general iptables rules

protective.rules

#block generic recon
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP # null
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP #kill syn flood
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP # xmas

# allow all on localhost
iptables -A INPUT -i lo -j ACCEPT

#allow web traffic
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

#allow inbound ssh
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

#stateful behavior on input
iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP

service iptables save