API tools faq
paste
Joker0day

endwall.sh

Joker0day
Dec 20th, 2017
585
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 94.64 KB | None | 0 0
raw download clone embed print report
  1. ####################################################################################
  2. #                        HEADER AND INSTRUCTIONS
  3. ####################################################################################
  4. # Current Version: endwall_nomac_v1.06  Feb 02 2016
  5. # Stable Version:  endwall_nomac_v1.05, Jan 30 2016
  6. #
  7. # Changes: Removed mac address binding
  8. #
  9. # Instructions: make directory,copy the file and change name to endwall.sh
  10. #               make whitelists,blacklist text files, edit the endwall.sh file
  11. #               change permisions to make endwall.sh executable, run the file.    
  12. # $ mkdir ~/endwall
  13. # $ cp vdyvuh.sh ~/endwall/endwall.sh
  14. # $ cd ~/endwall
  15. # $ echo " " >> smtp_whitelist.txt  # whitelist (hotmail,gmail,etc)
  16. # $ echo " " >> http_whitelist.txt  # users of your website  
  17. # $ echo " " >> http_blacklist.txt  # ipv4 addresses to restrict http/https
  18. # $ echo " " >> smtp_blacklist.txt  # ipv4 addresses to restrict smtp access
  19. # $ echo " " >> dns_blacklist.txt   # ipv4 addresses (bad dns actors) to restrict
  20. # $ echo " " >> attackers.txt       # ipv4 blacklist for hack attackers
  21. # $ echo " " >> blacklist.txt       # ipv4 blacklist of DOD subnets and others
  22. # $ echo " " >> email_blacklist.txt # strings of email addresses and keywords to block from smtp
  23. # $ echo " " >> html_blacklist.txt  # strings of attack html calls (cgi,php) to block from http
  24. # $ ls                              # list the files you just made
  25. # $ nano endwall.sh   # go to the section below labeled GLOBAL VARIABLES
  26. #                       edit the variables int_if,int_if2,host_ip,client1_ip,client1_ip,gateway_ip,
  27. #                       so that they match your needs and save. ^X  
  28. # $ chmod u+rwx endwall.sh          # change permisions to allow script execution
  29. # $ su                              # become root
  30. # # ./endwall.sh                    # execute/run the file
  31. #
  32. ##############################################################################################
  33. #                       EXAMPLES
  34. ##############################################################################################
  35. # Next add ip addresses to the whitelists and blacklists
  36. # Example: adding an ip to blacklist.txt
  37. # $ echo "116.58.45.115" >> attackers.txt
  38. # Example: banning a subnet from accessing smtp
  39. # $ echo "116.58.0.0/16" >> smtp_blacklist.txt
  40. # Example: banning a larger subnet from accessing http
  41. # $ echo "117.0.0.0/8" >> http_blacklist.txt
  42. # Example: banning a large subnet from accessing anything on your server
  43. # $ echo "118.0.0.0/8" >> blacklist.txt
  44. # Example: banning a spammer
  45. # $ echo "[email protected]" >> email_blacklist.txt (read the postfix log for examples)
  46. # Example: banning a hacker diving for files from hacking your webserver (read your httpd log for examples)
  47. # $ echo "/configuration.php" >> html_blacklist.txt
  48. # $ echo "/wordpress/xmlrpc.php" >> html_blacklist.txt
  49. # $ su                    
  50. # # ./endwall.sh   # run the firewall script with the new blacklisted ipv4 addresses
  51. ################################################################################################
  52. #                    GLOBAL VARIABLES
  53. ################################################################################################
  54. iptables=/sbin/iptables
  55. ip6tables=/sbin/ip6tables
  56.  
  57. systemctl enable iptables
  58. systemctl enable ip6tables
  59.  
  60. int_if=eth0         # internal (local) interface, e.g. eth0, wlan0, p5p1
  61. #int_if2=eth1                   # run $ifconfig or $ip link $ip addr to determine value.  
  62.  
  63. host_ip=192.168.0.160      # change to be your web server ip address (this computer)
  64. client1_ip=192.168.0.161   # change to be the static ip of your first internal client
  65. client2_ip=192.168.0.162   # change to be the static ip of your second internal client
  66. gateway_ip=192.168.0.1     # change to be the static ip of your gateway/router
  67.  
  68. int_ip1=$host_ip          # your internal ip (who are you?)
