Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- ALLOWED_IP=192.168.2.2
- OWN_IP=192.168.2.1
- OWN_IP_WAN=192.168.1.2
- OVPN_IP=178.162.194.30
- iptables -F
- iptables -X
- iptables -P INPUT DROP
- iptables -P OUTPUT DROP
- iptables -A INPUT -i lo -j ACCEPT
- iptables -A OUTPUT -o lo -j ACCEPT
- #### ALLOWED_IP -> OWN_IP
- ## Port 22
- iptables -A INPUT -i eth0 -p tcp -s $ALLOWED_IP -d $OWN_IP --sport 513:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp -s $OWN_IP -d $ALLOWED_IP --sport 22 --dport 513:65535 -m state --state ESTABLISHED -j ACCEPT
- ## Port 80
- iptables -A INPUT -i eth0 -p tcp -s $ALLOWED_IP -d $OWN_IP --sport 513:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp -s $OWN_IP -d $ALLOWED_IP --sport 80 --dport 513:65535 -m state --state ESTABLISHED -j ACCEPT
- ## Port 443
- iptables -A INPUT -i eth0 -p tcp -s $ALLOWED_IP -d $OWN_IP --sport 513:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp -s $OWN_IP -d $ALLOWED_IP --sport 443 --dport 513:65535 -m state --state ESTABLISHED -j ACCEPT
- #### OWN_IP -> OpenVPN Provider
- ## OpenVPN:
- iptables -A INPUT -i eth1 -p udp -s $OVPN_IP -d $OWN_IP_WAN --sport 1149 --dport 513:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp -s $OWN_IP_WAN -d $OVPN_IP --sport 513:65535 --dport 1149 -m state --state NEW,ESTABLISHED -j ACCEPT
- ## Forward in den Tunnel
- iptables -A FORWARD -i eth0 -o tun0 -m state --state NEW,ESTABLISHED -j ACCEPT
- iptables -A FORWARD -i tun0 -o eth0 -m state --state ESTABLISHED -j ACCEPT
- iptables -A FORWARD -i wlan0 -o tun0 -m state --state NEW,ESTABLISHED -j ACCEPT
- iptables -A FORWARD -i tun0 -o wlan0 -m state --state ESTABLISHED -j ACCEPT
- ## Masqueade
- iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
- ## Drop everything else
- iptables -A INPUT -j DROP
- iptables -A OUTPUT -j DROP
- iptables -A FORWARD -j DROP
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement