Firewall Iptables

https://github.com/vnlinux/firewall
http://codevl.net/webmaster/hosting-server/huong-dan-cau-hinh-how-to-config-iptables-firewall-tren-centos
http://techblog.vn/domain-hosting-server/cau-hinh-firewall-iptables-tren-centos-redhat-446/
http://wiki.centos.org/HowTos/Network/IPTables

https://github.com/vnlinux/firewall

file mau /etc/init.d/iptables

#!/bin/sh
#
# Startup script to implement /etc/sysconfig/iptables pre-defined rules.

IPTABLES=/sbin/iptables
$IPTABLES -F
$IPTABLES -F -t nat


#/sbin/modprobe ip_conntrack
#/sbin/modprobe ip_conntrack_ftp

# Clear any existing firewall stuff before we start
#$IPTABLES --flush
#$IPTABLES -t nat --flush
#$IPTABLES -t mangle --flush
# turn on NAT (IP masquerading for outgoing packets)
$IPTABLES -A POSTROUTING -t nat -o bond0 -j MASQUERADE
$IPTABLES -A POSTROUTING -t nat -o eth0 -j MASQUERADE
$IPTABLES -A POSTROUTING -t nat -o eth1 -j MASQUERADE
$IPTABLES -A POSTROUTING -t nat -o eth2 -j MASQUERADE
$IPTABLES -A POSTROUTING -t nat -o eth3 -j MASQUERADE
$IPTABLES -A POSTROUTING -t nat -o tun0 -j MASQUERADE
$IPTABLES -A POSTROUTING -t nat -o tun1 -j MASQUERADE
$IPTABLES -A POSTROUTING -t nat -o tun2 -j MASQUERADE
$IPTABLES -A POSTROUTING -t nat -o tun3 -j MASQUERADE
$IPTABLES -A POSTROUTING -t nat -o tun4 -j MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i bond0 -p icmp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i bond0 -p tcp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i bond0 -p udp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth1 -p icmp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth1 -p tcp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth1 -p udp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth2 -p icmp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth2 -p tcp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth2 -p udp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth3 -p icmp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth3 -p tcp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth3 -p udp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i tun0 -p icmp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i tun0 -p tcp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i tun0 -p udp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i tun1 -p icmp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i tun1 -p tcp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i tun1 -p udp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i tun2 -p icmp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i tun2 -p tcp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i tun2 -p udp
$IPTABLES -A FORWARD -i eth3 -j ACCEPT
$IPTABLES -A FORWARD -o eth3 -j ACCEPT

#Keepalive
$IPTABLES -I INPUT -i eth2 -d 224.0.0.0/8 -j ACCEPT
$IPTABLES -I INPUT -p vrrp -j ACCEPT
$IPTABLES -A INPUT -p 112 -i eth2 -j ACCEPT
$IPTABLES -A OUTPUT -p 112 -o eth2 -j ACCEPT