  69. #int_ip2=192.168.0.168  # change to the ip of your 2nd NIC
  70. ###################################################################################################################################
  71. #                              LINUX SECURITY BOOLEANS
  72. ###################################################################################################################################
  73. # Disable Source Routed Packets
  74. for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
  75.        echo 0 > $f
  76. done
  77.  
  78. # Disable ICMP Redirect Acceptance
  79. for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
  80.       echo 0 > $f
  81. done
  82.  
  83. # Don't send Redirect Messages
  84. for f in /proc/sys/net/ipv4/conf/*/send_redirects; do
  85.      echo 0 > $f
  86. done
  87.  
  88. # Drop Spoofed Packets coming in on an interface, which if replied to,
  89. # would result in the reply going out a different interface.
  90. for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
  91.      echo 1 > $f
  92. done
  93.  
  94. # Log packets with impossible addresses.
  95. for f in /proc/sys/net/ipv4/conf/*/log_martians; do
  96.      echo 1 > $f
  97. done
  98.  
  99. echo 1 > /proc/sys/net/ipv4/tcp_syncookies                              # enable tcp syn cookies (prevent against the common 'syn flood attack')
  100. echo 0 > /proc/sys/net/ipv4/ip_forward                                  # disable Packet forwarning between interfaces
  101. echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts                 # ignore all ICMP ECHO and TIMESTAMP requests sent to it via broadcast/multicast
  102. echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses           # disable logging of bogus responses to broadcast frames
  103. echo 1 > /proc/sys/net/ipv4/conf/all/log_martians                       # log packets with impossible addresses to kernel log
  104. echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter                          # do source validation by reversed path (Recommended option for single homed hosts)
  105. echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route                # Disable source routed packets redirects
  106. echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects                   # don't accept redirects
  107. echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects                     # don't send redirects
  108. echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route                # don't accept packets with SRR option
  109.  
  110. echo 0 > /proc/sys/net/ipv6/conf/all/accept_redirects                   # don't accept redirects
  111. echo 0 > /proc/sys/net/ipv6/conf/all/accept_source_route                # don't accept packets with SRR option
  112.  
  113. #echo 1 > /proc/sys/net/ipv4/conf/all/disable_ipv6                      # disable ipv6
  114.  
  115. #setsebool httpd_can_network_connect on   #needed for squirell mail if you are on selinux
  116. #setsebool httpd_can_sendmail on          # squirel mail
  117.  
  118. #######################################################################################
  119. ######################      FLUSH OLD RULES     #######################################
  120. iptables -F
  121. iptables -F -t mangle
  122. iptables -X -t mangle
  123. iptables -F -t nat
  124. iptables -X -t nat
  125. iptables -X
  126. iptables -Z
  127.  
  128. ip6tables -F
  129. ip6tables -F -t mangle
  130. ip6tables -X -t mangle
  131. ip6tables -X
  132. ip6tables -Z
  133.  
  134. ########################### DEFUALT POLICY and CHAINS ##########################################
  135. iptables -P INPUT   DROP
  136. iptables -P FORWARD DROP
  137. iptables -P OUTPUT  DROP
  138.  
  139. ip6tables -P INPUT   DROP
  140. ip6tables -P FORWARD DROP
  141. ip6tables -P OUTPUT  DROP
  142. #################################################################################################
  143. iptables -N LnD         # Define custom DROP chain
  144.  
  145. iptables -A LnD -p tcp -m limit --limit 1/s -j LOG --log-prefix "[TCP drop] " --log-level=info
  146. iptables -A LnD -p udp -m limit --limit 1/s -j LOG --log-prefix "[UDP drop] " --log-level=info
  147. iptables -A LnD -p icmp -m limit --limit 1/s -j LOG --log-prefix "[ICMP drop] " --log-level=info
  148. iptables -A LnD -f -m limit --limit 1/s -j LOG --log-prefix "[FRAG drop] " --log-level=info
  149. iptables -A LnD -j DROP
  150.  
  151. iptables -N LnR         # Define custom REJECT chain
  152.  
  153. iptables -A LnR -p tcp -m limit --limit 1/s -j LOG --log-prefix "[TCP reject] " --log-level=info
  154. iptables -A LnR -p udp -m limit --limit 1/s -j LOG --log-prefix "[UDP reject] " --log-level=info
  155. iptables -A LnR -p icmp -m limit --limit 1/s -j LOG --log-prefix "[ICMP reject] " --log-level=info
  156. iptables -A LnR -f -m limit --limit 1/s -j LOG --log-prefix "[FRAG reject] " --log-level=info
  157. iptables -A LnR -j REJECT
  158.  
  159. ip6tables -N LnD            # Define custom DROP chain
  160. ip6tables -A LnD -p tcp -m limit --limit 1/s -j LOG --log-prefix "[TCP drop] " --log-level=info
  161. ip6tables -A LnD -p udp -m limit --limit 1/s -j LOG --log-prefix "[UDP drop] " --log-level=info
  162. ip6tables -A LnD -p icmp -m limit --limit 1/s -j LOG --log-prefix "[ICMP drop] " --log-level=info
  163. ip6tables -A LnD -j DROP
  164.  
  165. ip6tables -N LnR            # Define custom REJECT chain
  166. ip6tables -A LnR -p tcp -m limit --limit 1/s -j LOG --log-prefix "[TCP reject] " --log-level=info
  167. ip6tables -A LnR -p udp -m limit --limit 1/s -j LOG --log-prefix "[UDP reject] " --log-level=info
  168. ip6tables -A LnR -p icmp -m limit --limit 1/s -j LOG --log-prefix "[ICMP reject] " --log-level=info
  169. ip6tables -A LnR -j REJECT
  170.  
  171. ####################################################################################
  172. #                   BASIC FIRST LINE SECURITY
  173. ####################################################################################
  174.  
  175. ################ DROP BAD FLAG COMBINATIONS #######################################
  176.  
  177. iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j LnD
  178. #Kill XMAS
  179. iptables -A INPUT -p tcp --tcp-flags ALL ALL -j LnD
  180. iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j LnD
  181. iptables -A INPUT -p tcp --tcp-flags ALL NONE -j LnD
  182. iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j LnD
  183. iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j LnD
  184.  
  185. iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j LnD
  186. iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j LnD
  187. iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j LnD
  188.  
  189. ip6tables -A INPUT -p tcp --tcp-flags ALL ALL -j LnD
  190. ip6tables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j LnD
  191. ip6tables -A INPUT -p tcp --tcp-flags ALL NONE -j LnD
  192. ip6tables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j LnD
  193. ip6tables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j LnD
  194.  
  195. ip6tables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j LnD
  196. ip6tables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j LnD
  197. ip6tables -A INPUT -p tcp --tcp-flags ACK,URG URG -j LnD
  198.  
  199. ##################### Kill SYN FLOOD  ############################################
  200. iptables -A INPUT -p tcp ! --syn -m state --state NEW -j LnD
  201. ip6tables -A INPUT -p tcp ! --syn -m state --state NEW -j LnD
  202.  
  203. # Prevent DoS attack
  204. #iptables -A INPUT -p tcp --dport 25 -m limit --limit 40/minute --limit-burst 80 -j ACCEPT
  205.  
  206. ################# DROP BROADCAST and DON'T LOG ########################################
  207. iptables -A INPUT  -i $int_if -d 255.255.255.255 -j DROP
  208. iptables -A INPUT  -i $int_if -d 192.168.255.255 -j DROP
  209. iptables -A INPUT  -i $int_if -d 192.168.0.255   -j DROP
  210. iptables -A INPUT  -i $int_if -d 153.122.255.255 -j DROP
  211. iptables -A INPUT  -i $int_if -d 153.122.1.255   -j DROP
  212. iptables -A INPUT  -i $int_if -d 172.2.255.255 -j DROP
  213. iptables -A INPUT  -i $int_if -d 172.2.1.255   -j DROP
  214. iptables -A INPUT  -i $int_if -d 10.0.0.0/8      -j DROP
  215. iptables -A INPUT  -i $int_if -d 169.254.0.0/16  -j DROP
  216.  
  217. ################# Drop Bad Guys #####################################################
  218. iptables -A INPUT -m recent --rcheck --seconds 60 -m limit --limit 10/second -j LOG --log-prefix "BG "
  219. iptables -A INPUT -m recent --update --seconds 60 -j DROP
  220. ip6tables -A INPUT -m recent --rcheck --seconds 60 -m limit --limit 10/second -j LOG --log-prefix "BG "
  221. ip6tables -A INPUT -m recent --update --seconds 60 -j DROP
  222.  
  223. # drop spoofed packets (i.e. packets with local source addresses coming from outside etc.)
  224. iptables -A INPUT    -i $int_if -s $int_ip1 -m recent --set -j LnD
  225. iptables -A FORWARD  -i $int_if -s $int_ip1 -m recent --set -j LnD
  226. #iptables -A INPUT    -i $int_if -s $int_ip2 -m recent --set -j LnD
  227. #iptables -A FORWARD  -i $int_if -s $int_ip2 -m recent --set -j LnD
  228.  
