Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #!/bin/bash
- #### Clear ####
- iptables -F
- iptables -X
- #++++++++++++++
- #### Policy ####################
- iptables -P INPUT DROP
- iptables -P FORWARD DROP
- iptables -P OUTPUT DROP
- #+++++++++++++++++++++++++++++++
- ##### CUSTOM CHAINS ####################################################################
- echo icmp
- # Icmp
- iptables -N ICMP
- iptables -A ICMP -m limit --limit 15/minute -j LOG --log-prefix "Icmp: "
- iptables -A ICMP -j DROP
- echo bad flags
- # Bad Flags, Bogus etc.
- iptables -N BOGUS
- iptables -A BOGUS -m limit --limit 15/minute -j LOG --log-prefix "Bogus: "
- iptables -A BOGUS -j DROP
- echo lan spoof
- # Lan Spoof
- iptables -N LANSPOOF
- iptables -A LANSPOOF -m limit --limit 15/minute -j LOG --log-prefix "LanSpoof: "
- iptables -A LANSPOOF -j DROP
- echo loopback spoof
- # Loopback Spoof
- iptables -N LOOPSPOOF
- iptables -A LOOPSPOOF -m limit --limit 15/minute -j LOG --log-prefix "LoopSpoof: "
- iptables -A LOOPSPOOF -j DROP
- echo final firewall
- # Finall Firewall
- iptables -N FIREWALL
- iptables -A FIREWALL -m limit --limit 15/minute -j LOG --log-prefix "Firewall: "
- iptables -A FIREWALL -j DROP
- #+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- ##### INPUT BLOCK ##############################################################################
- # Drop all ICMP
- iptables -A INPUT -p icmp -j ICMP
- # LAN Spoof
- iptables -A INPUT -i eth0 -s 192.168.1.0/24 -j LANSPOOF
- iptables -A INPUT -i wlan0 -s 192.168.1.0/24 -j LANSPOOF
- # Loopback Spoof
- iptables -A INPUT ! -i lo -s 127.0.0.0/8 -j LOOPSPOOF
- # Fragments
- iptables -A INPUT -f -j BOGUS
- # Bogus packets
- iptables -A INPUT -m conntrack --ctstate INVALID -j BOGUS
- iptables -A INPUT -p tcp --tcp-flags FIN,ACK FIN -j BOGUS
- iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j BOGUS
- iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j BOGUS
- iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j BOGUS
- iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j BOGUS
- iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j BOGUS
- iptables -A INPUT -p tcp --tcp-flags ALL ALL -j BOGUS
- iptables -A INPUT -p tcp --tcp-flags ALL NONE -j BOGUS
- iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j BOGUS
- iptables -A INPUT -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j BOGUS
- iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j BOGUS
- iptables -A INPUT -m conntrack --ctstate NEW,RELATED -p tcp ! --tcp-flags ALL SYN -j BOGUS
- #----- INPUT ACCEPT ----------------------------------------------------------------------------
- # Already established and related
- iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
- # Loopback
- iptables -A INPUT -i lo -j ACCEPT
- # allow sshing
- iptables -A INPUT -p tcp --dport ssh -j ACCEPT
- #+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- ##### OUTPUT BLOCK #####################################################################
- # Drop all ICMP
- iptables -A OUTPUT -p icmp -j ICMP
- # Bogus packets
- iptables -A OUTPUT -m conntrack --ctstate INVALID -j BOGUS
- #---- OUTPUT ACCEPT --------------------------------------------------------------------
- # Loopback
- iptables -A OUTPUT -o lo -j ACCEPT
- # Dns
- iptables -A OUTPUT -p udp --dport 53 -d 8.8.8.8 -j ACCEPT
- iptables -A OUTPUT -p udp --dport 53 -d 8.8.8.8 -j ACCEPT
- # Services
- iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
- iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
- iptables -A OUTPUT -p tcp --dport 873 -j ACCEPT
- iptables -A OUTPUT -p tcp --dport 993 -j ACCEPT
- iptables -A OUTPUT -p tcp --dport 110 -j ACCEPT
- iptables -A OUTPUT -p tcp --dport 587 -j ACCEPT
- # ssh
- #iptables -A OUTPUT -p tcp --dport ssh -j ACCEPT
- iptables -A OUTPUT -p tcp --sport ssh -j ACCEPT
- #+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- ##### FORWARD BLOCK ####################################################################
- # Bogus Packets
- iptables -A FORWARD -m conntrack --ctstate INVALID -j BOGUS
- #+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- ##### FINAL CATCH ALL ##########
- iptables -A INPUT -j FIREWALL
- iptables -A OUTPUT -j FIREWALL
- #+++++++++++++++++++++++++
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement