My simple iptable rules

iptables.sh

#!/bin/bash
###############################################################################
# The MIT License
#
# Copyright 2018 Raymund Ács <raycsucsu@gmail.com>.
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
# THE SOFTWARE.
#


# Flush the rules
iptables -F

# Blocking null packets
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

# Reject syn-flood attack
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

# XMAS packets
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

# Allow loopback access
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

########################
# Open port for services
########################

# ssh (default 22)
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

# http (default 80)
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

# https (default 443)
iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

# Enable pings
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT

# Allow to use outgoing connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Block everything else
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP

# Log dropped packets
iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7
iptables -A LOGGING -m addrtype --dst-type LOCAL -m limit --limit 1/sec -j LOG --log-prefix "IPTables reject: " --log-level 6
iptables -A LOGGING -j DROP