  229. ####################################################################################
  230. #                    IP FILTER WHITE LISTS
  231. ####################################################################################
  232. # smtp_whitelist.txt
  233. #echo SMTP WHITELIST LOADING
  234. #for whiteout in $(cat smtp_whitelist.txt);
  235. #do
  236. #(
  237. #iptables -A OUTPUT -p tcp -s $int_ip1 -d $whiteout -m multiport --dports 25,587 -j LOG --log-prefix "[SMTP WHITE OUT] " --log-level=info;
  238. #iptables -A OUTPUT -p tcp -s $int_ip1 -d $whiteout -m multiport --dports 25,587 -j ACCEPT;
  239. #iptables -A INPUT -p tcp -d $int_ip1 -s $whiteout -m multiport --dports 25,587 -j LOG --log-prefix "[SMTP WHITE IN] " --log-level=info;
  240. #iptables -A INPUT -p tcp -d $int_ip1 -s $whiteout -m multiport --dports 25,587 -j ACCEPT;
  241. #iptables -A FORWARD -p tcp -d $int_ip1 -s $whiteout -m multiport --dports 25,587 -j LOG --log-prefix "[SMTP WHITE FORWARD IN] "--log-level=info;
  242. #iptables -A FORWARD -p tcp -d $int_ip1 -s $whiteout -m multiport --dports 25,587 -j ACCEPT;
  243. #iptables -A FORWARD -p tcp -s $int_ip1 -d $whiteout -m multiport --dports 25,587 -j LOG --log-prefix "[SMTP WHITE FORWARD OUT] " --log-level=info;
  244. #iptables -A FORWARD -p tcp -s $int_ip1 -d $whiteout -m multiport --dports 25,587 -j ACCEPT;
  245. #)
  246. #echo $whiteout ;
  247. #done
  248. #echo SMTP WHITELIST LOADED
  249.  
  250. # http_whitelist.txt
  251. #echo HTTP/HTTPS WHITELIST LOADING
  252. #for whiteout in $(cat http_whitelist.txt);
  253. #do
  254. #(
  255. #iptables -A OUTPUT -p tcp -s $int_ip1 -d $whiteout -m multiport --dports 80,443 -j LOG --log-prefix "[HTTPS WHITE OUT] " --log-level=info;
  256. #iptables -A OUTPUT -p tcp -s $int_ip1 -d $whiteout -m multiport --dports 80,443 -j ACCEPT;
  257. #iptables -A INPUT -p tcp -d $int_ip1 -s $whiteout -m multiport --dports 80,443 -j LOG --log-prefix "[HTTPS WHITE IN] " --log-level=info;
  258. #iptables -A INPUT -p tcp -d $int_ip1 -s $whiteout -m multiport --dports 80,443 -j ACCEPT;
  259. #iptables -A FORWARD -p tcp -d $int_ip1 -s $whiteout -m multiport --dports 80,443 -j LOG --log-prefix "[HTTPS WHITE FORWARD IN] " --log-level=info;
  260. #iptables -A FORWARD -p tcp -d $int_ip1 -s $whiteout -m multiport --dports 80,443 -j ACCEPT;
  261. #iptables -A FORWARD -p tcp -s $int_ip1 -d $whiteout -m multiport --dports 80,443 -j LOG --log-prefix "[HTTPS WHITE FORWARD OUT] " --log-level=info;
  262. #iptables -A FORWARD -p tcp -s $int_ip1 -d $whiteout -m multiport --dports 80,443 -j ACCEPT;
  263. #)
  264. #echo $whiteout ;
  265. #done
  266. #echo HTTP/HTTPS WHITELIST LOADED
  267.  
  268. ####################################################################################
  269. #                    IP FILTER BLACK LISTS
  270. ####################################################################################
  271. ## Kill FACEBOOK GOOGLE AKAMI TECH AMAZON  HTTP
  272. echo HTTP/HTTPS BLACKLIST LOADING
  273. for blackout in $(cat http_blacklist.txt);
  274. do
  275. (iptables -A OUTPUT -p tcp -s $int_ip1 -d $blackout -m multiport --dports 80,443 -j LOG --log-prefix "[HTTP-SPAM OUT] " --log-level=info ;
  276. iptables -A OUTPUT -p tcp -s $int_ip1 -d $blackout -m multiport --dports 80,443 -j DROP;
  277. iptables -A INPUT -p tcp -d $int_ip1 -s $blackout -m multiport --dports 80,443 -j LOG --log-prefix "[HTTP-SPAM IN] " --log-level=info;
  278. iptables -A INPUT -p tcp -d $int_ip1 -s $blackout -m multiport --dports 80,443 -j DROP;
  279. iptables -A FORWARD -p tcp -d $int_ip1 -s $blackout -m multiport --dports 80,443 -j LOG --log-prefix "[HTTP-SPAM FORWARD IN] " --log-level=info ;
  280. iptables -A FORWARD -p tcp -d $int_ip1 -s $blackout -m multiport --dports 80,443 -j DROP;
  281. iptables -A FORWARD -p tcp -s $int_ip1 -d $blackout -m multiport --dports 80,443 -j LOG --log-prefix "[HTTP-SPAM FORWARD OUT] " --log-level=info;
  282. iptables -A FORWARD -p tcp -s $int_ip1 -d $blackout -m multiport --dports 80,443 -j DROP;
  283. )
  284. echo $blackout ;
  285. done
  286. echo HTTP BLACKLIST LOADED
  287.  
  288. #smtp_blacklist.txt
  289. echo SMTP BLACKLIST LOADING
  290. for blackout in $(cat smtp_blacklist.txt);
  291. do
  292. (
  293. iptables -A OUTPUT -p tcp -s $int_ip1 -d $blackout -m multiport --dports 25,587 -j LOG --log-prefix "[SMTP SPAM OUT] " --log-level=info;
  294. iptables -A OUTPUT -p tcp -s $int_ip1 -d $blackout -m multiport --dports 25,587 -j DROP;
  295. iptables -A INPUT -p tcp -d $int_ip1 -s $blackout -m multiport --dports 25,587 -j LOG --log-prefix "[SMTP SPAM IN] " --log-level=info;
  296. iptables -A INPUT -p tcp -d $int_ip1 -s $blackout -m multiport --dports 25,587 -j DROP;
  297. iptables -A FORWARD -p tcp -d $int_ip1 -s $blackout -m multiport --dports 25,587 -j LOG --log-prefix "[SMTP SPAM FORWARD IN] " --log-level=info;
  298. iptables -A FORWARD -p tcp -d $int_ip1 -s $blackout -m multiport --dports 25,587 -j DROP;
  299. iptables -A FORWARD -p tcp -s $int_ip1 -d $blackout -m multiport --dports 25,587 -j LOG --log-prefix "[SMTP SPAM FORWARD OUT] " --log-level=info;
  300. )
  301. echo $blackout ;
  302. done
  303. echo SMTP BLACKLIST LOADED
  304.  
  305. echo DNS BLACKLIST LOADING
  306. for blackout in $(cat dns_blacklist.txt);
  307. do
  308. (iptables -A OUTPUT -p udp -s $int_ip1 -d $blackout --dport 53 -j LOG --log-prefix "[DNS SPAM UDP OUT] " --log-level=info;
  309. iptables -A OUTPUT -p udp -s $int_ip1 -d $blackout --dport 53 -j DROP;
  310. iptables -A INPUT -p udp -d $int_ip1 -s $blackout --dport 53 -j LOG --log-prefix "[DNS SPAM UDP IN] " --log-level=info;
  311. iptables -A INPUT -p udp -d $int_ip1 -s $blackout --dport 53 -j DROP;
  312. iptables -A FORWARD -p udp -d $int_ip1 -s $blackout --dport 53 -j LOG --log-prefix "[DNS SPAM UDP FORWARD IN] " --log-level=info;
  313. iptables -A FORWARD -p udp -d $int_ip1 -s $blackout --dport 53 -j DROP;
  314. iptables -A FORWARD -p udp -s $int_ip1 -d $blackout --dport 53 -j LOG --log-prefix "[DNS SPAM UDP FORWARD OUT] " --log-level=info;
  315. iptables -A FORWARD -p udp -s $int_ip1 -d $blackout --dport 53 -j DROP;
  316.  
  317. iptables -A OUTPUT -p tcp -s $int_ip1 -d $blackout --dport 53 -j LOG --log-prefix "[DNS SPAM TCP OUT] " --log-level=info;
  318. iptables -A OUTPUT -p tcp -s $int_ip1 -d $blackout --dport 53 -j DROP;
  319. iptables -A INPUT -p tcp -d $int_ip1 -s $blackout --dport 53 -j LOG --log-prefix "[DNS SPAM TCP IN] " --log-level=info;
  320. iptables -A INPUT -p tcp -d $int_ip1 -s $blackout --dport 53 -j DROP;
  321. iptables -A FORWARD -p tcp -d $int_ip1 -s $blackout --dport 53 -j LOG --log-prefix "[DNS SPAM TCP FORWARD IN] " --log-level=info;
  322. iptables -A FORWARD -p tcp -d $int_ip1 -s $blackout --dport 53 -j DROP;
  323. iptables -A FORWARD -p tcp -s $int_ip1 -d $blackout --dport 53 -j LOG --log-prefix "[DNS SPAM TCP FORWARD OUT] " --log-level=info;
  324. iptables -A FORWARD -p tcp -s $int_ip1 -d $blackout --dport 53 -j DROP;
  325.  
  326. )
  327. echo $blackout ;
  328. done
  329. echo DNS BLACKLIST LOADED
  330.  
  331. #blacklist.txt
  332. # Kill HACKERS
  333. echo ATTACKER BLACKLIST LOADING
  334. for blackout in $(cat attackers.txt);
  335. do
  336. (iptables -A OUTPUT -p all -s $int_ip1 -d $blackout -j LOG --log-prefix "[ATTACKER OUT] " --log-level=info ;
  337. iptables -A OUTPUT -p all -s $int_ip1 -d $blackout -j DROP;
  338. iptables -A INPUT -p all -d $int_ip1 -s $blackout -j LOG --log-prefix "[ATTACKER IN] " --log-level=info ;
  339. iptables -A INPUT -p all -d $int_ip1 -s $blackout -j DROP;
  340. iptables -A FORWARD -p all -d $int_ip1 -s $blackout -j LOG --log-prefix "[ATTACKER FORWARD IN] " --log-level=info ;
  341. iptables -A FORWARD -p all -d $int_ip1 -s $blackout -j DROP;
  342. iptables -A FORWARD -p all -s $int_ip1 -d $blackout -j LOG --log-prefix "[ATTACKER FORWARD OUT] " --log-level=info  ;
  343. iptables -A FORWARD -p all -s $int_ip1 -d $blackout -j DROP;
  344. )
  345. echo $blackout ;
  346. done
  347. echo ATTACKER BLACKLIST LOADED
  348.  
  349. echo LOADING BLACKLIST
  350. for blackout in $(cat blacklist.txt);
  351. do
  352. (
  353. iptables -A OUTPUT -p all -s $int_ip1 -d $blackout -j LOG --log-prefix "[BLACKLIST OUT] " --log-level=info ;
  354. iptables -A OUTPUT -p all -s $int_ip1 -d $blackout -j DROP;
  355. iptables -A INPUT -p all -d $int_ip1 -s $blackout -j LOG --log-prefix "[BLACKLIST IN] " --log-level=info ;
  356. iptables -A INPUT -p all -d $int_ip1 -s $blackout -j DROP;
  357. iptables -A FORWARD -p all -d $int_ip1 -s $blackout -j LOG --log-prefix "[BLACKLIST FORWARD IN] " --log-level=info ;
  358. iptables -A FORWARD -p all -d $int_ip1 -s $blackout -j DROP;
  359. iptables -A FORWARD -p all -s $int_ip1 -d $blackout -j LOG --log-prefix "[BLACKLIST FORWARD OUT] " --log-level=info  ;
  360. iptables -A FORWARD -p all -s $int_ip1 -d $blackout -j DROP;
  361. )
  362. echo $blackout ;
  363. done
  364. echo BLACKLIST LOADED
  365.  
  366. echo EMAIL BLACKLIST LOADING
  367. for blackout in $(cat email_blacklist.txt);
  368. do
  369. (
  370. iptables -A INPUT -p tcp --dport 25 -m string --string "$blackout" --algo bm -j LOG --log-prefix "[EMAIL SPAM] " --log-level=info;
  371. iptables -A INPUT -p tcp --dport 25 -m string --string "$blackout" --algo bm -j DROP
  372. iptables -A OUTPUT -p tcp --dport 25 -m string --string "$blackout" --algo bm -j LOG --log-prefix "[EMAIL SPAM] " --log-level=info;
  373. iptables -A OUTPUT -p tcp --dport 25 -m string --string "$blackout" --algo bm -j DROP
  374. iptables -A FORWARD -p tcp --dport 25 -m string --string "$blackout" --algo bm -j LOG --log-prefix "[EMAIL SPAM] " --log-level=info;
  375. iptables -A FORWARD -p tcp --dport 25 -m string --string "$blackout" --algo bm -j DROP
  376. )
  377. echo $blackout ;
  378. done
  379. echo EMAIL BLACKLIST LOADED
  380.  
  381. echo HTML BLACKLIST LOADING
  382. for blackout in $(cat html_blacklist.txt);
  383. do
  384. (
  385. iptables -A INPUT -p tcp -m multiport --dports 80,443 -m string --string "$blackout" --algo bm -j LOG --log-prefix "[HTTP SPAM] " --log-level=info;
  386. iptables -A INPUT -p tcp -m multiport --dports 80,443 -m string --string "$blackout" --algo bm -j DROP
  387. iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m string --string "$blackout" --algo bm -j LOG --log-prefix "[HTTP SPAM] " --log-level=info;
  388. iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m string --string "$blackout" --algo bm -j DROP
  389. iptables -A FORWARD -p tcp -m multiport --dports 80,443 -m string --string "$blackout" --algo bm -j LOG --log-prefix "[HTTP SPAM] " --log-level=info;
  390. iptables -A FORWARD -p tcp -m multiport --dports 80,443 -m string --string "$blackout" --algo bm -j DROP
  391. )
  392. echo $blackout ;
  393. done
  394. echo HTML BLACKLIST LOADED
  395.  
  396. #####################################################################################################
  397. #       LOCAL HOST RULES  127.0.0.1 = lo   NEVER accept everything from loopback
  398. #####################################################################################################
  399.  
  400. #####################################   BOOTP    #############################################
  401. iptables -A INPUT  -i lo  -p udp -m multiport --dports 67,68 -j ACCEPT
  402. iptables -A INPUT  -i lo  -p udp -m multiport --sports 67,68 -j ACCEPT
  403. iptables -A OUTPUT  -o lo  -p udp -m multiport --dports 67,68 -j ACCEPT
  404. iptables -A OUTPUT  -o lo  -p udp -m multiport --sports 67,68 -j ACCEPT
  405.  
  406. ##################################  DNS   #################################################
  407. iptables -A INPUT  -i lo  -p udp -m multiport --dports 53,953 -j ACCEPT
  408. iptables -A INPUT  -i lo  -p udp -m multiport --sports 53,953 -j ACCEPT
  409. iptables -A OUTPUT  -o lo  -p udp -m multiport --dports 53,953 -j ACCEPT
  410. iptables -A OUTPUT  -o lo  -p udp -m multiport --sports 53,953 -j ACCEPT
  411.  
  412. ip6tables -A INPUT  -i lo -p udp -m multiport --sports 53,953 -j ACCEPT
  413. ip6tables -A INPUT -i lo  -p udp -m multiport --dports 53,953 -j ACCEPT
  414. ip6tables -A OUTPUT  -o lo -p udp -m multiport --sports 53,953 -j ACCEPT
  415. ip6tables -A OUTPUT -o lo  -p udp -m multiport --dports 53,953 -j ACCEPT
  416.  
  417. ########################### TELNET SSH  ###########################################################
  418. iptables -A INPUT  -i lo  -p tcp -m multiport --dports 22,23 -j ACCEPT
  419. iptables -A INPUT  -i lo  -p tcp -m multiport --sports 22,23 -j ACCEPT
  420. iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 22,23 -j ACCEPT
  421. iptables -A OUTPUT -o lo  -p tcp -m multiport --sports 22,23 -j ACCEPT
  422. ########################### SMTP ###################################################################
  423. iptables -A INPUT  -i lo  -p tcp -m multiport --dports 25,587,465 -m limit --limit 10/second --limit-burst 12 -j ACCEPT
  424. iptables -A INPUT  -i lo  -p tcp -m multiport --sports 25,587,465 -m limit --limit 10/second --limit-burst 12 -j ACCEPT
  425. iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 25,587,465 -m limit --limit 10/second  --limit-burst 12 -j ACCEPT
  426. iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 25,587,465 -m limit --limit 10/second --limit-burst 12 -j ACCEPT
  427.  
