Filtrage IPTABLES

#!/bin/sh
# Script by Tlams, Jose, Anthony
# Date : 11/12/13
# fonction : Filtrage / Firewall IPTABLES
# Note: -t filter -> Optionnel

#---------------------
#-- CONFIG INITIALE --
#---------------------

# Vider les tables actuelles
iptables -t filter -F

# Vider les regles personnelles
iptables -t filter -X

# Ne pas casser les connexions etablies !
iptables -t filter -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

#Interdire toute connexion entrante
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP

# Table NAT : on accepte
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t nat -P POSTROUTING ACCEPT

# Active l'ip forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

#---------------------
#-- CONFIG FILTRAGE --
#---------------------

# Autoriser loopback
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT

# ICMP (Ping) Limite
iptables -I INPUT -p icmp --icmp-type echo-request -m recent --set
iptables -I INPUT -p icmp --icmp-type echo-request -m recent --update --seconds 10 --hitcount 5 -j DROP
iptables -t filter -A FORWARD -p icmp -j ACCEPT
iptables -t filter -A OUTPUT -p icmp -j ACCEPT
iptables -t filter-A INPUT -p icmp -j ACCEPT

#WEB limité !
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --name BLACKLIST --set
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --name BLACKLIST --update --seconds 10 --hitcount 2 --rttl -j DROP
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A FORWARD -p tcp --dport 80 -j ACCEPT

# SSH // Filtrage IP résaux connu
iptables -t filter -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT
iptables -t filter -A OUTPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT
iptables -t filter -A FORWARD -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT

# FTP // Filtrage MAC
iptables -t filter -A INPUT -m mac --mac-source 00:0F:EA:91:04:07 -p tcp --dport 21 -j ACCEPT
iptables -t filter -A FORWARD -m mac --mac-source 00:0F:EA:91:04:07 -p tcp --dport 21 -j ACCEPT

# FINGER
iptables -t filter -A INPUT -p tcp --dport 79 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 79 -j ACCEPT
iptables -t filter -A FORWARD -p tcp --dport 79 -j ACCEPT

#Log les paquets drop
iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A OUTPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP