#################################################################################### # HEADER AND INSTRUCTIONS #################################################################################### # Current Version: endwall_nomac_v1.06 Feb 02 2016 # Stable Version: endwall_nomac_v1.05, Jan 30 2016 # # Changes: Removed mac address binding # # Instructions: make directory,copy the file and change name to endwall.sh # make whitelists,blacklist text files, edit the endwall.sh file # change permisions to make endwall.sh executable, run the file. # $ mkdir ~/endwall # $ cp vdyvuh.sh ~/endwall/endwall.sh # $ cd ~/endwall # $ echo " " >> smtp_whitelist.txt # whitelist (hotmail,gmail,etc) # $ echo " " >> http_whitelist.txt # users of your website # $ echo " " >> http_blacklist.txt # ipv4 addresses to restrict http/https # $ echo " " >> smtp_blacklist.txt # ipv4 addresses to restrict smtp access # $ echo " " >> dns_blacklist.txt # ipv4 addresses (bad dns actors) to restrict # $ echo " " >> attackers.txt # ipv4 blacklist for hack attackers # $ echo " " >> blacklist.txt # ipv4 blacklist of DOD subnets and others # $ echo " " >> email_blacklist.txt # strings of email addresses and keywords to block from smtp # $ echo " " >> html_blacklist.txt # strings of attack html calls (cgi,php) to block from http # $ ls # list the files you just made # $ nano endwall.sh # go to the section below labeled GLOBAL VARIABLES # edit the variables int_if,int_if2,host_ip,client1_ip,client1_ip,gateway_ip, # so that they match your needs and save. ^X # $ chmod u+rwx endwall.sh # change permisions to allow script execution # $ su # become root # # ./endwall.sh # execute/run the file # ############################################################################################## # EXAMPLES ############################################################################################## # Next add ip addresses to the whitelists and blacklists # Example: adding an ip to blacklist.txt # $ echo "116.58.45.115" >> attackers.txt # Example: banning a subnet from accessing smtp # $ echo "116.58.0.0/16" >> smtp_blacklist.txt # Example: banning a larger subnet from accessing http # $ echo "117.0.0.0/8" >> http_blacklist.txt # Example: banning a large subnet from accessing anything on your server # $ echo "118.0.0.0/8" >> blacklist.txt # Example: banning a spammer # $ echo "[email protected]" >> email_blacklist.txt (read the postfix log for examples) # Example: banning a hacker diving for files from hacking your webserver (read your httpd log for examples) # $ echo "/configuration.php" >> html_blacklist.txt # $ echo "/wordpress/xmlrpc.php" >> html_blacklist.txt # $ su # # ./endwall.sh # run the firewall script with the new blacklisted ipv4 addresses ################################################################################################ # GLOBAL VARIABLES ################################################################################################ iptables=/sbin/iptables ip6tables=/sbin/ip6tables systemctl enable iptables systemctl enable ip6tables int_if=eth0 # internal (local) interface, e.g. eth0, wlan0, p5p1 #int_if2=eth1 # run $ifconfig or $ip link $ip addr to determine value. host_ip=192.168.0.160 # change to be your web server ip address (this computer) client1_ip=192.168.0.161 # change to be the static ip of your first internal client client2_ip=192.168.0.162 # change to be the static ip of your second internal client gateway_ip=192.168.0.1 # change to be the static ip of your gateway/router int_ip1=$host_ip # your internal ip (who are you?) #int_ip2=192.168.0.168 # change to the ip of your 2nd NIC ################################################################################################################################### # LINUX SECURITY BOOLEANS ################################################################################################################################### # Disable Source Routed Packets for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do echo 0 > $f done # Disable ICMP Redirect Acceptance for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo 0 > $f done # Don't send Redirect Messages for f in /proc/sys/net/ipv4/conf/*/send_redirects; do echo 0 > $f done # Drop Spoofed Packets coming in on an interface, which if replied to, # would result in the reply going out a different interface. for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f done # Log packets with impossible addresses. for f in /proc/sys/net/ipv4/conf/*/log_martians; do echo 1 > $f done echo 1 > /proc/sys/net/ipv4/tcp_syncookies # enable tcp syn cookies (prevent against the common 'syn flood attack') echo 0 > /proc/sys/net/ipv4/ip_forward # disable Packet forwarning between interfaces echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # ignore all ICMP ECHO and TIMESTAMP requests sent to it via broadcast/multicast echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses # disable logging of bogus responses to broadcast frames echo 1 > /proc/sys/net/ipv4/conf/all/log_martians # log packets with impossible addresses to kernel log echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter # do source validation by reversed path (Recommended option for single homed hosts) echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route # Disable source routed packets redirects echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects # don't accept redirects echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects # don't send redirects echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route # don't accept packets with SRR option echo 0 > /proc/sys/net/ipv6/conf/all/accept_redirects # don't accept redirects echo 0 > /proc/sys/net/ipv6/conf/all/accept_source_route # don't accept packets with SRR option #echo 1 > /proc/sys/net/ipv4/conf/all/disable_ipv6 # disable ipv6 #setsebool httpd_can_network_connect on #needed for squirell mail if you are on selinux #setsebool httpd_can_sendmail on # squirel mail ####################################################################################### ###################### FLUSH OLD RULES ####################################### iptables -F iptables -F -t mangle iptables -X -t mangle iptables -F -t nat iptables -X -t nat iptables -X iptables -Z ip6tables -F ip6tables -F -t mangle ip6tables -X -t mangle ip6tables -X ip6tables -Z ########################### DEFUALT POLICY and CHAINS ########################################## iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP ip6tables -P INPUT DROP ip6tables -P FORWARD DROP ip6tables -P OUTPUT DROP ################################################################################################# iptables -N LnD # Define custom DROP chain iptables -A LnD -p tcp -m limit --limit 1/s -j LOG --log-prefix "[TCP drop] " --log-level=info iptables -A LnD -p udp -m limit --limit 1/s -j LOG --log-prefix "[UDP drop] " --log-level=info iptables -A LnD -p icmp -m limit --limit 1/s -j LOG --log-prefix "[ICMP drop] " --log-level=info iptables -A LnD -f -m limit --limit 1/s -j LOG --log-prefix "[FRAG drop] " --log-level=info iptables -A LnD -j DROP iptables -N LnR # Define custom REJECT chain iptables -A LnR -p tcp -m limit --limit 1/s -j LOG --log-prefix "[TCP reject] " --log-level=info iptables -A LnR -p udp -m limit --limit 1/s -j LOG --log-prefix "[UDP reject] " --log-level=info iptables -A LnR -p icmp -m limit --limit 1/s -j LOG --log-prefix "[ICMP reject] " --log-level=info iptables -A LnR -f -m limit --limit 1/s -j LOG --log-prefix "[FRAG reject] " --log-level=info iptables -A LnR -j REJECT ip6tables -N LnD # Define custom DROP chain ip6tables -A LnD -p tcp -m limit --limit 1/s -j LOG --log-prefix "[TCP drop] " --log-level=info ip6tables -A LnD -p udp -m limit --limit 1/s -j LOG --log-prefix "[UDP drop] " --log-level=info ip6tables -A LnD -p icmp -m limit --limit 1/s -j LOG --log-prefix "[ICMP drop] " --log-level=info ip6tables -A LnD -j DROP ip6tables -N LnR # Define custom REJECT chain ip6tables -A LnR -p tcp -m limit --limit 1/s -j LOG --log-prefix "[TCP reject] " --log-level=info ip6tables -A LnR -p udp -m limit --limit 1/s -j LOG --log-prefix "[UDP reject] " --log-level=info ip6tables -A LnR -p icmp -m limit --limit 1/s -j LOG --log-prefix "[ICMP reject] " --log-level=info ip6tables -A LnR -j REJECT #################################################################################### # BASIC FIRST LINE SECURITY #################################################################################### ################ DROP BAD FLAG COMBINATIONS ####################################### iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j LnD #Kill XMAS iptables -A INPUT -p tcp --tcp-flags ALL ALL -j LnD iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j LnD iptables -A INPUT -p tcp --tcp-flags ALL NONE -j LnD iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j LnD iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j LnD iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j LnD iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j LnD iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j LnD ip6tables -A INPUT -p tcp --tcp-flags ALL ALL -j LnD ip6tables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j LnD ip6tables -A INPUT -p tcp --tcp-flags ALL NONE -j LnD ip6tables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j LnD ip6tables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j LnD ip6tables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j LnD ip6tables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j LnD ip6tables -A INPUT -p tcp --tcp-flags ACK,URG URG -j LnD ##################### Kill SYN FLOOD ############################################ iptables -A INPUT -p tcp ! --syn -m state --state NEW -j LnD ip6tables -A INPUT -p tcp ! --syn -m state --state NEW -j LnD # Prevent DoS attack #iptables -A INPUT -p tcp --dport 25 -m limit --limit 40/minute --limit-burst 80 -j ACCEPT ################# DROP BROADCAST and DON'T LOG ######################################## iptables -A INPUT -i $int_if -d 255.255.255.255 -j DROP iptables -A INPUT -i $int_if -d 192.168.255.255 -j DROP iptables -A INPUT -i $int_if -d 192.168.0.255 -j DROP iptables -A INPUT -i $int_if -d 153.122.255.255 -j DROP iptables -A INPUT -i $int_if -d 153.122.1.255 -j DROP iptables -A INPUT -i $int_if -d 172.2.255.255 -j DROP iptables -A INPUT -i $int_if -d 172.2.1.255 -j DROP iptables -A INPUT -i $int_if -d 10.0.0.0/8 -j DROP iptables -A INPUT -i $int_if -d 169.254.0.0/16 -j DROP ################# Drop Bad Guys ##################################################### iptables -A INPUT -m recent --rcheck --seconds 60 -m limit --limit 10/second -j LOG --log-prefix "BG " iptables -A INPUT -m recent --update --seconds 60 -j DROP ip6tables -A INPUT -m recent --rcheck --seconds 60 -m limit --limit 10/second -j LOG --log-prefix "BG " ip6tables -A INPUT -m recent --update --seconds 60 -j DROP # drop spoofed packets (i.e. packets with local source addresses coming from outside etc.) iptables -A INPUT -i $int_if -s $int_ip1 -m recent --set -j LnD iptables -A FORWARD -i $int_if -s $int_ip1 -m recent --set -j LnD #iptables -A INPUT -i $int_if -s $int_ip2 -m recent --set -j LnD #iptables -A FORWARD -i $int_if -s $int_ip2 -m recent --set -j LnD #################################################################################### # IP FILTER WHITE LISTS #################################################################################### # smtp_whitelist.txt #echo SMTP WHITELIST LOADING #for whiteout in $(cat smtp_whitelist.txt); #do #( #iptables -A OUTPUT -p tcp -s $int_ip1 -d $whiteout -m multiport --dports 25,587 -j LOG --log-prefix "[SMTP WHITE OUT] " --log-level=info; #iptables -A OUTPUT -p tcp -s $int_ip1 -d $whiteout -m multiport --dports 25,587 -j ACCEPT; #iptables -A INPUT -p tcp -d $int_ip1 -s $whiteout -m multiport --dports 25,587 -j LOG --log-prefix "[SMTP WHITE IN] " --log-level=info; #iptables -A INPUT -p tcp -d $int_ip1 -s $whiteout -m multiport --dports 25,587 -j ACCEPT; #iptables -A FORWARD -p tcp -d $int_ip1 -s $whiteout -m multiport --dports 25,587 -j LOG --log-prefix "[SMTP WHITE FORWARD IN] "--log-level=info; #iptables -A FORWARD -p tcp -d $int_ip1 -s $whiteout -m multiport --dports 25,587 -j ACCEPT; #iptables -A FORWARD -p tcp -s $int_ip1 -d $whiteout -m multiport --dports 25,587 -j LOG --log-prefix "[SMTP WHITE FORWARD OUT] " --log-level=info; #iptables -A FORWARD -p tcp -s $int_ip1 -d $whiteout -m multiport --dports 25,587 -j ACCEPT; #) #echo $whiteout ; #done #echo SMTP WHITELIST LOADED # http_whitelist.txt #echo HTTP/HTTPS WHITELIST LOADING #for whiteout in $(cat http_whitelist.txt); #do #( #iptables -A OUTPUT -p tcp -s $int_ip1 -d $whiteout -m multiport --dports 80,443 -j LOG --log-prefix "[HTTPS WHITE OUT] " --log-level=info; #iptables -A OUTPUT -p tcp -s $int_ip1 -d $whiteout -m multiport --dports 80,443 -j ACCEPT; #iptables -A INPUT -p tcp -d $int_ip1 -s $whiteout -m multiport --dports 80,443 -j LOG --log-prefix "[HTTPS WHITE IN] " --log-level=info; #iptables -A INPUT -p tcp -d $int_ip1 -s $whiteout -m multiport --dports 80,443 -j ACCEPT; #iptables -A FORWARD -p tcp -d $int_ip1 -s $whiteout -m multiport --dports 80,443 -j LOG --log-prefix "[HTTPS WHITE FORWARD IN] " --log-level=info; #iptables -A FORWARD -p tcp -d $int_ip1 -s $whiteout -m multiport --dports 80,443 -j ACCEPT; #iptables -A FORWARD -p tcp -s $int_ip1 -d $whiteout -m multiport --dports 80,443 -j LOG --log-prefix "[HTTPS WHITE FORWARD OUT] " --log-level=info; #iptables -A FORWARD -p tcp -s $int_ip1 -d $whiteout -m multiport --dports 80,443 -j ACCEPT; #) #echo $whiteout ; #done #echo HTTP/HTTPS WHITELIST LOADED #################################################################################### # IP FILTER BLACK LISTS #################################################################################### ## Kill FACEBOOK GOOGLE AKAMI TECH AMAZON HTTP echo HTTP/HTTPS BLACKLIST LOADING for blackout in $(cat http_blacklist.txt); do (iptables -A OUTPUT -p tcp -s $int_ip1 -d $blackout -m multiport --dports 80,443 -j LOG --log-prefix "[HTTP-SPAM OUT] " --log-level=info ; iptables -A OUTPUT -p tcp -s $int_ip1 -d $blackout -m multiport --dports 80,443 -j DROP; iptables -A INPUT -p tcp -d $int_ip1 -s $blackout -m multiport --dports 80,443 -j LOG --log-prefix "[HTTP-SPAM IN] " --log-level=info; iptables -A INPUT -p tcp -d $int_ip1 -s $blackout -m multiport --dports 80,443 -j DROP; iptables -A FORWARD -p tcp -d $int_ip1 -s $blackout -m multiport --dports 80,443 -j LOG --log-prefix "[HTTP-SPAM FORWARD IN] " --log-level=info ; iptables -A FORWARD -p tcp -d $int_ip1 -s $blackout -m multiport --dports 80,443 -j DROP; iptables -A FORWARD -p tcp -s $int_ip1 -d $blackout -m multiport --dports 80,443 -j LOG --log-prefix "[HTTP-SPAM FORWARD OUT] " --log-level=info; iptables -A FORWARD -p tcp -s $int_ip1 -d $blackout -m multiport --dports 80,443 -j DROP; ) echo $blackout ; done echo HTTP BLACKLIST LOADED #smtp_blacklist.txt echo SMTP BLACKLIST LOADING for blackout in $(cat smtp_blacklist.txt); do ( iptables -A OUTPUT -p tcp -s $int_ip1 -d $blackout -m multiport --dports 25,587 -j LOG --log-prefix "[SMTP SPAM OUT] " --log-level=info; iptables -A OUTPUT -p tcp -s $int_ip1 -d $blackout -m multiport --dports 25,587 -j DROP; iptables -A INPUT -p tcp -d $int_ip1 -s $blackout -m multiport --dports 25,587 -j LOG --log-prefix "[SMTP SPAM IN] " --log-level=info; iptables -A INPUT -p tcp -d $int_ip1 -s $blackout -m multiport --dports 25,587 -j DROP; iptables -A FORWARD -p tcp -d $int_ip1 -s $blackout -m multiport --dports 25,587 -j LOG --log-prefix "[SMTP SPAM FORWARD IN] " --log-level=info; iptables -A FORWARD -p tcp -d $int_ip1 -s $blackout -m multiport --dports 25,587 -j DROP; iptables -A FORWARD -p tcp -s $int_ip1 -d $blackout -m multiport --dports 25,587 -j LOG --log-prefix "[SMTP SPAM FORWARD OUT] " --log-level=info; ) echo $blackout ; done echo SMTP BLACKLIST LOADED echo DNS BLACKLIST LOADING for blackout in $(cat dns_blacklist.txt); do (iptables -A OUTPUT -p udp -s $int_ip1 -d $blackout --dport 53 -j LOG --log-prefix "[DNS SPAM UDP OUT] " --log-level=info; iptables -A OUTPUT -p udp -s $int_ip1 -d $blackout --dport 53 -j DROP; iptables -A INPUT -p udp -d $int_ip1 -s $blackout --dport 53 -j LOG --log-prefix "[DNS SPAM UDP IN] " --log-level=info; iptables -A INPUT -p udp -d $int_ip1 -s $blackout --dport 53 -j DROP; iptables -A FORWARD -p udp -d $int_ip1 -s $blackout --dport 53 -j LOG --log-prefix "[DNS SPAM UDP FORWARD IN] " --log-level=info; iptables -A FORWARD -p udp -d $int_ip1 -s $blackout --dport 53 -j DROP; iptables -A FORWARD -p udp -s $int_ip1 -d $blackout --dport 53 -j LOG --log-prefix "[DNS SPAM UDP FORWARD OUT] " --log-level=info; iptables -A FORWARD -p udp -s $int_ip1 -d $blackout --dport 53 -j DROP; iptables -A OUTPUT -p tcp -s $int_ip1 -d $blackout --dport 53 -j LOG --log-prefix "[DNS SPAM TCP OUT] " --log-level=info; iptables -A OUTPUT -p tcp -s $int_ip1 -d $blackout --dport 53 -j DROP; iptables -A INPUT -p tcp -d $int_ip1 -s $blackout --dport 53 -j LOG --log-prefix "[DNS SPAM TCP IN] " --log-level=info; iptables -A INPUT -p tcp -d $int_ip1 -s $blackout --dport 53 -j DROP; iptables -A FORWARD -p tcp -d $int_ip1 -s $blackout --dport 53 -j LOG --log-prefix "[DNS SPAM TCP FORWARD IN] " --log-level=info; iptables -A FORWARD -p tcp -d $int_ip1 -s $blackout --dport 53 -j DROP; iptables -A FORWARD -p tcp -s $int_ip1 -d $blackout --dport 53 -j LOG --log-prefix "[DNS SPAM TCP FORWARD OUT] " --log-level=info; iptables -A FORWARD -p tcp -s $int_ip1 -d $blackout --dport 53 -j DROP; ) echo $blackout ; done echo DNS BLACKLIST LOADED #blacklist.txt # Kill HACKERS echo ATTACKER BLACKLIST LOADING for blackout in $(cat attackers.txt); do (iptables -A OUTPUT -p all -s $int_ip1 -d $blackout -j LOG --log-prefix "[ATTACKER OUT] " --log-level=info ; iptables -A OUTPUT -p all -s $int_ip1 -d $blackout -j DROP; iptables -A INPUT -p all -d $int_ip1 -s $blackout -j LOG --log-prefix "[ATTACKER IN] " --log-level=info ; iptables -A INPUT -p all -d $int_ip1 -s $blackout -j DROP; iptables -A FORWARD -p all -d $int_ip1 -s $blackout -j LOG --log-prefix "[ATTACKER FORWARD IN] " --log-level=info ; iptables -A FORWARD -p all -d $int_ip1 -s $blackout -j DROP; iptables -A FORWARD -p all -s $int_ip1 -d $blackout -j LOG --log-prefix "[ATTACKER FORWARD OUT] " --log-level=info ; iptables -A FORWARD -p all -s $int_ip1 -d $blackout -j DROP; ) echo $blackout ; done echo ATTACKER BLACKLIST LOADED echo LOADING BLACKLIST for blackout in $(cat blacklist.txt); do ( iptables -A OUTPUT -p all -s $int_ip1 -d $blackout -j LOG --log-prefix "[BLACKLIST OUT] " --log-level=info ; iptables -A OUTPUT -p all -s $int_ip1 -d $blackout -j DROP; iptables -A INPUT -p all -d $int_ip1 -s $blackout -j LOG --log-prefix "[BLACKLIST IN] " --log-level=info ; iptables -A INPUT -p all -d $int_ip1 -s $blackout -j DROP; iptables -A FORWARD -p all -d $int_ip1 -s $blackout -j LOG --log-prefix "[BLACKLIST FORWARD IN] " --log-level=info ; iptables -A FORWARD -p all -d $int_ip1 -s $blackout -j DROP; iptables -A FORWARD -p all -s $int_ip1 -d $blackout -j LOG --log-prefix "[BLACKLIST FORWARD OUT] " --log-level=info ; iptables -A FORWARD -p all -s $int_ip1 -d $blackout -j DROP; ) echo $blackout ; done echo BLACKLIST LOADED echo EMAIL BLACKLIST LOADING for blackout in $(cat email_blacklist.txt); do ( iptables -A INPUT -p tcp --dport 25 -m string --string "$blackout" --algo bm -j LOG --log-prefix "[EMAIL SPAM] " --log-level=info; iptables -A INPUT -p tcp --dport 25 -m string --string "$blackout" --algo bm -j DROP iptables -A OUTPUT -p tcp --dport 25 -m string --string "$blackout" --algo bm -j LOG --log-prefix "[EMAIL SPAM] " --log-level=info; iptables -A OUTPUT -p tcp --dport 25 -m string --string "$blackout" --algo bm -j DROP iptables -A FORWARD -p tcp --dport 25 -m string --string "$blackout" --algo bm -j LOG --log-prefix "[EMAIL SPAM] " --log-level=info; iptables -A FORWARD -p tcp --dport 25 -m string --string "$blackout" --algo bm -j DROP ) echo $blackout ; done echo EMAIL BLACKLIST LOADED echo HTML BLACKLIST LOADING for blackout in $(cat html_blacklist.txt); do ( iptables -A INPUT -p tcp -m multiport --dports 80,443 -m string --string "$blackout" --algo bm -j LOG --log-prefix "[HTTP SPAM] " --log-level=info; iptables -A INPUT -p tcp -m multiport --dports 80,443 -m string --string "$blackout" --algo bm -j DROP iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m string --string "$blackout" --algo bm -j LOG --log-prefix "[HTTP SPAM] " --log-level=info; iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m string --string "$blackout" --algo bm -j DROP iptables -A FORWARD -p tcp -m multiport --dports 80,443 -m string --string "$blackout" --algo bm -j LOG --log-prefix "[HTTP SPAM] " --log-level=info; iptables -A FORWARD -p tcp -m multiport --dports 80,443 -m string --string "$blackout" --algo bm -j DROP ) echo $blackout ; done echo HTML BLACKLIST LOADED ##################################################################################################### # LOCAL HOST RULES 127.0.0.1 = lo NEVER accept everything from loopback ##################################################################################################### ##################################### BOOTP ############################################# iptables -A INPUT -i lo -p udp -m multiport --dports 67,68 -j ACCEPT iptables -A INPUT -i lo -p udp -m multiport --sports 67,68 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --dports 67,68 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --sports 67,68 -j ACCEPT ################################## DNS ################################################# iptables -A INPUT -i lo -p udp -m multiport --dports 53,953 -j ACCEPT iptables -A INPUT -i lo -p udp -m multiport --sports 53,953 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --dports 53,953 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --sports 53,953 -j ACCEPT ip6tables -A INPUT -i lo -p udp -m multiport --sports 53,953 -j ACCEPT ip6tables -A INPUT -i lo -p udp -m multiport --dports 53,953 -j ACCEPT ip6tables -A OUTPUT -o lo -p udp -m multiport --sports 53,953 -j ACCEPT ip6tables -A OUTPUT -o lo -p udp -m multiport --dports 53,953 -j ACCEPT ########################### TELNET SSH ########################################################### iptables -A INPUT -i lo -p tcp -m multiport --dports 22,23 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 22,23 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 22,23 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 22,23 -j ACCEPT ########################### SMTP ################################################################### iptables -A INPUT -i lo -p tcp -m multiport --dports 25,587,465 -m limit --limit 10/second --limit-burst 12 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 25,587,465 -m limit --limit 10/second --limit-burst 12 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 25,587,465 -m limit --limit 10/second --limit-burst 12 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 25,587,465 -m limit --limit 10/second --limit-burst 12 -j ACCEPT ip6tables -A INPUT -i lo -p tcp -m multiport --dports 25,587,465 -m limit --limit 10/second --limit-burst 12 -j ACCEPT ip6tables -A INPUT -i lo -p tcp -m multiport --sports 25,587,465 -m limit --limit 10/second --limit-burst 12 -j ACCEPT ip6tables -A OUTPUT -o lo -p tcp -m multiport --dports 25,587,465 -m limit --limit 10/second --limit-burst 12 -j ACCEPT ip6tables -A OUTPUT -o lo -p tcp -m multiport --sports 25,587,465 -m limit --limit 10/second --limit-burst 12 -j ACCEPT ############################ FTP ######################################################################################## iptables -A INPUT -i lo -p tcp -m multiport --dports 20,21,989,990 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 20,21,989,990 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 20,21,989,990 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 20,21,989,990 -j ACCEPT iptables -A INPUT -i lo -p udp -m multiport --dports 20,21,989,990 -j ACCEPT iptables -A INPUT -i lo -p udp -m multiport --sports 20,21,989,990 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --dports 20,21,989,990 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --sports 20,21,989,990 -j ACCEPT ########################### HTTP,HTTPS,DNS ############################################################################ iptables -A INPUT -i lo -p tcp -m multiport --dports 53,80,443 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 53,80,443 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 53,80,443 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 53,80,443 -j ACCEPT ip6tables -A INPUT -i lo -p tcp -m multiport --dports 53,80,443 -j ACCEPT ip6tables -A INPUT -i lo -p tcp -m multiport --sports 53,80,443 -j ACCEPT ip6tables -A OUTPUT -o lo -p tcp -m multiport --dports 53,80,443 -j ACCEPT ip6tables -A OUTPUT -o lo -p tcp -m multiport --sports 53,80,443 -j ACCEPT ############################ IMAP IMAPS POP3 POP3S ############################################################# iptables -A INPUT -i lo -p tcp -m multiport --dports 110,143,443,514 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 110,143,443,514 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 110,143,443,514 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 110,143,443,514 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --dports 783,953,993,995 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 783,953,993,995 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 783,953,993,995 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 783,953,993,995 -j ACCEPT #################################### IRC ##################################################### iptables -A INPUT -i lo -p tcp -m multiport --dports 6667,6668,6669,6697,9999 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 6667,6668,6669,6697,9999 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 6667,6668,6669,6697,9999 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 6667,6668,6669,6697,9999 -j ACCEPT #################################### XMPP MSN ICQ AOL ##################################################### iptables -A INPUT -i lo -p tcp -m multiport --dports 1863,5190,5222,5223,5269,5280,5281,5298,5582,8010 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 1863,5190,5222,5223,5269,5280,5281,5298,5582,8010 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 1863,5190,5222,5223,5269,5280,5281,5298,5582,8010 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 1863,5190,5222,5223,5269,5280,5281,5298,5582,8010 -j ACCEPT iptables -A INPUT -i lo -p udp -m multiport --dports 5298 -j ACCEPT iptables -A INPUT -i lo -p udp -m multiport --sports 5298 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --dports 5298 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --sports 5298 -j ACCEPT ############################### NNTP ##################################################### iptables -A INPUT -i lo -p udp -m multiport --dports 119,563 -j ACCEPT iptables -A INPUT -i lo -p udp -m multiport --sports 119,563 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --dports 119,563 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --sports 119,563 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --dports 119,563 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 119,563 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 119,563 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 119,563 -j ACCEPT ################################### HKP PGP ########################################################## iptables -A INPUT -i lo -p tcp -m multiport --dports 11371 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 11371 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 11371 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 11371 -j ACCEPT #################################### TOR ############################################################# iptables -A INPUT -i lo -p tcp -m multiport --dports 9040,9050,9051,9150,9151,9001 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 9040,9050,9051,9150,9151,9001 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 9040,9050,9051,9150,9151,9001 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 9040,9050,9051,9150,9151,9001 -j ACCEPT ################################### LDAP ############################################################ iptables -A INPUT -i lo -p tcp -m multiport --dports 389 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 389 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 389 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 389 -j ACCEPT iptables -A INPUT -i lo -p udp -m multiport --dports 389 -j ACCEPT iptables -A INPUT -i lo -p udp -m multiport --sports 389 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --dports 389 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --sports 389 -j ACCEPT ###################################### BIT TORRENT ##################################################### #iptables -A INPUT -i lo -p tcp -m multiport --dports 6880,6881,6882,6883,6884,6885,6969 -j ACCEPT #iptables -A INPUT -i lo -p tcp -m multiport --dports 6886,6887,6888,6889,6890 -j ACCEPT #iptables -A INPUT -i lo -p tcp -m multiport --sports 6880,6881,6882,6883,6884,6885,6969 -j ACCEPT #iptables -A INPUT -i lo -p tcp -m multiport --sports 6886,6887,6888,6889,6890 -j ACCEPT #iptables -A OUTPUT -o lo -p tcp -m multiport --dports 6880,6881,6882,6883,6884,6885,6969 -j ACCEPT #iptables -A OUTPUT -o lo -p tcp -m multiport --dports 6886,6887,6888,6889,6890 -j ACCEPT #iptables -A OUTPUT -o lo -p tcp -m multiport --sports 6880,6881,6882,6883,6884,6885,6969 -j ACCEPT #iptables -A OUTPUT -o lo -p tcp -m multiport --sports 6886,6887,6888,6889,6890 -j ACCEPT #iptables -A INPUT -i lo -p udp -m multiport --dports 6880,6881,6882,6883,6884,6885,6969 -j ACCEPT #iptables -A INPUT -i lo -p udp -m multiport --dports 6886,6887,6888,6889,6890 -j ACCEPT #iptables -A INPUT -i lo -p udp -m multiport --sports 6880,6881,6882,6883,6884,6885,6969 -j ACCEPT #iptables -A INPUT -i lo -p udp -m multiport --sports 6886,6887,6888,6889,6890 -j ACCEPT #iptables -A OUTPUT -o lo -p udp -m multiport --dports 6880,6881,6882,6883,6884,6885,6969 -j ACCEPT #iptables -A OUTPUT -o lo -p udp -m multiport --dports 6886,6887,6888,6889,6890 -j ACCEPT #iptables -A OUTPUT -o lo -p udp -m multiport --sports 6880,6881,6882,6883,6884,6885,6969 -j ACCEPT #iptables -A OUTPUT -o lo -p udp -m multiport --sports 6886,6887,6888,6889,6890 -j ACCEPT #iptables -A INPUT -i lo -p tcp -m multiport --dports 58846,2710 -j ACCEPT #iptables -A INPUT -i lo -p tcp -m multiport --sports 58846,2710 -j ACCEPT #iptables -A OUTPUT -o lo -p tcp -m multiport --dports 58846,2710 -j ACCEPT #iptables -A OUTPUT -o lo -p tcp -m multiport --sports 58846,2710 -j ACCEPT #iptables -A INPUT -i lo -p udp -m multiport --dports 4444,6969,1337,2710,80 -j ACCEPT #iptables -A INPUT -i lo -p udp -m multiport --sports 4444,6969,1337,2710,80 -j ACCEPT #iptables -A OUTPUT -o lo -p udp -m multiport --dports 4444,6969,1337,2710,80 -j ACCEPT #iptables -A OUTPUT -o lo -p udp -m multiport --sports 4444,6969,1337,2710,80 -j ACCEPT #iptables -A INPUT -i lo -p udp -m multiport --dports 4444,80 -j ACCEPT #iptables -A INPUT -i lo -p udp -m multiport --sports 4444,80 -j ACCEPT #iptables -A OUTPUT -o lo -p udp -m multiport --dports 4444,80 -j ACCEPT #iptables -A OUTPUT -o lo -p udp -m multiport --sports 4444,80 -j ACCEPT #################################### SQUID HTTP ALTERNATE ########################################### iptables -A INPUT -i lo -p tcp -m multiport --dports 3128,8000,8080,8082,8445,8123,8443 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 3128,8000,8080,8082,8445,8123,8443 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 3128,8000,8080,8082,8445,8123,8443 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 3128,8000,8080,8082,8445,8123,8443 -j ACCEPT #################################### SOCKS 4/5 ######################################################### iptables -A INPUT -i lo -p tcp -m multiport --dports 1080,1085 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 1080,1085 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 1080,1085 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 1080,1085 -j ACCEPT ################################## NETBIOS ######################################################### #iptables -A INPUT -i lo -p tcp -m multiport --dports 135,137,138,139 -j ACCEPT #iptables -A INPUT -i lo -p tcp -m multiport --sports 135,137,138,139 -j ACCEPT #iptables -A OUTPUT -o lo -p tcp -m multiport --dports 135,137,138,139 -j ACCEPT #iptables -A OUTPUT -o lo -p tcp -m multiport --sports 135,137,138,139 -j ACCEPT #iptables -A INPUT -i lo -p udp -m multiport --dports 135,137,138,139 -j ACCEPT #iptables -A INPUT -i lo -p udp -m multiport --sports 135,137,138,139 -j ACCEPT #iptables -A OUTPUT -o lo -p udp -m multiport --dports 135,137,138,139 -j ACCEPT #iptables -A OUTPUT -o lo -p udp -m multiport --sports 135,137,138,139 -j ACCEPT ################################### SMB SAMBA ####################################################### #iptables -A INPUT -i lo -p tcp -m multiport --dports 445 -j ACCEPT #iptables -A INPUT -i lo -p tcp -m multiport --sports 445 -j ACCEPT #iptables -A OUTPUT -o lo -p tcp -m multiport --dports 445 -j ACCEPT #iptables -A OUTPUT -o lo -p tcp -m multiport --sports 445 -j ACCEPT ############################## PULSE AUDIO SERVER #iptables -A INPUT -i lo -p tcp -m multiport --dports 4713 -j ACCEPT #iptables -A INPUT -i lo -p tcp -m multiport --sports 4713 -j ACCEPT #iptables -A OUTPUT -o lo -p tcp -m multiport --dports 4713 -j ACCEPT #iptables -A OUTPUT -o lo -p tcp -m multiport --sports 4713 -j ACCEPT ############################### CUPS ################################################################ iptables -A INPUT -i lo -p tcp -m multiport --dports 631 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 631 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 631 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 631 -j ACCEPT iptables -A INPUT -i lo -p udp -m multiport --dports 631 -j ACCEPT iptables -A INPUT -i lo -p udp -m multiport --sports 631 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --dports 631 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --sports 631 -j ACCEPT ################################### GIT HUB ########################################################## iptables -A INPUT -i lo -p tcp -m multiport --dports 9418 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 9418 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 9418 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 9418 -j ACCEPT ######################## ICMP ######################################################################## iptables -A INPUT -i lo -p icmp --icmp-type ping -m limit --limit 1/second -j ACCEPT iptables -A OUTPUT -o lo -p icmp --icmp-type ping -m limit --limit 2/second -j ACCEPT iptables -A INPUT -i lo -p icmp --icmp-type 0 -m limit --limit 1/second -j ACCEPT iptables -A OUTPUT -o lo -p icmp --icmp-type 0 -m limit --limit 2/second -j ACCEPT iptables -A INPUT -i lo -p icmp --icmp-type 3 -m limit --limit 1/second -j ACCEPT iptables -A OUTPUT -o lo -p icmp --icmp-type 3 -m limit --limit 2/second -j ACCEPT iptables -A INPUT -i lo -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT iptables -A OUTPUT -o lo -p icmp --icmp-type 8 -m limit --limit 2/second -j ACCEPT iptables -A INPUT -i lo -p icmp --icmp-type 11 -m limit --limit 1/second -j ACCEPT iptables -A OUTPUT -o lo -p icmp --icmp-type 11 -m limit --limit 2/second -j ACCEPT ip6tables -A INPUT -i lo -p icmp -m limit --limit 1/second -j ACCEPT ip6tables -A OUTPUT -o lo -p icmp -m limit --limit 2/second -j ACCEPT ############################## SYSLOG ############################################### iptables -A INPUT -i lo -p udp -m multiport --dports 514 -j ACCEPT iptables -A INPUT -i lo -p udp -m multiport --sports 514 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --dports 514 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --sports 514 -j ACCEPT ############################### NTP ##################################################### iptables -A INPUT -i lo -p udp -m multiport --dports 123 -j ACCEPT iptables -A INPUT -i lo -p udp -m multiport --sports 123 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --dports 123 -j ACCEPT iptables -A OUTPUT -o lo -p udp -m multiport --sports 123 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --dports 123 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 123 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 123 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 123 -j ACCEPT ################################ RCP ################################################# #iptables -A INPUT -i lo -p tcp -m multiport --dports 111 -j ACCEPT #iptables -A INPUT -i lo -p tcp -m multiport --sports 111 -j ACCEPT #iptables -A OUTPUT -o lo -p tcp -m multiport --dports 111 -j ACCEPT #iptables -A OUTPUT -o lo -p tcp -m multiport --sports 111 -j ACCEPT #iptables -A INPUT -i lo -p udp -m multiport --dports 111 -j ACCEPT #iptables -A INPUT -i lo -p udp -m multiport --sports 111 -j ACCEPT #iptables -A OUTPUT -o lo -p udp -m multiport --dports 111 -j ACCEPT #iptables -A OUTPUT -o lo -p udp -m multiport --sports 111 -j ACCEPT ################################ RSYNC ################################################# iptables -A INPUT -i lo -p tcp -m multiport --dports 873 -j ACCEPT iptables -A INPUT -i lo -p tcp -m multiport --sports 873 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --dports 873 -j ACCEPT iptables -A OUTPUT -o lo -p tcp -m multiport --sports 873 -j ACCEPT ########################################################################################### ################################################################################################ # Router and Internal Network Rules ################################################################################################### # # REMOVED /ADD YOUR OWN according to your needs sshd etc # # ############################################################################################################################## # Application and Port Specific Rules for INTERNET ############################################################################################################################## # PUBLIC OUTPUT ############################################################################################################################################# ################################################## HTTP HTTPS Client ############################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 80,443,8000,8080,8443,8082,8445,3128 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 80,443,8000,8080,8443,8082,8445,3128 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 80,443,8000,8080,8443,8082,8445,3128 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --dports 80,443,8000,8080,8443,8082,8445,3128 -m state --state ESTABLISHED -j ACCEPT ip6tables -A OUTPUT -o $int_if -p tcp -m multiport --dports 80,443,8000,8080,8443,8082,8445,3128 -m state --state NEW,ESTABLISHED -j ACCEPT ip6tables -A INPUT -i $int_if -p tcp -m multiport --sports 80,443,8000,8080,8443,8082,8445,3128 -m state --state ESTABLISHED -j ACCEPT ip6tables -A OUTPUT -o $int_if -p tcp -m multiport --sports 80,443,8000,8080,8443,8082,8445,3128 -m state --state NEW,ESTABLISHED -j ACCEPT ip6tables -A INPUT -i $int_if -p tcp -m multiport --dports 80,443,8000,8080,8443,8082,8445,3128 -m state --state ESTABLISHED -j ACCEPT ################################################## HKP OPEN PGP SERVER CLIENT ############################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 11371 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 11371 -m state --state ESTABLISHED -j ACCEPT ################################################## RSYNC CLIENT ####################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 873 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 873 -m state --state ESTABLISHED -j ACCEPT ################################################## HTTPS PROXY ############################################################################### #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 8081,8000,8090,9090 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 8081,8000,8090,9090 -m state --state ESTABLISHED,RELATED -j ACCEPT ################################################# SQUID HTTPS PROXY ################################################################################ #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 3128 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 3128 -m state --state ESTABLISHED -j ACCEPT ########################################## SOCK4,SOCK5 Client ################################################################################## iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 1080,1085 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 1080,1085 -m state --state ESTABLISHED -j ACCEPT ########################################## IRC Client ################################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 6667,6668,6669,6697,9999 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 6667,6668,6669,6697,9999 -m state --state ESTABLISHED -j ACCEPT ########################################## XMPP Client ################################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 5190,5222,5223,5269,5280,5281,5298,8010 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 5190,5222,5223,5269,5280,5281,5298,8010 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 5298 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --sports 5298 -m state --state ESTABLISHED -j ACCEPT ########################################## MSN Client ################################################################################### #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 1863 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 1863 -m state --state ESTABLISHED -j ACCEPT ########################################## FTP Client ################################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 20,21,989,990 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 20,21,989,990 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 20,21,989,990 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --sports 20,21,989,990 -m state --state ESTABLISHED -j ACCEPT ########################################## NNTP Client ################################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 119,563 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 119,563 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 119,563 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --sports 119,563 -m state --state ESTABLISHED -j ACCEPT ########################################## TELNET Client #################################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 23 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 23 -m state --state ESTABLISHED -j ACCEPT ########################################### SSH Client ################################################################################## iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 22 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 22 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 22 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --dports 22 -m state --state ESTABLISHED -j ACCEPT ############################################# SMTP Client ##################################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 25,465,587,2525 -m limit --limit 5/second --limit-burst 10 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 25,465,587,2525 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 25,465,587,2525 -m limit --limit 5/second --limit-burst 10 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --dports 25,465,587,2525 -m state --state ESTABLISHED -j ACCEPT ip6tables -A OUTPUT -o $int_if -p tcp -m multiport --dports 25,465,587,2525 -m limit --limit 5/second --limit-burst 10 -m state --state NEW,ESTABLISHED -j ACCEPT ip6tables -A INPUT -i $int_if -p tcp -m multiport --sports 25,465,587,2525 -m state --state ESTABLISHED -j ACCEPT ip6tables -A OUTPUT -o $int_if -p tcp -m multiport --sports 25,465,587,2525 -m limit --limit 5/second --limit-burst 10 -m state --state NEW,ESTABLISHED -j ACCEPT ip6tables -A INPUT -i $int_if -p tcp -m multiport --dports 25,465,587,2525 -m state --state ESTABLISHED -j ACCEPT ########################################## POP3 Client ############################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 110,995 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 110,995 -m state --state ESTABLISHED -j ACCEPT ########################################## IMAP Client ################################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 143,993 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 143,993 -m state --state ESTABLISHED -j ACCEPT ######################################## DNS Client ####################################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 53,953 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --sports 53,953 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 53,953 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 53,953 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 53,953 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --dports 53,953 -m state --state ESTABLISHED -j ACCEPT ####################################### BOOTP Client ####################################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -d $gateway_ip -p udp -m multiport --dports 67,68 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -s $gateway_ip -p udp -m multiport --sports 67,68 -m state --state ESTABLISHED -j ACCEPT ########################################## NTP Client ########################################################################################## iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 123 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --sports 123 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 123 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 123 -m state --state ESTABLISHED -j ACCEPT ########################################### ICMP Ping ############################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -p icmp --icmp-type ping -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p icmp --icmp-type ping -m state --state ESTABLISHED -j ACCEPT # echo reply from ping iptables -A INPUT -i $int_if -p icmp --icmp-type 0 -d $int_ip1 -m state --state ESTABLISHED -j ACCEPT # rejection messages iptables -A INPUT -i $int_if -p icmp --icmp-type 3 -d $int_ip1 -m state --state ESTABLISHED -j ACCEPT # time out signal iptables -A INPUT -i $int_if -p icmp --icmp-type 11 -d $int_ip1 -m state --state ESTABLISHED -j ACCEPT # echo request from ping iptables -A INPUT -i $int_if -p icmp --icmp-type 8 -m limit --limit 1/second -d $int_ip1 -m state --state ESTABLISHED -j ACCEPT # ip6tables -A OUTPUT -o $int_if -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT # ip6tables -A INPUT -i $int_if -p icmp -m state --state ESTABLISHED -j ACCEPT ########################################## SPECIALIZED OUTPUT ######################################################################################### ########################################## GIT Client #################################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 9418 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 9418 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 9418 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --dports 9418 -m state --state ESTABLISHED -j ACCEPT ######################################### FTP SSL Client ######################################################################################### #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp --dport 2121 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp --sport 2121 -m state --state ESTABLISHED -j ACCEPT ######################################### I2P Client ########################################################################################## #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 19648 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 19648 -m state --state ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 19648 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --sports 19648 -m state --state ESTABLISHED -j ACCEPT ########################################## FREENET Client ######################################################################################### #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 12701,29732 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --sports 12701,29732 -m state --state ESTABLISHED -j ACCEPT ########################################## TOR