iptables

/* d.mocek */

#!/bin/bash

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT

iptables --flush

iptables -A INPUT -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -m state --state NEW -j ACCEPT

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

iptables -A INPUT -p icmp -j ACCEPT

iptables -D INPUT -p icmp -j ACCEPT

iptables -N MLOG
iptables -A INPUT -i  local  -p tcp  -m state  --state NEW -j MLOG

iptables -N ELOG
# iptables -A INPUT -p icmp  -m limit --limit 500b -j ELOG

iptables -A INPUT -p icmp  -m connbytes  --connbytes-mode bytes --connbytes-dir original --connbytes 500 -j ELOG

iptables -A INPUT -p tcp --dport ssh -m limit --limit 3/min

# 10
iptables -A INPUT -s 192.168.1.100 -p tcp --dport ssh -j REJECT
# 11
# http://www.chiark.greenend.org.uk/~peterb/network/drop-vs-reject

# 12
iptables -A INPUT -m mac --mac-source 00:11:22:33:44:55 -j ACCEPT

#13
iptables -A INPUT -f -j DROP

#14
# iptabels -L ELOG

# 15
iptables -A INPUT -m connbytes --connbytes-mode bytes --connbytes-dir both  --connbytes 500  -j MARK --set-mark 1

# 16
iptables -t mangle -A PREROUTING -i eth0 -j TTL --ttl-set 16

#17
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1000