This is an old revision of the document!
Iptables/Netfilter classical sample
Netfilter rules example
#!/bin/sh # Interfaces EXTIF1=eth0 EXTIF2=usb0 INTIF1=vboxnet0 INTIF2=wlan0 # Delete all existing rules iptables -F iptables -X iptables -t nat -F iptables -t mangle -F # Always accept loopback traffic iptables -A INPUT -i lo -j ACCEPT # Allow established connections, and those not coming from the outside iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -m conntrack --ctstate NEW -i $INTIF1 -j ACCEPT iptables -A INPUT -m conntrack --ctstate NEW -i $INTIF2 -j ACCEPT # Allow outgoing connections from the LAN side iptables -A FORWARD -i $INTIF1 -j ACCEPT iptables -A FORWARD -i $INTIF2 -j ACCEPT # Connect LANs iptables -A FORWARD -i $INTIF -o $INTIF2 -j ACCEPT iptables -A FORWARD -i $INTIF2 -o $INTIF -j ACCEPT iptables -A FORWARD -i $INTIF -o $INTIF -j ACCEPT iptables -A FORWARD -i $INTIF2 -o $INTIF2 -j ACCEPT # Masquerade iptables -t nat -A POSTROUTING -o $EXTIF1 -j MASQUERADE iptables -t nat -A POSTROUTING -o $EXTIF2 -j MASQUERADE # Don't forward from the outside to the inside iptables -A FORWARD -i $EXTIF1 -j REJECT iptables -A FORWARD -i $EXTIF2 -j REJECT # MTU iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu # Block all outgoing connections from $INTIF2 to all except several ips/subnets iptables -I FORWARD -i $INTIF2 -j DROP iptables -I FORWARD -i $INTIF2 -d 192.168.1.X -j ACCEPT iptables -I FORWARD -i $INTIF2 -d 192.168.1.Y -j ACCEPT iptables -I FORWARD -i $INTIF2 -d 192.168.1.Z -j ACCEPT iptables -I FORWARD -i $INTIF2 ! -d 192.168.0.0/16 -j ACCEPT iptables -I FORWARD -i $INTIF2 ! -s 192.168.3.0/24 -j DROP # bad wi-fi IPs # BROOT FORCE protection on several ports for PORT in 4369 5222 5223 5269 5280 8090 11194 49164; do iptables -A INPUT -p tcp --dport $PORT --syn -m limit --limit 1/m --limit-burst 5 -j ACCEPT iptables -A INPUT -p tcp --dport $PORT --syn -j DROP done #--------------------- #--- More examples --- #--------------------- # Deny ICMP echo-requests iptables -t filter -A INPUT -i $EXTIF -p icmp --icmp-type echo-request -j DROP # Forward traffic from local net except the routers ROUTER1_IP=192.168.1.333 ROUTER2_IP=192.168.1.555 iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -s $ROUTER1_IP -m conntrack --ctstate NEW -j REJECT iptables -A FORWARD -s $ROUTER2_IP -m conntrack --ctstate NEW -j REJECT iptables -A FORWARD -s 192.168.0.0/16 ! -d 192.168.0.0/16 -m conntrack --ctstate NEW -j ACCEPT iptables -A FORWARD -j REJECT # Squid iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128 # SSH Guard iptables -N sshguard iptables -A INPUT -j sshguard # Block Samba connections from Routers with old firmwares iptables -A INPUT -i $EXTIF -p udp --dport 137 -s $ROUTER1_IP -j DROP iptables -A INPUT -i $EXTIF -p udp --dport 138 -s $ROUTER1_IP -j DROP iptables -A INPUT -i $EXTIF -p tcp --dport 139 -s $ROUTER1_IP -j REJECT iptables -A INPUT -i $EXTIF -p tcp --dport 445 -s $ROUTER1_IP -j REJECT iptables -A INPUT -i $EXTIF -p udp --dport 137 -s $ROUTER2_IP -j DROP iptables -A INPUT -i $EXTIF -p udp --dport 138 -s $ROUTER2_IP -j DROP iptables -A INPUT -i $EXTIF -p tcp --dport 139 -s $ROUTER2_IP -j REJECT iptables -A INPUT -i $EXTIF -p tcp --dport 445 -s $ROUTER2_IP -j REJECT # Drop all outbound UDP traffic except for the DNS, NTP iptables -A INPUT -p udp --sport 53 -j ACCEPT iptables -A INPUT -p udp --dport 53 -j ACCEPT iptables -A OUTPUT -p udp --sport 53 -j ACCEPT iptables -A OUTPUT -p udp --dport 53 -j ACCEPT iptables -A INPUT -p udp --sport 123 -j ACCEPT iptables -A INPUT -p udp --dport 123 -j ACCEPT iptables -A OUTPUT -p udp --sport 123 -j ACCEPT iptables -A OUTPUT -p udp --dport 123 -j ACCEPT iptables -A INPUT -p udp -j DROP iptables -A OUTPUT -p udp -j DROP # Don't forward UPD traffic except for the DNS, NTP iptables -A FORWARD -p udp --sport 53 -j ACCEPT iptables -A FORWARD -p udp --dport 53 -j ACCEPT iptables -A FORWARD -p udp --sport 123 -j ACCEPT iptables -A FORWARD -p udp --dport 123 -j ACCEPT iptables -A FORWARD -p udp -j DROP