Skip to content

Instantly share code, notes, and snippets.

@tomeaton17
Created August 7, 2018 00:52
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save tomeaton17/310034445318d8881d94f6d95436411a to your computer and use it in GitHub Desktop.
Save tomeaton17/310034445318d8881d94f6d95436411a to your computer and use it in GitHub Desktop.
Causing intermittent drop outs
# Generated by iptables-save v1.6.2 on Tue Aug 7 00:51:28 2018
*security
:INPUT ACCEPT [892816:236841925]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [903821:312132550]
COMMIT
# Completed on Tue Aug 7 00:51:28 2018
# Generated by iptables-save v1.6.2 on Tue Aug 7 00:51:28 2018
*raw
:PREROUTING ACCEPT [919852:238407317]
:OUTPUT ACCEPT [903821:312132550]
COMMIT
# Completed on Tue Aug 7 00:51:28 2018
# Generated by iptables-save v1.6.2 on Tue Aug 7 00:51:28 2018
*mangle
:PREROUTING ACCEPT [919852:238407317]
:INPUT ACCEPT [919839:238406253]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [903821:312132550]
:POSTROUTING ACCEPT [903830:312133126]
COMMIT
# Completed on Tue Aug 7 00:51:28 2018
# Generated by iptables-save v1.6.2 on Tue Aug 7 00:51:28 2018
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [162:15183]
:IN_SSH - [0:0]
:TCP - [0:0]
:UDP - [0:0]
:logdrop - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p ipv6 -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j TCP
-A INPUT -p tcp -m recent --set --name TCP-PORTSCAN --mask 255.255.255.255 --rsource -j REJECT --reject-with tcp-reset
-A INPUT -p udp -m recent --set --name UDP-PORTSCAN --mask 255.255.255.255 --rsource -j REJECT --reject-with icmp-port-unreachable
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
-A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j IN_SSH
-A INPUT -m conntrack --ctstate INVALID -j logdrop
-A IN_SSH -m recent --rcheck --seconds 10 --hitcount 3 --rttl --name sshbf --mask 255.255.255.255 --rsource -j DROP
-A IN_SSH -m recent --rcheck --seconds 1800 --hitcount 4 --rttl --name sshbf --mask 255.255.255.255 --rsource -j DROP
-A IN_SSH -m recent --set --name sshbf --mask 255.255.255.255 --rsource -j ACCEPT
-A TCP -p tcp -m recent --update --seconds 60 --name TCP-PORTSCAN --mask 255.255.255.255 --rsource -j REJECT --reject-with tcp-reset
-A TCP -p tcp -m tcp --dport 80 -j ACCEPT
-A TCP -p tcp -m tcp --dport 443 -j ACCEPT
-A TCP -p tcp -m tcp --dport 22 -j ACCEPT
-A TCP -p tcp -m tcp --dport 53 -j ACCEPT
-A TCP -p tcp -m tcp --dport 113 -j ACCEPT
-A TCP -p tcp -m tcp --dport 6697 -j ACCEPT
-A TCP -p tcp -m tcp --dport 6881:6999 -j ACCEPT
-A TCP -p tcp -m tcp --dport 21 -j ACCEPT
-A TCP -p tcp -m tcp --dport 20 -j ACCEPT
-A UDP -p udp -m recent --update --seconds 60 --name UDP-PORTSCAN --mask 255.255.255.255 --rsource -j REJECT --reject-with icmp-port-unreachable
-A UDP -p udp -m udp --dport 53 -j ACCEPT
-A logdrop -m limit --limit 5/min --limit-burst 10 -j LOG
-A logdrop -j DROP
COMMIT
# Completed on Tue Aug 7 00:51:28 2018
# Generated by iptables-save v1.6.2 on Tue Aug 7 00:51:28 2018
*nat
:PREROUTING ACCEPT [138770:5634414]
:INPUT ACCEPT [121498:4467176]
:OUTPUT ACCEPT [245:17342]
:POSTROUTING ACCEPT [16139:653102]
COMMIT
# Completed on Tue Aug 7 00:51:28 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment