uncomplicated firewall (ufw) before.rules
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# | |
# rules.before | |
# | |
# Rules that should be run before the ufw command line added rules. Custom | |
# rules should be added to one of these chains: | |
# ufw-before-input | |
# ufw-before-output | |
# ufw-before-forward | |
# | |
# START OPENVPN RULES | |
# NAT table rules | |
*nat | |
:POSTROUTING ACCEPT [0:0] | |
# Allow traffic from OpenVPN client to eth0 | |
-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE | |
COMMIT | |
# END OPENVPN RULES | |
# Don't delete these required lines, otherwise there will be errors | |
*filter | |
:ufw-before-input - [0:0] | |
:ufw-before-output - [0:0] | |
:ufw-before-forward - [0:0] | |
:ufw-not-local - [0:0] | |
# End required lines | |
# allow all on loopback | |
-A ufw-before-input -i lo -j ACCEPT | |
-A ufw-before-output -o lo -j ACCEPT | |
# quickly process packets for which we already have a connection | |
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT | |
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT | |
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT | |
# drop INVALID packets (logs these in loglevel medium and higher) | |
-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny | |
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP | |
# ok icmp codes for INPUT | |
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT | |
-A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT | |
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT | |
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT | |
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT | |
# ok icmp code for FORWARD | |
-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT | |
-A ufw-before-forward -p icmp --icmp-type source-quench -j ACCEPT | |
-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT | |
-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT | |
-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT | |
# allow dhcp client to work | |
-A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT | |
# | |
# ufw-not-local | |
# | |
-A ufw-before-input -j ufw-not-local | |
# if LOCAL, RETURN | |
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN | |
# if MULTICAST, RETURN | |
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN | |
# if BROADCAST, RETURN | |
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN | |
# all other non-local packets are dropped | |
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny | |
-A ufw-not-local -j DROP | |
# allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above | |
# is uncommented) | |
-A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT | |
# allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above | |
# is uncommented) | |
-A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT | |
# don't delete the 'COMMIT' line or these rules won't be processed | |
COMMIT |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment