API tools faq
paste
Advertisement
Guest User

BeardBash

a guest
Feb 28th, 2017
140
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.98 KB | None | 0 0
raw download clone embed print report
  1. ### 1: Drop invalid packets ###
  2. /sbin/iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP
  3.  
  4. ### 2: Drop TCP packets that are new and are not SYN ###
  5. /sbin/iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
  6.  
  7. ### 3: Drop SYN packets with suspicious MSS value ###
  8. /sbin/iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
  9.  
  10. ### 4: Block packets with bogus TCP flags ###
  11. /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
  12. /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
  13. /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
  14. /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
  15. /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
  16. /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
  17. /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
  18. /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
  19. /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
  20. /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
  21. /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
  22. /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
  23. /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
  24. /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
  25.  
  26. ### 5: Block spoofed packets ###
  27. /sbin/iptables -t mangle -A PREROUTING -s 224.0.0.0/3 -j DROP
  28. /sbin/iptables -t mangle -A PREROUTING -s 169.254.0.0/16 -j DROP
  29. /sbin/iptables -t mangle -A PREROUTING -s 172.16.0.0/12 -j DROP
  30. /sbin/iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP
  31. /sbin/iptables -t mangle -A PREROUTING -s 0.0.0.0/8 -j DROP
  32. /sbin/iptables -t mangle -A PREROUTING -s 240.0.0.0/5 -j DROP
  33. /sbin/iptables -t mangle -A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP
  34.  
  35. ### 7: Drop fragments in all chains ###
  36. /sbin/iptables -t mangle -A PREROUTING -f -j DROP
  37.  
  38. ### 8: Limit connections per source IP ###
  39. /sbin/iptables -A INPUT -p tcp -m connlimit --connlimit-above 111 -j REJECT --reject-with tcp-reset
  40.  
  41. ### 9: Limit RST packets ###
  42. /sbin/iptables -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT
  43. /sbin/iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP
  44.  
  45. ### SSH brute-force protection ###
  46. /sbin/iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --set
  47. /sbin/iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 -j DROP
  48.  
  49. ### Protection against port scanning ###
  50. /sbin/iptables -N port-scanning
  51. /sbin/iptables -A port-scanning -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j RETURN
  52. /sbin/iptables -A port-scanning -j DROP
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!