Skip to content

Instantly share code, notes, and snippets.

@dvasilen
Forked from spuzirev/basicfw.sh
Created Dec 21, 2021
Embed
What would you like to do?
#!/bin/bash
$IPT=/sbin/iptables
#################
# GENERIC INPUT #
#################
$IPT --policy INPUT DROP
# Drop invalid
$IPT --append INPUT --match conntrack --ctstate INVALID --jump DROP
# Drop invalid SYN packets
$IPT --append INPUT --protocol tcp --tcp-flags ALL ACK,RST,SYN,FIN --jump DROP
$IPT --append INPUT --protocol tcp --tcp-flags SYN,FIN SYN,FIN --jump DROP
$IPT --append INPUT --protocol tcp --tcp-flags SYN,RST SYN,RST --jump DROP
# Make sure NEW incoming TCP-connections are SYN packets; otherwise we need to drop them
$IPT --append INPUT --protocol tcp ! --syn --match conntrack --ctstate NEW --jump DROP
# DROP Packets with incoming fragments. This attack result into Linux server panic such data loss
$IPT --append INPUT --fragment --jump DROP
# DROP incoming malformed XMAS packets
$IPT --append INPUT --protocol tcp --tcp-flags ALL ALL --jump DROP
# DROP incoming malformed NULL packets
$IPT --append INPUT --protocol tcp --tcp-flags ALL NONE --jump DROP
# Local traffic
$IPT --append INPUT --in-interface lo --jump ACCEPT
# ICMP traffic
$IPT --append INPUT --protocol icmp --icmp-type 8 -m conntrack --ctstate NEW,ESTABLISHED,RELATED --jump ACCEPT
$IPT --append INPUT --protocol icmp --icmp-type 3 -m conntrack --ctstate NEW,ESTABLISHED,RELATED --jump ACCEPT
$IPT --append INPUT --protocol icmp --icmp-type 4 -m conntrack --ctstate NEW,ESTABLISHED,RELATED --jump ACCEPT
$IPT --append INPUT --protocol icmp --icmp-type 0 -m conntrack --ctstate NEW,ESTABLISHED,RELATED --jump ACCEPT
# Allow only ESTABLISHED, RELATED
$IPT --append INPUT --protocol tcp --match conntrack --ctstate ESTABLISHED,RELATED --jump ACCEPT
$IPT --append INPUT --protocol udp --match conntrack --ctstate ESTABLISHED,RELATED --jump ACCEPT
# End of GENERIC INPUT
##################
# GENERIC OUTPUT #
##################
$IPT --policy OUTPUT DROP
# DROP INVALID
$IPT --append OUTPUT --match conntrack --ctstate INVALID --jump DROP
# DROP invalid SYN packets
$IPT --append OUTPUT --protocol tcp --tcp-flags ALL ACK,RST,SYN,FIN --jump DROP
$IPT --append OUTPUT --protocol tcp --tcp-flags SYN,FIN SYN,FIN --jump DROP
$IPT --append OUTPUT --protocol tcp --tcp-flags SYN,RST SYN,RST --jump DROP
# Make sure NEW outgoing TCP-connections are SYN packets; otherwise we need to drop them
$IPT --append OUTPUT --protocol tcp ! --syn --match conntrack --ctstate NEW --jump DROP
# DROP packets with outgoing fragments. This attack result into Linux server panic such data loss
$IPT --append OUTPUT --fragment --jump DROP
# DROP outgoing malformed XMAS packets
$IPT --append OUTPUT --protocol tcp --tcp-flags ALL ALL --jump DROP
# DROP outgoing malformed NULL packets
$IPT --append OUTPUT --protocol tcp --tcp-flags ALL NONE --jump DROP
# Accept local traffic
$IPT --append OUTPUT --out-interface lo --jump ACCEPT
# ACCEPT NEW,RELATED,ESTABLISHED
$IPT --append OUTPUT --match conntrack --ctstate NEW,RELATED,ESTABLISHED --jump ACCEPT
# End of GENERIC OUTPUT
################
# CUSTOM RULES #
################
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment