Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
branch: master
52 lines (39 sloc) 1.663 kB
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
# allow all loopback traffic
-A INPUT -i lo -j ACCEPT
# allow all ICMP traffic
-A INPUT -p icmpv6 -j ACCEPT
# Drop any tcp packet that does not start a connection with a syn flag.
-A INPUT -p tcp ! --syn -m state --state NEW -j DROP
# packets belonging to an established connection or related to one can pass
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# packets that are out-of-sequence are silently dropped
-A INPUT -m state --state INVALID -j DROP
# Allow incoming FTP
#-A INPUT -i eth0 -p tcp --dport 21 -j ACCEPT
# Allow incoming SSH
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
# Allow incoming HTTP
#-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
# Allow incoming HTTPS
#-A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
# Allow DNS
#-A OUTPUT -o eth0 -p tcp --dport 53 -j ACCEPT
#-A OUTPUT -o eth0 -p udp --dport 53 -j ACCEPT
#-A INPUT -i eth0 -p tcp --sport 53 -j ACCEPT
#-A INPUT -i eth0 -p udp --sport 53 -j ACCEPT
# Log dropped packets
-N LOGGING
-A INPUT -j LOGGING
-A LOGGING -p tcp -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "iptables: [INPUT6 ][denied TCP] " --log-level 7
-A LOGGING -p udp -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "iptables: [INPUT6 ][denied UDP] " --log-level 7
-A LOGGING -p icmp -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "iptables: [INPUT6 ][denied ICMP] " --log-level 7
-A INPUT -j REJECT
# allow outgoing traffic, explicitly (despite chain policy)
-A OUTPUT -j ACCEPT
# disallow forwarded traffic, explicitly (despite chain policy)
-A FORWARD -j REJECT
COMMIT
Jump to Line
Something went wrong with that request. Please try again.