Client ############################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 9001,9040,9050,9051,9150,9151 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 9001,9040,9050,9051,9150,9151 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 9001,9040,9050,9051,9150,9151 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --dports 9001,9040,9050,9051,9150,9151 -m state --state ESTABLISHED -j ACCEPT ########################################## BitTorrent Client ######################################################################################### #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 2710,6881,6887,6888,6889,6890,6969 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 2710,6881,6887,6888,6889,6890,6969 -m state --state ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 2710,6881,6887,6888,6889,6890,6969 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --sports 2710,6881,6887,6888,6889,6890,6969 -m state --state ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 6969,2710,4444,1337,80 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --sports 6969,2710,4444,1337,80 -m state --state ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 6969,2710,4444,1337,80 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --dports 6969,2710,4444,1337,80 -m state --state ESTABLISHED -j ACCEPT ########################################## NETBIOS Client ############################################################################### #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 135,137,138,139 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 135,137,138,139 -m state --state ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 135,137,138,139 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --dports 135,137,138,139 -m state --state ESTABLISHED -j ACCEPT # #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 135,137,138,139 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --sports 135,137,138,139 -m state --state ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 135,137,138,139 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --dports 135,137,138,139 -m state --state ESTABLISHED -j ACCEPT ########################################## SMB Client ############################################################################### #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 445 -m state --state NEW,ESTABLISHED-j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 445 -m state --state ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 445 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --dports 445 -m state --state ESTABLISHED -j ACCEPT ########################################## CUPS Client ############################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 631 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 631 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 631 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --dports 631 -m state --state ESTABLISHED -j ACCEPT # iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 631 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --sports 631 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 631 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --dports 631 -m state --state ESTABLISHED -j ACCEPT ########################################## PULSE AUDIO Client ############################################################################### #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 4713 -m state --state NEW,ESTABLISHED, -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 4713 -m state --state ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 4713 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --dports 4713 -m state --state ESTABLISHED -j ACCEPT ########################################## LDAP Client ############################################################################### iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 389 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --sports 389 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 389 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --dports 389 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 389 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --sports 389 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 389 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --dports 389 -m state --state ESTABLISHED -j ACCEPT ########################################################################################################################################################### ######################################################################################################################### # PUBLIC INPUTS ######################################################################################################################### ################################### NTP SERVER ############################################################### #iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --dports 123 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 123 -m state --state ESTABLISHED -j ACCEPT ################################### NNTP SERVER ############################################################### #iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --dports 119,563 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 119,563 -m state --state ESTABLISHED -j ACCEPT ################################### SMTP SERVER ##################################################################################################### #iptables -A INPUT -i $int_if -p tcp -m multiport --dports 25,465,587,2525 -m limit --limit 10/s --limit-burst 12 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 25,465,587,2525 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --sports 25,465,587,2525 -m limit --limit 10/s --limit-burst 12 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 25,465,587,2525 -m state --state ESTABLISHED -j ACCEPT ################################### POP3 SERVER ###################################################################################################### #iptables -A INPUT -i $int_if -p tcp -m multiport --dports 110,995 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 110,995 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --sports 110,995 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 110,995 -m state --state ESTABLISHED -j ACCEPT ################################### IMAP4 SERVER ###################################################################################################### #iptables -A INPUT -i $int_if -p tcp -m multiport --dports 143,993 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 143,993 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --sports 143,993 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 143,993 -m state --state ESTABLISHED -j ACCEPT ################################### TELNET SERVER ################################################################################################# #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --dports 23 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -s $int_ip1 -m multiport --sports 23 -m state --state ESTABLISHED -j ACCEPT ################################## SSH SERVER #################################################################################################### #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --dports 22 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -s $int_ip1 -m multiport --sports 22 -m state --state ESTABLISHED -j ACCEPT ################################### FTP SERVER ##################################################################################################### #iptables -A INPUT -i $int_if -p tcp -m multiport --dports 20,21,2121 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 20,21,2121 -m state --state ESTABLISHED -j ACCEPT ################################## HTTP HTTPS SERVER ####################################################################################################### #iptables -A INPUT -i $int_if -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --sports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 80,443 -m state --state ESTABLISHED -j ACCEPT #ip6tables -A INPUT -i $int_if -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT #ip6tables -A OUTPUT -o $int_if -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED -j ACCEPT #ip6tables -A INPUT -i $int_if -p tcp -m multiport --sports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT #ip6tables -A OUTPUT -o $int_if -p tcp -m multiport --dports 80,443 -m state --state ESTABLISHED -j ACCEPT ################################### FREENET SERVER ############################################################################################### #iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --dports 12701,29732 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 12701,29732 -m state --state ESTABLISHED -j ACCEPT ################################### BitTorrent SERVER ############################################################################################### #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --dports 6880,6881,6882,6883,6884,6885,6886 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 6880,6881,6882,6883,6884,6885,6886 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --dports 6880,6881,6882,6883,6884,6885,6886 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 6880,6881,6882,6883,6884,6885,6886 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp --sport 53 --dport 4444 -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --dport 53 --sport 4444 -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #################################### I2P SERVER ##################################################################################################### #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --dports 19648 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 19648 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --dports 19648 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 19648 -m state --state ESTABLISHED -j ACCEPT #################################### TOR SERVER ##################################################################################################### #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --dports 9001,9040,9050,9051,9150,9151 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 9001,9040,9050,9051,9150,9151 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --dports 9001,9040,9050,9051,9150,9151 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 9001,9040,9050,9051,9150,9151 -m state --state ESTABLISHED -j ACCEPT ############################################################################################################################################################################## # LOCAL / PRIVATE INPUTS # mac address bind local clients to hosts # ####################################### BOOTP SERVER ###################################################################################################### iptables -A INPUT -i $int_if -s $gateway_ip -d $int_ip1 -p udp -m multiport --dports 67,68 -m state --state NEW,ESTABLISHED -j ACCEPT ####################################### RSYSLOG SERVER ########################################################################################################### iptables -A INPUT -i $int_if -s $gateway_ip -d $int_ip1 -p udp --sport 514 --dport 514 -m state --state NEW,ESTABLISHED -j ACCEPT ####################################### DNS SERVER UNBOUND ######################################################################################################## iptables -A INPUT -i $int_if -p udp --sport 53 --dport 53 -d $int_ip1 -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -p udp --dport 53 --sport 53 -s $int_ip1 -d $host_ip -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -p udp --dport 53 --sport 53 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -p udp --sport 53 --dport 53 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -p tcp --sport 53 --dport 53 -d $int_ip1 -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -p tcp --dport 53 --sport 53 -s $int_ip1 -d $host_ip -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -p tcp --dport 53 --sport 53 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -p tcp --sport 53 --dport 53 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -p udp --sport 53 --dport 53 -d $int_ip1 -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -p udp --dport 53 --sport 53 -s $int_ip1 -d $client1_ip -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -p udp --dport 53 --sport 53 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -p udp --sport 53 --dport 53 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -p tcp --sport 53 --dport 53 -d $int_ip1 -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -p tcp --dport 53 --sport 53 -s $int_ip1 -d $client1_ip -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -p tcp --dport 53 --sport 53 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -p tcp --sport 53 --dport 53 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -p udp --sport 53 --dport 53 -d $int_ip1 -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -p udp --dport 53 --sport 53 -s $int_ip1 -d $client2_ip -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -p udp --dport 53 --sport 53 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -p udp --sport 53 --dport 53 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -p tcp --sport 53 --dport 53 -d $int_ip1 -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -p tcp --dport 53 --sport 53 -s $int_ip1 -d $client2_ip -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -i $int_if -p tcp --dport 53 --sport 53 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $int_if -p tcp --sport 53 --dport 53 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT ################################### POP3 SERVER ###################################################################################################### #iptables -A INPUT -i $int_if -p tcp -m multiport --dports 110,995 -d $int_ip1 -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 110,995 -s $int_ip1 -d $host_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --sports 110,995 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 110,995 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --dports 110,995 -d $int_ip1 -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 110,995 -s $int_ip1 -d $client1_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --sports 110,995 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 110,995 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --dports 110,995 -d $int_ip1 -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 110,995 -s $int_ip1 -d $client2_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --sports 110,995 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 110,995 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT ################################### IMAP4 SERVER ###################################################################################################### #iptables -A INPUT -i $int_if -p tcp -m multiport --dports 143,993 -d $int_ip1 -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 143,993 -s $int_ip1 -d $host_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --sports 143,993 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 143,993 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --dports 143,993 -d $int_ip1 -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 143,993 -s $int_ip1 -d $client1_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --sports 143,993 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 143,993 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --dports 143,993 -d $int_ip1 -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 143,993 -s $int_ip1 -d $client2_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --sports 143,993 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 143,993 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #################################################### SMB SERVER ############################################################################################## #iptables -A INPUT -i $int_if -p tcp --sport 445 --dport 445 -d $int_ip1 -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --dport 445 --sport 445 -s $int_ip1 -d $host_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --dport 445 --sport 445 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --sport 445 --dport 445 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --sport 445 --dport 445 -d $int_ip1 -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --dport 445 --sport 445 -s $int_ip1 -d $client1_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --dport 445 --sport 445 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --sport 445 --sport 445 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --sport 445 --dport 445 -d $int_ip1 -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --dport 445 --sport 445 -s $int_ip1 -d $client2_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --dport 445 --sport 445 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --sport 445 --dport 445 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT ####################################################### NETBIOS SERVER ############################################################################################## #iptables -A INPUT -i $int_if -p tcp -m multiport --dports 135,137,138,139 -d $int_ip1 -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 135,137,138,139 -s $int_ip1 -d $host_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --sports 135,137,138,139 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 135,137,138,139 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp -m multiport --dports 135,137,138,139 -d $int_ip1 -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp -m multiport --sports 135,137,138,139 -s $int_ip1 -d $host_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp -m multiport --sports 135,137,138,139 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp -m multiport --dports 135,137,138,139 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --dports 135,137,138,139 -d $int_ip1 -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 135,137,138,139 -s $int_ip1 -d $client1_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --sports 135,137,138,139 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 135,137,138,139 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp -m multiport --dports 135,137,138,139 -d $int_ip1 -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp -m multiport --sports 135,137,138,139 -s $int_ip1 -d $client1_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp -m multiport --sports 135,137,138,139 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp -m multiport --dports 135,137,138,139 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --dports 135,137,138,139 -d $int_ip1 -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 135,137,138,139 -s $int_ip1 -d $client2_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp -m multiport --sports 135,137,138,139 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 135,137,138,139 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp -m multiport --dports 135,137,138,139 -d $int_ip1 -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp -m multiport --sports 135,137,138,139 -s $int_ip1 -d $client2_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp -m multiport --sports 135,137,138,139 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp -m multiport --dports 135,137,138,139 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #################################################### CUPS SERVER ############################################################################################## #iptables -A INPUT -i $int_if -p udp --sport 631 --dport 631 -d $int_ip1 -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --dport 631 --sport 631 -s $int_ip1 -d $host_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp --dport 631 --sport 631 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --sport 631 --dport 631 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --sport 631 --dport 631 -d $int_ip1 -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --dport 631 --sport 631 -s $int_ip1 -d $host_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --dport 631 --sport 631 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --sport 631 --dport 631 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp --sport 631 --dport 631 -d $int_ip1 -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --dport 631 --sport 631 -s $int_ip1 -d $client1_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp --dport 631 --sport 631 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --sport 631 --dport 631 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --sport 631 --dport 631 -d $int_ip1 -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --dport 631 --sport 631 -s $int_ip1 -d $client1_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --dport 631 --sport 631 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --sport 631 --dport 631 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp --sport 631 --dport 631 -d $int_ip1 -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --dport 631 --sport 631 -s $int_ip1 -d $client2_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp --dport 631 --sport 631 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --sport 631 --dport 631 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --sport 631 --dport 631 -d $int_ip1 -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --dport 631 --sport 631 -s $int_ip1 -d $client2_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --dport 631 --sport 631 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --sport 631 --dport 631 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT ####################################### LDAP SERVER OPENLDAP ######################################################################################################## #iptables -A INPUT -i $int_if -p udp --sport 389 --dport 389 -d $int_ip1 -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --dport 389 --sport 389 -s $int_ip1 -d $host_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp --dport 389 --sport 389 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --sport 389 --dport 389 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --sport 389 --dport 389 -d $int_ip1 -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --dport 389 --sport 389 -s $int_ip1 -d $host_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --dport 389 --sport 389 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --sport 389 --dport 389 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp --sport 389 --dport 389 -d $int_ip1 -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --dport 389 --sport 389 -s $int_ip1 -d $client1_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp --dport 389 --sport 389 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --sport 389 --dport 389 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --sport 389 --dport 389 -d $int_ip1 -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --dport 389 --sport 389 -s $int_ip1 -d $client1_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --dport 389 --sport 389 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --sport 389 --dport 389 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp --sport 389 --dport 389 -d $int_ip1 -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --dport 389 --sport 389 -s $int_ip1 -d $client2_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp --dport 389 --sport 389 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --sport 389 --dport 389 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --sport 389 --dport 389 -d $int_ip1 -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --dport 389 --sport 389 -s $int_ip1 -d $client2_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --dport 389 --sport 389 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --sport 389 --dport 389 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT ####################################### XMPP SERVER ######################################################################################################## #iptables -A INPUT -i $int_if -p udp --sport 5222 --dport 5222 -d $int_ip1 -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --dport 5222 --sport 5222 -s $int_ip1 -d $host_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp --dport 5222 --sport 5222 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --sport 5222 --dport 5222 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --sport 5222 --dport 5222 -d $int_ip1 -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --dport 5222 --sport 5222 -s $int_ip1 -d $host_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --dport 5222 --sport 5222 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --sport 5222 --dport 5222 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp --sport 5222 --dport 5222 -d $int_ip1 -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --dport 5222 --sport 5222 -s $int_ip1 -d $client1_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp --dport 5222 --sport 5222 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --sport 5222 --dport 5222 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --sport 5222 --dport 5222 -d $int_ip1 -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --dport 5222 --sport 5222 -s $int_ip1 -d $client1_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --dport 5222 --sport 5222 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --sport 5222 --dport 5222 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp --sport 5222 --dport 5222 -d $int_ip1 -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --dport 5222 --sport 5222 -s $int_ip1 -d $client2_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p udp --dport 5222 --sport 5222 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p udp --sport 5222 --dport 5222 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --sport 5222 --dport 5222 -d $int_ip1 -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --dport 5222 --sport 5222 -s $int_ip1 -d $client2_ip -m state --state ESTABLISHED -j ACCEPT #iptables -A INPUT -i $int_if -p tcp --dport 5222 --sport 5222 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT #iptables -A OUTPUT -o $int_if -p tcp --sport 5222 --dport 5222 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT ##################################################################################################################### # ICMP INPUT ####################################################################################################################### # accept ICMP packets (ping et.al.) iptables -A INPUT -p icmp -j LnD ip6tables -A INPUT -p icmp -j LnD ####################################################################################################################### # IP SPOOFING PROOFING ####################################################################################################################### iptables -A INPUT -s 10.0.0.0/8 -j LnD iptables -A INPUT -s 172.16.0.0/12 -j LnD iptables -A INPUT -s 224.0.0.0/4 -j LnD iptables -A OUTPUT -d 224.0.0.0/16 -j LnD iptables -A INPUT -s 240.0.0.0/5 -j LnD iptables -A INPUT -s 169.254.0.0/16 -j LnD iptables -A OUTPUT -d 255.255.255.255 -j LnD iptables -A INPUT -s 192.168.0.0/16 -j LnD iptables -A INPUT -s 127.0.0.0/8 -j LnD iptables -A INPUT -s 0.0.0.0/8 -j LnD ######################################################################################################################## # FINAL LOG DROP ####################################################################################################################### ########################################################################################################################## # log all the rest before dropping iptables -A INPUT -j LOG --log-prefix "IPTables IN Dropped " --log-level=info; iptables -A INPUT -j REJECT --reject-with icmp-host-unreachable iptables -A OUTPUT -j LOG --log-prefix "IPTables OUT Dropped " --log-level=info; iptables -A OUTPUT -j REJECT --reject-with icmp-host-unreachable iptables -A FORWARD -j LOG --log-prefix "IPTables FW Dropped " --log-level=info; iptables -A FORWARD -j REJECT --reject-with icmp-host-unreachable ip6tables -A INPUT -j LOG --log-prefix "IPTables IN Dropped " --log-level=info; ip6tables -A INPUT -j REJECT ip6tables -A OUTPUT -j LOG --log-prefix "IPTables OUT Dropped " --log-level=info; ip6tables -A OUTPUT -j REJECT ip6tables -A FORWARD -j LOG --log-prefix "IPTables FW Dropped " --log-level=info; ip6tables -A FORWARD -j REJECT ########################################################################################################################## # SAVE RULES ##################################################################################################################### iptables-save > /etc/iptables/iptables.rules ip6tables-save > /etc/iptables/ip6tables.rules #list the rules #iptables -L -v # print the time the script finishes echo "ENDWALL LOADED" date
Comments
0 B
|👍
/👎