Created
January 31, 2015 09:02
-
-
Save ssskip/cc3d0c8cb1b191f85985 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
*filter | |
:INPUT ACCEPT [0:0] | |
:FORWARD ACCEPT [0:0] | |
:OUTPUT ACCEPT [0:0] | |
# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0 | |
-A INPUT -i lo -j ACCEPT | |
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT | |
# Accepts all established inbound connections | |
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT | |
# Allows all outbound traffic | |
# You could modify this to only allow certain traffic | |
-A OUTPUT -j ACCEPT | |
# Allows HTTP and HTTPS connections from anywhere (ports for websites) | |
-A INPUT -p tcp --dport 80 -j ACCEPT | |
-A INPUT -p tcp --dport 443 -j ACCEPT | |
# Allows SSH connections | |
# THE -dport NUMBER IS THE SAME ONE YOU SET UP IN THE SSHD_CONFIG FILE | |
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT | |
# Now you should read up on iptables rules and consider whether ssh access | |
# for everyone is really desired. Most likely you will only allow access from certain IPs. | |
# Allow ping | |
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT | |
# log iptables denied calls (access via 'dmesg' command) | |
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 | |
# Reject all other inbound - default deny unless explicitly allowed policy: | |
-A INPUT -j REJECT | |
-A FORWARD -j REJECT | |
COMMIT |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment