IPTABLES settings on slackware linux server #2

# Delete all rules
echo "Delete firewall rules..."
iptables -F
iptables -F  -t nat
iptables -F  -t mangle
iptables -X
iptables -t nat -X
iptables -t mangle -X

# Drop all traffic
echo "Set main policy..."
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

#prinimat' vse ustanovlennye vhodashie soedineniya
echo "Accepts all established inbound connections..."
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

#open VPN ports and GRE
echo "Open VPN ports and GRE..."
#to computer
iptables -A INPUT  -p tcp --dport 1723 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1723 -j ACCEPT

iptables -A INPUT -p gre -j ACCEPT
iptables -A OUTPUT -p gre -j ACCEPT

#accept all traffic an lo interface
echo "Accept all lo interface traffic..."
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#open ports for VPN clients (to computer)
# ssh (22 port)
echo "Open 22 port (ssh) for VPN clients..."
iptables -A INPUT  -s 172.16.1.0/24  -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -s 172.16.1.0/24  -p tcp --sport 22 -j ACCEPT
# XDMCP
echo "Open 177 port UDP (XDMCP) for VPN clients..."
iptables -A INPUT  -s 172.16.1.0/24  -p udp --dport 177 -j ACCEPT
iptables -A OUTPUT -s 172.16.1.0/24  -p udp --sport 177 -j ACCEPT

echo "Open 6000:6005 ports (Windows XDMCP) in both directions for VPN clients..."
iptables -A INPUT  -s 172.16.1.0/24  -p tcp -m multiport --dports 6000:6005 -j ACCEPT
iptables -A OUTPUT -s 172.16.1.0/24  -p tcp -m multiport --sports 6000:6005 -j ACCEPT

iptables -A INPUT  -s 172.16.1.0/24  -p tcp -m multiport --sports 6000:6005 -j ACCEPT
iptables -A OUTPUT -s 172.16.1.0/24  -p tcp -m multiport --dports 6000:6005 -j ACCEPT

echo "Open DNS for VPN clients..."
iptables -A INPUT  -s 172.16.1.0/24  -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -s 172.16.1.0/24  -p udp --sport 53 -j ACCEPT

iptables -A INPUT  -s 172.16.1.0/24  -p tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -s 172.16.1.0/24  -p tcp --sport 53 -j ACCEPT


#  Allow ICMP
echo "Allow ICMP and ports for TRACEROUTE..."
iptables -A INPUT  -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
#open ports from traceroute
iptables -A OUTPUT -p udp -m multiport --dports 33434:33534 -j ACCEPT

#Open standart ports (from computer)
echo "Open standart ports (DNS,WWW, email) from server"
# 53-DNS,80 8080/tcp - WWW, 443/tcp - https, 110,443,25,587 - e-mail 873/tcp - rsync (for sbopkg)
iptables -A OUTPUT -p udp -m multiport --dports 53,443 -j ACCEPT
iptables -A OUTPUT -p tcp -m multiport --dports 53,80,8080,443,110,443,25,587,873 -j ACCEPT

#start VPN server
echo "Starting PPTD VPN server..."
pptpd &

echo "Final firewall settings for VPN clients..."
#NAT for VPN clients
iptables -t nat -A POSTROUTING -s 172.16.1.0/24 -j MASQUERADE
#popravlaem pakety (bez etogo visnut nekotorye soedinenia)
iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu