iptables ruls

#!/bin/sh
IPTABLES="/sbin/iptables"

$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT

$IPTABLES -N droplog
$IPTABLES -N dropip

$IPTABLES -I droplog -p TCP -j LOG -m limit --limit 20/min --log-prefix="DROP TCP-Packet: " --log-level crit
$IPTABLES -I droplog -p UDP -j LOG -m limit --limit 20/min --log-prefix="DROP UDP-Packet: " --log-level crit
$IPTABLES -I droplog -p ICMP -j LOG -m limit --limit 20/min --log-prefix="DROP ICMP-Packet: " --log-level crit

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP

$IPTABLES -A dropip -j LOG -m limit --limit 1/min --log-prefix 'DROPIPS: ' --log-level 4
$IPTABLES -A dropip -j DROP

$IPTABLES -A INPUT -m state --state INVALID -j DROP
$IPTABLES -A OUTPUT -m state --state INVALID -j DROP

$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP

$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT

$IPTABLES -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -I OUTPUT -o eth0 -p ICMP --icmp-type echo-reply -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -I INPUT -i eth0 -p ICMP --icmp-type echo-reply -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
$IPTABLES -A INPUT -s 95.154.113.71 -j ACCEPT
$IPTABLES -I INPUT -i eth0 -p ICMP --icmp-type echo-request -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -I OUTPUT -o eth0 -p ICMP --icmp-type echo-request -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A INPUT -i eth0 -m state --state NEW -p tcp --dport 6000:6003 -j ACCEPT
$IPTABLES -A INPUT -i eth0 -m state --state NEW -p tcp --dport 7001:7002 -j ACCEPT
$IPTABLES -A INPUT -i eth0 -m state --state NEW -p udp --dport 27005 -j ACCEPT
$IPTABLES -A INPUT -i eth0 -m state --state NEW -p udp --dport 27010 -j ACCEPT
$IPTABLES -A INPUT -p udp -m udp --sport 27000:27030 --dport 1025:65355 -j ACCEPT
$IPTABLES -A INPUT -p udp -m udp --sport 4380 --dport 1025:65355 -j ACCEPT

$IPTABLES -A INPUT -p udp --dport 27015:27540 -m length --length 0:32 -j LOG --log-prefix "SRCDSXSQUERY: " --log-ip-options -m limit --limit 1/m --limit-burst 1
$IPTABLES -A INPUT -p udp --dport 27015:27540 -m length --length 0:32 -j DROP
$IPTABLES -A INPUT -p udp --dport 27015:27540 -m length --length 2521:65535 -j LOG --log-prefix "SRCDSXLFRAG: " --log-ip-options -m limit --limit 1/m --limit-burst 1
$IPTABLES -A INPUT -p udp --dport 27015:27540 -m length --length 2521:65535 -j DROP
$IPTABLES -A INPUT -p udp --dport 27015:27540 -m state --state ESTABLISH -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 27015:27540 -m state --state NEW -m hashlimit --hashlimit-mode srcip --hashlimit-name StopDoS --hashlimit 8/s --hashlimit-burst 10 -j ACCEPT
$IPTABLES -A INPUT -i eth0 -p tcp -m tcp --dport 27015:27540 -m hashlimit --hashlimit-upto 1/Min --hashlimit-burst 1 --hashlimit-mode srcip,dstip,dstport --hashlimit-name "RCONLIMIT" -j ACCEPT


$IPTABLES -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT

$IPTABLES -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 2/s -j ACCEPT

$IPTABLES -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


$IPTABLES -A INPUT -m state --state INVALID -j droplog

$IPTABLES -A INPUT -j droplog
$IPTABLES -A OUTPUT -j droplog
$IPTABLES -A FORWARD -j droplog