ipt_dns_sofar

### INSTALLATION(S)
# IPSET
* * * * * /sbin/ipset save > /etc/ipsetrules.save
@reboot /sbin/ipset restore -! < /etc/ipsetrules.save
## IPTABLES PERSISTENT
# 1. apt update
# 2. apt install iptables-persistent
# 3. systemctl enable netfilter-persistent
# 4. Add your rules
# 5. invoke-rc.d netfilter-persistent save
## COUNTRY BLOCKING
# https://www.vultr.com/docs/easy-iptables-configuration-and-examples-on-ubuntu-16-04
# There's an issue, yes, we know. Go here: https://legacy-geoip-csv.ufficyo.com/
# The command is: wget -q https://legacy-geoip-csv.ufficyo.com/Legacy-MaxMind-GeoIP-database.tar.gz -O - | tar -xvzf - -C /usr/share/xt_geoip
## IPSET
# apt-get install ipset
###

## ALLOW ALL FROM VPC NETWORK
iptables -A INPUT -s 172.16.0.0/12 -j ACCEPT

## ALLOW ALL FROM CLOUDFLARE CDN
# https://support.cloudflare.com/hc/en-us/articles/200169166-How-do-I-whitelist-Cloudflare-s-IP-addresses-in-iptables-
ipset create cf hash:net
for x in $(curl https://www.cloudflare.com/ips-v4); do ipset add cf $x; done
iptables -A INPUT -m set --match-set cf src -p tcp -m multiport --dports http,https -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports http,https -j REJECT --reject-with tcp-reset

## ONLY ALLOW "GOOD" COUNTRIES
iptables -A INPUT -m geoip --src-cc US -j ACCEPT

## BLOCK ALL OTHERS
iptables -A INPUT -p tcp --dport 22 -j DROP
iptables -A INPUT -p udp --dport 53 -j DROP
iptables -A INPUT -p tcp --dport 53 -j DROP

## DNS AMPLIFICATION ATTACKS
iptables -A INPUT -p udp --dport 53 -m string --from 40 --algo bm --hex-string '|0000FF0001|' -m recent --set --name dnsanyquery 
iptables -A INPUT -p udp --dport 53 -m string --from 40 --algo bm --hex-string '|0000FF0001|' -m recent --name dnsanyquery --rcheck --seconds 60 --hitcount 3 -j DROP
iptables -A INPUT -p tcp --dport 53 -m string --from 52 --algo bm --hex-string '|0000FF0001|' -m recent --set --name dnsanyquery 
iptables -A INPUT -p tcp --dport 53 -m string --from 52 --algo bm --hex-string '|0000FF0001|' -m recent --name dnsanyquery --rcheck --seconds 60 --hitcount 3 -j DROP