Skip to content

Instantly share code, notes, and snippets.

@andrewlkho

andrewlkho/rules.v4

Last active October 24, 2018 14:41
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save andrewlkho/48fb40ed071f350ca33b44bd228b2967 to your computer and use it in GitHub Desktop.
Save andrewlkho/48fb40ed071f350ca33b44bd228b2967 to your computer and use it in GitHub Desktop.
Download ZIP
ip(6)tables rules
Raw
rules.v4
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
# Boilerplate acceptance policy
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i lo -j ACCEPT
# Drop invalid packets
-A INPUT -m conntrack --ctstate INVALID -j DROP
# SSH (SYN is the only valid method for establishing a new TCP connection)
-A INPUT -p tcp --syn -m conntrack --ctstate NEW --dport 22 -j ACCEPT
# ICMP
-A INPUT -p icmp -m conntrack --ctstate new -j ACCEPT
COMMIT
Raw
rules.v6
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
# Boilerplate acceptance policy
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i lo -j ACCEPT
# Drop invalid packets
-A INPUT -m conntrack --ctstate INVALID -j DROP
# SSH (SYN is the only valid method for establishing a new TCP connection)
-A INPUT -p tcp --syn -m conntrack --ctstate NEW --dport 22 -j ACCEPT
# ICMP
-A INPUT -p ipv6-icmp -j ACCEPT
COMMIT
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment