -A INPUT -i $VIRBR0 -p udp -d 255.255.255.255 --dport 67 -j ACCEPT
+# -- FORWARD --
+iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+#iptables -A FORWARD -j SYN-FLOOD
 iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-iptables -A INPUT -m conntrack --ctstate NEW -i $INTIF1 -j ACCEPT
+iptables -A FORWARD -i $VIRBR0 -o $WAN0 -j ACCEPT
-iptables -A INPUT -m conntrack --ctstate NEW -i $INTIF2 -j ACCEPT
+iptables -A FORWARD -i $LAN0 -o $VIRBR0 -j ACCEPT
+iptables -A FORWARD -i $VIRBR0 -o $LAN0 -j ACCEPT
+#iptables -A FORWARD -i $LAN0 -o $WAN0 -s 192.168.0.0/16 ! -d 192.168.0.0/16 \
+#       -m conntrack --ctstate NEW -j ACCEPT
-# Allow outgoing connections from the LAN side
+# -- MASQUERADE --
-iptables -A FORWARD -i $INTIF1 -j ACCEPT
+iptables -t nat -A POSTROUTING -o $WAN0 -j MASQUERADE
-iptables -A FORWARD -i $INTIF2 -j ACCEPT
-# Connect LANs
+# -- SQUID --
-iptables -A FORWARD -i $INTIF -o $INTIF2 -j ACCEPT
+#iptables -t nat -A PREROUTING -i $LAN0 -s 192.168.1.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128
-iptables -A FORWARD -i $INTIF2 -o $INTIF -j ACCEPT
+#iptables -t nat -A PREROUTING -i $VIRBR0 -s 192.168.1.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128
-iptables -A FORWARD -i $INTIF -o $INTIF -j ACCEPT
-iptables -A FORWARD -i $INTIF2 -o $INTIF2 -j ACCEPT
-# Masquerade
+# -- SSH GUARD --
-iptables -t nat -A POSTROUTING -o $EXTIF1 -j MASQUERADE
+iptables -N sshguard
-iptables -t nat -A POSTROUTING -o $EXTIF2 -j MASQUERADE
+iptables -A INPUT -j sshguard
-# Don't forward from the outside to the inside
+# Allow tiny proxy only for Someone
-iptables -A FORWARD -i $EXTIF1 -j REJECT
+#iptables -A INPUT -i $EXTIF -p tcp --dport 3130 ! -s xx.yy.zz.123 -j DROP
-iptables -A FORWARD -i $EXTIF2 -j REJECT
-# MTU
-iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-# Block all outgoing connections from $INTIF2 to all except several ips/subnets
+#---------------------
-iptables -I FORWARD -i $INTIF2 -j DROP
+#--- More examples ---
-iptables -I FORWARD -i $INTIF2 -d 192.168.1.X -j ACCEPT
+#---------------------
-iptables -I FORWARD -i $INTIF2 -d 192.168.1.Y -j ACCEPT
+# Deny ICMP echo-requests
-iptables -I FORWARD -i $INTIF2 -d 192.168.1.Z -j ACCEPT
+iptables -t filter -A INPUT -i $EXTIF -p icmp --icmp-type echo-request -j DROP
-iptables -I FORWARD -i $INTIF2 ! -d 192.168.0.0/16 -j ACCEPT
-iptables -I FORWARD -i $INTIF2 ! -s 192.168.3.0/24 -j DROP # bad wi-fi IPs
-# BROOT FORCE protection on several ports
+# Forward traffic from local net except the routers
-for PORT in 4369 5222 5223 5269 5280 8090 11194 49164; do
+ROUTER1_IP=192.168.1.333
-    iptables -A INPUT -p tcp --dport $PORT --syn -m limit --limit 1/m --limit-burst 5 -j ACCEPT
+ROUTER2_IP=192.168.1.555
-    iptables -A INPUT -p tcp --dport $PORT --syn -j DROP
+iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-done
+iptables -A FORWARD -s $ROUTER1_IP -m conntrack --ctstate NEW -j REJECT
+iptables -A FORWARD -s $ROUTER2_IP -m conntrack --ctstate NEW -j REJECT
+iptables -A FORWARD -s 192.168.0.0/16 ! -d 192.168.0.0/16 -m conntrack --ctstate NEW -j ACCEPT
+iptables -A FORWARD -j REJECT
+# Squid
+iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128
+# SSH Guard
+iptables -N sshguard
+iptables -A INPUT -j sshguard
+# Block Samba connections from Routers with old firmwares
+iptables -A INPUT -i $EXTIF -p udp --dport 137 -s $ROUTER1_IP -j DROP
+iptables -A INPUT -i $EXTIF -p udp --dport 138 -s $ROUTER1_IP -j DROP
+iptables -A INPUT -i $EXTIF -p tcp --dport 139 -s $ROUTER1_IP -j REJECT
+iptables -A INPUT -i $EXTIF -p tcp --dport 445 -s $ROUTER1_IP -j REJECT
+iptables -A INPUT -i $EXTIF -p udp --dport 137 -s $ROUTER2_IP -j DROP
+iptables -A INPUT -i $EXTIF -p udp --dport 138 -s $ROUTER2_IP -j DROP
+iptables -A INPUT -i $EXTIF -p tcp --dport 139 -s $ROUTER2_IP -j REJECT
+iptables -A INPUT -i $EXTIF -p tcp --dport 445 -s $ROUTER2_IP -j REJECT
+# Drop all outbound UDP traffic except for the DNS, NTP
+iptables -A INPUT -p udp --sport 53 -j ACCEPT
+iptables -A INPUT -p udp --dport 53 -j ACCEPT
+iptables -A OUTPUT -p udp --sport 53 -j ACCEPT
+iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
+iptables -A INPUT -p udp --sport 123 -j ACCEPT
+iptables -A INPUT -p udp --dport 123 -j ACCEPT
+iptables -A OUTPUT -p udp --sport 123 -j ACCEPT
+iptables -A OUTPUT -p udp --dport 123 -j ACCEPT
+iptables -A INPUT -p udp -j DROP
+iptables -A OUTPUT -p udp -j DROP
+# Don't forward UPD traffic except for the DNS, NTP
+iptables -A FORWARD -p udp --sport 53 -j ACCEPT
+iptables -A FORWARD -p udp --dport 53 -j ACCEPT
+iptables -A FORWARD -p udp --sport 123 -j ACCEPT
+iptables -A FORWARD -p udp --dport 123 -j ACCEPT
+iptables -A FORWARD -p udp -j DROP
 </code>