Created
April 22, 2012 04:25
-
-
Save raecoo/2451293 to your computer and use it in GitHub Desktop.
iptables default rules (Debian tested)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
*filter | |
# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0 | |
-A INPUT -i lo -j ACCEPT | |
# Accepts all established inbound connections | |
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT | |
# Allows all outbound traffic | |
# You could modify this to only allow certain traffic | |
-A OUTPUT -j ACCEPT | |
# Allows HTTP and MySQLconnections from anywhere (the normal ports for websites) | |
-A INPUT -p tcp --dport 80 -j ACCEPT | |
-A INPUT -p tcp --dport 3306 -j ACCEPT | |
# Allows SSH connections for script kiddies | |
# THE -dport NUMBER IS THE SAME ONE YOU SET UP IN THE SSHD_CONFIG FILE | |
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT | |
# Now you should read up on iptables rules and consider whether ssh access | |
# for everyone is really desired. Most likely you will only allow access from certain IPs. | |
# Allow ping | |
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT | |
# log iptables denied calls (access via 'dmesg' command) | |
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 | |
# Reject all other inbound - default deny unless explicitly allowed policy: | |
-A INPUT -j REJECT | |
-A FORWARD -j REJECT | |
COMMIT |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
iptables-restore < /etc/iptables.default.rules # Enable the rules
vim /etc/network/if-pre-up.d/iptables # applies the rules when server start
!/bin/bash
/sbin/iptables-restore </etc/iptables.default.rules
chmod +x /etc/network/if-pre-up.d/iptables # add permission for script