gistfile1.txt

------ Bare Metal Server ------
Unable to run without getting locked out


------ Virtual Server ------
# Generated by iptables-save v1.4.12 on Tue Jul 14 16:51:27 2015
*mangle
:PREROUTING ACCEPT [22:1576]
:INPUT ACCEPT [22:1576]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [22:2312]
:POSTROUTING ACCEPT [19:1964]
COMMIT
# Completed on Tue Jul 14 16:51:27 2015
# Generated by iptables-save v1.4.12 on Tue Jul 14 16:51:27 2015
*nat
:PREROUTING ACCEPT [1:100]
:INPUT ACCEPT [1:100]
:OUTPUT ACCEPT [3:348]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed on Tue Jul 14 16:51:27 2015
# Generated by iptables-save v1.4.12 on Tue Jul 14 16:51:27 2015
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [3:348]
[0:0] -A INPUT -s 10.0.0.0/8 -p tcp -m tcp --dport 48000:48020 -m comment --comment "Required Nimsoft monitoring ports" -j ACCEPT
[0:0] -A INPUT -i lo -j ACCEPT
[22:1576] -A INPUT -i eth1 -p tcp -m tcp --dport 22 -j ACCEPT
[0:0] -A INPUT -p udp -m udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
[0:0] -A INPUT -p tcp -m tcp --sport 53 -m state --state ESTABLISHED -j ACCEPT
[0:0] -A INPUT -i eth1 -p tcp -m tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
[0:0] -A INPUT -i eth1 -p tcp -m tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
[0:0] -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m tcp --dport 9200 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m tcp --dport 5432 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m tcp --dport 6379 -j ACCEPT
[0:0] -A OUTPUT -o lo -j ACCEPT
[27:3212] -A OUTPUT -o eth1 -p tcp -m tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -p tcp -m tcp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
COMMIT
# Completed on Tue Jul 14 16:51:27 2015


------ Original Script ------

# Start Fresh, drop all.
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Allow Loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Port 22 for ssh on eth1 (public ip)
iptables -A INPUT -i eth1 -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -o eth1 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

# Allow DNS Lookups
iptables -A OUTPUT -p udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT  -p udp --sport 53 -m state --state ESTABLISHED     -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT  -p tcp --sport 53 -m state --state ESTABLISHED     -j ACCEPT

# Allow outgoing HTTP / HTTPS requests
iptables -A OUTPUT -o eth1 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth1 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

# Allow Nimsoft Monitoring (SoftLayer Monitoring Service)
iptables -s 10.0.0.0/8 -I INPUT -p tcp --dport 48000:48020 -j ACCEPT -m comment --comment "Required Nimsoft monitoring ports"

# Allow ping from outside in (SoftLayer Monitoring Service)
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT

# Port 9200 for elasticsearch on eth0 (private ip)
iptables -A INPUT -i eth0 -p tcp -m tcp --dport 9200 -j ACCEPT

# Port 5432 for postgres on eth0 (private ip)
iptables -A INPUT -i eth0 -p tcp -m tcp --dport 5432 -j ACCEPT

# Port 6379 for redis on eth0 (private ip)
iptables -A INPUT -i eth0 -p tcp -m tcp --dport 6379 -j ACCEPT