iptables - Config example V.2

#!/bin/bash

echo "0" /proc/sys/net/ipv4/ip_forward

iptables -F
iptables -F -t nat
iptables -F -t mangle
iptables -X
iptables -X -t nat
iptables -X -t mangle

echo "Old rules flushed"

modprobe ip_conntrack_ftp

# Установка правил на DROP по-умолчанию

iptables -P INPUT DROP
iptables -P OUTPUT DROP

# Создание новой цепочки

iptables -N BAD_PACKETS

# Allow localhost

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Jump to BAD_PACKETS

iptables -A INPUT -j BAD_PACKETS

# Allow ESTABLISHED connections

iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow PING

iptables -A INPUT -p ICMP -i eth0 --icmp-type 8 -j ACCEPT
iptables -A OUTPUT -p ICMP -o eth0 --icmp-type 9 -j ACCEPT

# Allow output SSH

iptables -A OUTPUT -p TCP -o eth0 --dport 22 -j ACCEPT

# Allow DNS

iptables -A OUTPUT -p UDP -o eth0 -d IP_ADDR --dport 53 -j ACCEPT
iptables -A OUTPUT -p TCP -o eth0 -d IP_ADDR --dport 53 -j ACCEPT
iptables -A OUTPUT -p UDP -o eth0 -d IP_ADDR --dport 53 -j ACCEPT
iptables -A OUTPUT -p TCP -o eth0 -d IP_ADDR --dport 53 -j ACCEPT
iptables -A OUTPUT -p UDP -o eth0 -d 8.8.8.8 --dport 53 -j ACCEPT
iptables -A OUTPUT -p TCP -o eth0 -d 8.8.8.8 --dport 53 -j ACCEPT


# Allow HTTP

iptables -A OUTPUT -p TCP -o eth0 --dport 443 -j ACCEPT
iptables -A OUTPUT -p TCP -o eth0 --dport 80 -j ACCEPT

# Allow Webmin

iptables -A OUTPUT -p TCP -o eth0 --dport 10000 -j ACCEPT

# Allow Lync

iptables -A OUTPUT -p TCP -o eth0 -d IP_ADDR --dport 5061 -j ACCEPT

# Allow RDP

iptables -A OUTPUT -p TCP -o eth0 --dport 3389 -j ACCEPT

# Allow POP3, SMTP, IMAP, IMAPS

iptables -A OUTPUT -p TCP -o eth0 --dport 110 -j ACCEPT
iptables -A OUTPUT -p TCP -o eth0 --dport 143 -j ACCEPT
iptables -A OUTPUT -p TCP -o eth0 --dport 25 -j ACCEPT
iptables -A OUTPUT -p TCP -o eth0 --dport 993 -j ACCEPT

# Allow FTP

iptables -A OUTPUT -p TCP -o eth0 --dport 21 -j ACCEPT
iptables -A OUTPUT -p TCP -o eth0 --dport 22 -j ACCEPT

# Allow SAMBA

iptables -A INPUT -i eth0 -p UDP -m multiport --ports 135,136,137,138,139,445 -j ACCEPT
iptables -A INPUT -i eth0 -p TCP -m multiport --ports 135,136,137,138,139,445 -j ACCEPT
iptables -A OUTPUT -o eth0 -p UDP -m multiport --ports 135,136,137,138,139,445 -j ACCEPT
iptables -A OUTPUT -o eth0 -p TCP -m multiport --ports 135,136,137,138,139,445 -j ACCEPT

#Allow input torrents-client

iptables -A INPUT -p TCP -i eth0 --dport 51413 -j ACCEPT
iptables -A INPUT -p UDP -i eth0 --dport 51413 -j ACCEPT
iptables -A INPUT -p TCP -i eth0 --dport 6881 -j ACCEPT
iptables -A INPUT -p UDP -i eth0 --dport 6881 -j ACCEPT

##### ATTACK #####

# DoS

iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

# Защита от спуфинга

iptables -I INPUT -m conntrack --ctstate NEW,INVALID -p tcp --tcp-flags SYN,ACK SYN,ACK -j REJECT --reject-with tcp-reset

# Защита от попытки открыть входящее соединение TCP не через SYN

iptables -I INPUT -m conntrack --ctstate NEW -p tcp ! --syn -j DROP

##### DROP #####

#iptables -A INPUT -j LOG --log-prefix "INPUT DROP:"
#iptables -A OUTPUT -j LOG --log-prefix "OUTPUT DROP:"
iptables -A BAD_PACKETS -d 255.255.255.255 -j DROP
iptables -A BAD_PACKETS -j RETURN

echo "Rules written."