iptables

#! /bin/sh

# Flush and reset.
iptables -F
iptables -X
iptables -Z

ip6tables -F
ip6tables -X
ip6tables -Z

# Set default actions.
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

ip6tables -P INPUT DROP
ip6tables -P OUTPUT ACCEPT
ip6tables -P FORWARD DROP

# Custom chain for logging and dropping.
iptables -N LOGDROP
iptables -A LOGDROP -m recent --set
iptables -A LOGDROP -j LOG --log-prefix "iptables: "
iptables -A LOGDROP -j DROP

ip6tables -N LOGDROP
ip6tables -A LOGDROP -m recent --set
ip6tables -A LOGDROP -j LOG --log-prefix "ip6tables: "
ip6tables -A LOGDROP -j DROP

# Accept loopback traffic on the loopback interface.
iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT

ip6tables -A INPUT -s ::1/128 -d ::1/128 -i lo -j ACCEPT

# Block private ranges/bogons.
iptables -A INPUT -s 127.0.0.0/8 -j LOGDROP
iptables -A INPUT -s 10.0.0.0/8 -j LOGDROP
iptables -A INPUT -s 169.254.0.0/16 -j LOGDROP
iptables -A INPUT -s 172.16.0.0/12 -j LOGDROP
iptables -A INPUT -s 192.168.0.0/16 -j LOGDROP

ip6tables -A INPUT -s ::1/128 -j LOGDROP
ip6tables -A INPUT -s fe80::/10 -j LOGDROP

# Block RH0 packets.
ip6tables -A INPUT -m rt --rt-type 0 -j LOGDROP

# Block RST spam.
iptables -A INPUT -p tcp --tcp-flags RST RST -m recent --set --name rst --rsource
iptables -A INPUT -p tcp --tcp-flags RST RST -m recent --update --name rst --rsource --seconds 3 --hitcount 3 -j LOGDROP

ip6tables -A INPUT -p tcp --tcp-flags RST RST -m recent --set --name rst --rsource
ip6tables -A INPUT -p tcp --tcp-flags RST RST -m recent --update --name rst --rsource --seconds 3 --hitcount 3 -j LOGDROP

# Accept packets that belong to existing connections.
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Block flagged sources.
iptables -A INPUT -m recent --update --seconds 86400 -j DROP

ip6tables -A INPUT -m recent --update --seconds 86400 -j DROP

# Block SSH bruteforce attacks.
iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name ssh --rsource
iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --name ssh --rsource --seconds 180 --hitcount 4 -j LOGDROP

ip6tables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name ssh --rsource
ip6tables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --name ssh --rsource --seconds 180 --hitcount 4 -j LOGDROP

# Accept DHCP packets.
iptables -A INPUT -p udp --dport 68 -j ACCEPT

# Accept ICMP packets.
iptables -A INPUT -p icmp -j ACCEPT

ip6tables -A INPUT -p icmpv6 -j ACCEPT

# Accept SSH connections.
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT

# Accept HTTP(S) connections.
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT
ip6tables -A INPUT -p tcp --dport 443 -j ACCEPT

# Flag anyone who ends up here.
iptables -A INPUT -j LOGDROP

ip6tables -A INPUT -j LOGDROP