iptables-rules, komptatibel mit kubernetes, zur Verwendung in der rc.local

iptables.sh

for iptables in iptables; do
	$iptables -A FORWARD -j ACCEPT

	$iptables -F INPUT
	$iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
	$iptables -A INPUT -i lo -j ACCEPT

	$iptables -A INPUT -p tcp --sport 1024:65535 --dport 22 -j ACCEPT -m comment --comment "allow ssh"
	$iptables -A INPUT -p udp --sport 1024:65535 --dport 60000:60099 -j ACCEPT -m comment --comment "allow mosh"
	$iptables -A INPUT -p tcp --sport 1024:65535 --dport 80 -j ACCEPT -m comment --comment "allow http"
	$iptables -A INPUT -p tcp --sport 1024:65535 --dport 443 -j ACCEPT -m comment --comment "allow https"

	$iptables -A INPUT -p tcp --sport 1024:65535 --dport 5222 -j ACCEPT -m comment --comment "allow xmpp starttls"
	$iptables -A INPUT -p tcp --dport 5269 -j ACCEPT -m comment --comment "allow xmpp s2s in"

	$iptables -A INPUT -p tcp --sport 1024:65535 --dport 6443 -j ACCEPT -m comment --comment "kube-apiserver"

	$iptables -A INPUT -p udp --sport 53 -m state --state ESTABLISHED -j ACCEPT -m comment --comment "allow dns"

	$iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset -m comment --comment "reject remaining tcp"
	$iptables -A INPUT -p udp -j REJECT -m comment --comment "reject remaining udp"
done