iptables script

gistfile1.sh

#!/bin/sh

IF=eth0

iptables -F 
iptables -t nat -F
iptables -X
iptables -Z

# drop all packets by default
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

# Allow all packets via lo
iptables -A INPUT -i lo -j ACCEPT

#iptables -A INPUT -i ${IF} -s 10.0.0.0/8 -j DROP
#iptables -A INPUT -i ${IF} -s 172.16.0.0/12 -j DROP
#iptables -A INPUT -i ${IF} -s 192.168.0.0/16 -j DROP

# Allow DNS query from ${IF}
iptables -A OUTPUT -o ${IF} -p udp --dport 53 -j ACCEPT

# Allow HTTP request to ${IF}
iptables -A INPUT -i ${IF} -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i ${IF} -p tcp --dport 443 -j ACCEPT

# Enable SSH on port 10022 (22 is also open for a first stage configuration)
iptables -A INPUT -i ${IF} -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i ${IF} -p tcp --dport 10022 -j ACCEPT

# Allow DHCP
iptables -A INPUT -i ${IF} -s 0.0.0.0/0 -d 0.0.0.0/0 -p udp --sport bootps --dport bootpc -j ACCEPT

# Deny all broadcast/multicast packet
iptables -A INPUT -d 255.255.255.255 -j DROP
iptables -A INPUT -d 224.0.0.1 -j DROP

# Allow response packet
iptables -A INPUT  -i ${IF} -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o ${IF} -m state --state ESTABLISHED,RELATED -j ACCEPT