Skip to content

Instantly share code, notes, and snippets.

@leoleozhu
Created January 26, 2014 05:40
Show Gist options
  • Save leoleozhu/8628912 to your computer and use it in GitHub Desktop.
Save leoleozhu/8628912 to your computer and use it in GitHub Desktop.
iptables setting
#! /bin/bash
# Set the default policies to allow everything while we set up new rules.
# Prevents cutting yourself off when running from remote SSH.
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
# Flush any existing rules, leaving just the defaults
iptables -F
iptables -t nat -F
# Open port 22 for incoming SSH connections.
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 2222 -j ACCEPT
# Open 80 & 443
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
# Open 8388 for shadowsocks
iptables -A INPUT -p tcp --dport 8388 -j ACCEPT
# PPTP NAT rule
iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
# PPTP used not tcp or udp, but gre (protocol number 47).
iptables -A INPUT -p 47 -j ACCEPT
iptables -A FORWARD -i ppp0 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT
iptables -A FORWARD -i ppp1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o ppp1 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# SMTP
#iptables -A INPUT -p tcp --dport 25 -j ACCEPT
# POP3
#iptables -A INPUT -p tcp --dport 110 -j ACCEPT
# IMAP
#iptables -A INPUT -p tcp --dport 143 -j ACCEPT
# IMAPS
#iptables -A INPUT -p tcp --dport 993 -j ACCEPT
# POP3S
#iptables -A INPUT -p tcp --dport 995 -j ACCEPT
#
# Other rules...
#
# Accept any localhost (loopback) calls.
iptables -A INPUT -i lo -j ACCEPT
# Allow any existing connection to remain.
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Reset the default policies to stop all incoming and forward requests.
iptables -P INPUT DROP
iptables -P FORWARD DROP
# Accept any outbound requests from this server.
iptables -P OUTPUT ACCEPT
# Save the settings.
#service iptables save
#iptables-save -c
# Allow ping.
iptables -A INPUT -p icmp --icmp-type 8 -s 0/0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type 0 -d 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Display the settings.
#iptables -L -v --line-numbers
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment