Erik: Copy from old

Erik — Tue, 02 Jun 2009 03:28:07 GMT

Copy from old

New page

I use this. It does not allow any incoming data, so it's no good for NFS servers.

#!/bin/sh

IPT="/usr/sbin/iptables"

# Let's make sure forwarding is DISABLED:
echo "0" > /proc/sys/net/ipv4/ip_forward

# Let's enable SYN cookies (to protect against SYN floods):
echo "1" > /proc/sys/net/ipv4/tcp_syncookies

# Let's disable TCP timestamps to reduce the TCP stack workload:
echo "0" > /proc/sys/net/ipv4/tcp_timestamps

# Let's enable reverse path filtering for anti-spoofing:
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter

# Let's ignore PINGs which have been BROADCAST:
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Let's disable source routed packets as they are ridiculous:
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route

# Let's allow redirects from trusted gateways only:
echo "1" > /proc/sys/net/ipv4/conf/all/secure_redirects

# Let's log any UFOs which are spotted:
echo "1" > /proc/sys/net/ipv4/conf/all/log_martians

# Let's flush-out all the chains in our tables:
$IPT -F
$IPT -F -t nat
$IPT -F -t mangle

# Let's delete every non-builtin chains in our tables:
$IPT -X
$IPT -X -t nat
$IPT -X -t mangle

# Let's set our INPUT policy to DROP:
$IPT -P INPUT DROP

# Let's set our OUTPUT policy to ACCEPT, because we can
# appreciate this kinda flexibility on a Home PC:
$IPT -P OUTPUT ACCEPT

# Let's accept incoming packets which belong to connections
# that have ALREADY been initiated:
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Let's allow all packets initiating new connections LOCALLY:
$IPT -A INPUT -i lo -m state --state NEW -j ACCEPT

# Let's log every packet that reaches this rule, right before
# it hits our INPUT policy and gets a DROP:
$IPT -A INPUT -j LOG --log-prefix "INPUT DROP: "

# Let's load the module allowing Connection Tracking for FTP:
/sbin/modprobe ip_conntrack_ftp

# Let's load the module allowing Connection Tracking for IRC:
/sbin/modprobe ip_conntrack_irc

# No rc.firewall script is complete without the ubiquitous echo:
echo "So let it be written. So let it be done."

[[Category:Security]]

AllixD Firewall Script - Revision history

Erik: Copy from old