Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- apt install busybox -y
- apt install iptables-persistent netfilter-persistent conntrack nftables -y
- systemctl enable netfilter-persistent
- systemctl start netfilter-persistent
- # Whitelist SSH to VPN
- iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
- iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 8 --hitcount 1 -j DROP
- iptables -I INPUT -p udp --dport 22 -j DROP
- iptables-save > /etc/iptables/rules.v4
- iptables -I INPUT -s 213.186.33.99 -j ACCEPT
- iptables -A INPUT -p esp -j DROP
- iptables -A INPUT -p gre -j DROP
- //Change to VPN Port
- iptables -I INPUT -p tcp --dport 65500 -i eth0 -m state --state NEW -m recent --set
- iptables -I INPUT -p tcp --dport 65500 -i eth0 -m state --state NEW -m recent --update --seconds 8 --hitcount 1 -j DROP
- iptables -I INPUT -p udp --dport 65500 -j DROP
- iptables -I INPUT -i tun0 -j ACCEPT
- iptables -A PREROUTING -t raw -m rpfilter --invert -j DROP
- ip6tables -A PREROUTING -t raw -m rpfilter --invert -j DROP
- iptables-save > /etc/iptables/rules.v4
- iptables -A INPUT -p tcp -m tcp -m string --string "0x08x" --algo kmp --to 65535 -j DROP
- iptables -A INPUT -p tcp -m tcp -m string --string "0x4000" --algo kmp --to 65535 -j DROP
- iptables -A INPUT -p tcp -m tcp -m string --string "0x0000" --algo kmp --to 65535 -j DROP
- iptables -A INPUT -p udp -m udp -m string --string "0x4000" --algo kmp --to 65535 -j DROP
- iptables -A INPUT -p udp -m udp -m string --string "0x0000" --algo kmp --to 65535 -j DROP
- iptables -A INPUT -p udp -m udp -m string --string "0x00" --algo kmp --to 65535 -j DROP
- iptables -A INPUT -p tcp -m tcp -m string --string "0x00" --algo kmp --to 65535 -j DROP
- iptables -A INPUT -p udp -m udp -m string --string "0x28" --algo kmp --to 65535 -j DROP
- iptables -A INPUT -p tcp -m tcp -m string --string "0x28" --algo kmp --to 65535 -j DROP
- iptables -A INPUT -p tcp -m tcp -m string --string "0xff" --algo kmp --to 65535 -j DROP
- iptables -A INPUT -p udp -m udp -m string --string "0xff" --algo kmp --to 65535 -j DROP
- iptables -A INPUT -p tcp -m tcp -m string --string "0xffff" --algo kmp --to 65535 -j DROP
- iptables -A INPUT -p udp -m udp -m string --string "0xffff" --algo kmp --to 65535 -j DROP
- # Hash Limit (change interface if needed)
- iptables -t raw -I PREROUTING -p tcp -m tcp -i eth0 --tcp-flags FIN,SYN,RST,ACK SYN -m hashlimit --hashlimit-above 8/min --hashlimit-burst 2 --hashlimit-mode srcip --hashlimit-srcmask 24 --hashlimit-name tcplimit --hashlimit-htable-expire 30000 -j DROP
- iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --update --seconds 8 --hitcount 1 -j DROP
- iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --set
- iptables -A INPUT -p udp -i eth0 -m state --state NEW -m recent --update --seconds 8 --hitcount 1 -j DROP
- iptables -A INPUT -p udp -i eth0 -m state --state NEW -m recent --set
- iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
- iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
- iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
- iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
- iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
- iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
- iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
- iptables-save > /etc/iptables/rules.v4
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
