Iptables Statefull Workstation (script)

#!/bin/bash
### BEGIN INIT INFO
# Provides:             fwipv4-StateFull
# Required-Start:       $network
# Required-Stop:        $network
# Default-Start:        2 3 4 5
# Default-Stop:         0 1 6
# Short-Description: Activating Iptables StateFull
### END INIT INFO
flush_reglas(){
iptables -F
iptables -X
iptables -t raw -F
iptables -t raw -X
iptables -t mangle -F
iptables -t mangle -X
}
set_policy(){
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
}
unset_policy(){
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
}
reglas(){
# Core netfilter module
/sbin/modprobe ip_tables
# Stateful connection tracking module
/sbin/modprobe ip_conntrack
### Reglas loopback y ping ###
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
### 1: Drop invalid packets ###
iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP
### 2: Drop TCP packets that are new and are not SYN ###
iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
### 3: Drop SYN packets with suspicious MSS value ###
iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
### 4: Block packets with bogus TCP flags ###
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
### 5: Block spoofed packets ###
iptables -t mangle -A PREROUTING -s 224.0.0.0/3 -j DROP
iptables -t mangle -A PREROUTING -s 169.254.0.0/16 -j DROP
iptables -t mangle -A PREROUTING -s 172.16.0.0/12 -j DROP
iptables -t mangle -A PREROUTING -s 192.0.2.0/24 -j DROP
#iptables -t mangle -A PREROUTING -s 192.168.0.0/16 -j DROP
iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP
iptables -t mangle -A PREROUTING -s 0.0.0.0/8 -j DROP
iptables -t mangle -A PREROUTING -s 240.0.0.0/5 -j DROP
iptables -t mangle -A PREROUTING -s 248.0.0.0/5 -j DROP
iptables -t mangle -A PREROUTING -s 255.255.255.255/32 -j DROP
iptables -t mangle -A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP
### 6: Drop ICMP (useless protocol) ###
iptables -t mangle -A PREROUTING -p icmp -j DROP
### 7: Drop fragments in all chains ###
iptables -t mangle -A PREROUTING -f -j DROP
### 8: Limit connections per source IP ###
iptables -A INPUT -p tcp -m connlimit --connlimit-above 111 -j REJECT --reject-with tcp-reset
### 9: Limit RST packets ###
iptables -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT
iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP
### 10: Limit new TCP connections per second per source IP ###
iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
iptables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP
### 11: Use SYNPROXY on all ports (disables connection limiting rule) ###
iptables -A INPUT -p tcp -m tcp -d ip_local -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
### 12: Protection against port scanning ###
iptables -N port-scanning
iptables -A port-scanning -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j RETURN
iptables -A port-scanning -j DROP
### 13: SSH brute-force protection ###
iptables -A INPUT -p tcp --dport ssh_port -m conntrack --ctstate NEW -m recent --set
iptables -A INPUT -p tcp --dport ssh_port -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 -j DROP
### As a server ###
iptables -A INPUT -p tcp --dport ssh_port -m state -s net/mask --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport ssh_port -m state -d net/mask --state ESTABLISHED -j ACCEPT
### As a client ###
iptables -A OUTPUT -p udp --dport 53 -m state -d ip_dns_server --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp --sport 53 -m state -s ip_dns_server --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp --sport 123 -m state --state ESTABLISHED -j ACCEPT
### 14: MAKE SURE NEW OUTGOING TCP CONNECTIONS ARE SYN PACKETS; OTHERWISE WE NEED TO DROP THEM
iptables -A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP
### 15: DROP PACKETS WITH OUTGOING FRAGMENTS. THIS ATTACK RESULT INTO LINUX SERVER PANIC SUCH DATA LOSS
iptables -A OUTPUT -f -j DROP
### 16: DROP OUTGOING MALFORMED XMAS PACKETS
iptables -A OUTPUT -p tcp --tcp-flags ALL ALL -j DROP
### 17: DROP OUTGOING MALFORMED NULL PACKETS
iptables -A OUTPUT -p tcp --tcp-flags ALL NONE -j DROP
### 18: Invalid icmp packets need to be dropped to prevent a possible exploit.
iptables -A OUTPUT -m state -p icmp --state INVALID -j DROP
#Logueo de DROPS (Habilitar en caso necesario)
#iptables -N LOGGING #Make the chain
#iptables -A INPUT -j LOGGING #Pasa los input por la cadena de logs
#iptables -A FORWARD -j LOGGING #Pasa los forward por la cadena de logs
#iptables -A OUTPUT -j LOGGING #Pasa los outgoing por la cadena de logs
#iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
#iptables -A LOGGING -j DROP
}
case "$1" in

start)
flush_reglas
set_policy
reglas
echo "Started"
;;

stop)
flush_reglas
unset_policy
echo "Stopped"
;;

restart)
$0 stop
$0 start
;;

*)

echo "Use running: /etc/init.d/$0 {start|stop|restart}"
;;

esac