  428. ip6tables -A INPUT -i lo  -p tcp -m multiport --dports 25,587,465 -m limit --limit 10/second  --limit-burst 12 -j ACCEPT
  429. ip6tables -A INPUT  -i lo  -p tcp -m multiport --sports 25,587,465 -m limit --limit 10/second  --limit-burst 12 -j ACCEPT
  430. ip6tables -A OUTPUT -o lo  -p tcp -m multiport --dports 25,587,465 -m limit --limit 10/second  --limit-burst 12 -j ACCEPT
  431. ip6tables -A OUTPUT  -o lo  -p tcp -m multiport --sports 25,587,465 -m limit --limit 10/second  --limit-burst 12 -j ACCEPT
  432. ############################ FTP ########################################################################################
  433. iptables -A INPUT  -i lo  -p tcp -m multiport --dports 20,21,989,990 -j ACCEPT
  434. iptables -A INPUT  -i lo  -p tcp -m multiport --sports 20,21,989,990 -j ACCEPT
  435. iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 20,21,989,990 -j ACCEPT
  436. iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 20,21,989,990 -j ACCEPT
  437.  
  438. iptables -A INPUT  -i lo  -p udp -m multiport --dports 20,21,989,990 -j ACCEPT
  439. iptables -A INPUT  -i lo  -p udp -m multiport --sports 20,21,989,990 -j ACCEPT
  440. iptables -A OUTPUT  -o lo  -p udp -m multiport --dports 20,21,989,990 -j ACCEPT
  441. iptables -A OUTPUT  -o lo  -p udp -m multiport --sports 20,21,989,990 -j ACCEPT
  442.  
  443. ########################### HTTP,HTTPS,DNS ############################################################################
  444. iptables -A INPUT -i lo  -p tcp -m multiport --dports 53,80,443  -j ACCEPT
  445. iptables -A INPUT -i lo  -p tcp -m multiport --sports 53,80,443  -j ACCEPT
  446. iptables -A OUTPUT -o lo  -p tcp -m multiport --dports 53,80,443 -j ACCEPT
  447. iptables -A OUTPUT -o lo  -p tcp -m multiport --sports 53,80,443 -j ACCEPT
  448.  
  449. ip6tables -A INPUT -i lo  -p tcp -m multiport --dports 53,80,443  -j ACCEPT
  450. ip6tables -A INPUT -i lo  -p tcp -m multiport --sports 53,80,443  -j ACCEPT
  451. ip6tables -A OUTPUT -o lo  -p tcp -m multiport --dports 53,80,443  -j ACCEPT
  452. ip6tables -A OUTPUT -o lo  -p tcp -m multiport --sports 53,80,443  -j ACCEPT
  453. ############################ IMAP IMAPS POP3 POP3S #############################################################
  454. iptables -A INPUT  -i lo  -p tcp -m multiport --dports 110,143,443,514 -j ACCEPT
  455. iptables -A INPUT  -i lo  -p tcp -m multiport --sports 110,143,443,514 -j  ACCEPT
  456. iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 110,143,443,514 -j ACCEPT
  457. iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 110,143,443,514 -j  ACCEPT
  458.  
  459. iptables -A INPUT  -i lo  -p tcp -m multiport --dports 783,953,993,995 -j ACCEPT
  460. iptables -A INPUT  -i lo  -p tcp -m multiport --sports 783,953,993,995 -j ACCEPT
  461. iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 783,953,993,995 -j ACCEPT
  462. iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 783,953,993,995 -j ACCEPT
  463. ####################################     IRC         #####################################################
  464. iptables -A INPUT  -i lo  -p tcp -m multiport --dports 6667,6668,6669,6697,9999 -j ACCEPT
  465. iptables -A INPUT  -i lo  -p tcp -m multiport --sports 6667,6668,6669,6697,9999 -j ACCEPT
  466. iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 6667,6668,6669,6697,9999 -j ACCEPT
  467. iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 6667,6668,6669,6697,9999 -j ACCEPT
  468.  
  469. #################################### XMPP MSN ICQ AOL #####################################################
  470. iptables -A INPUT  -i lo  -p tcp -m multiport --dports 1863,5190,5222,5223,5269,5280,5281,5298,5582,8010 -j ACCEPT
  471. iptables -A INPUT  -i lo  -p tcp -m multiport --sports 1863,5190,5222,5223,5269,5280,5281,5298,5582,8010 -j ACCEPT
  472. iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 1863,5190,5222,5223,5269,5280,5281,5298,5582,8010 -j ACCEPT
  473. iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 1863,5190,5222,5223,5269,5280,5281,5298,5582,8010 -j ACCEPT
  474.  
  475. iptables -A INPUT  -i lo  -p udp -m multiport --dports 5298 -j ACCEPT
  476. iptables -A INPUT  -i lo  -p udp -m multiport --sports 5298 -j ACCEPT
  477. iptables -A OUTPUT  -o lo  -p udp -m multiport --dports 5298 -j ACCEPT
  478. iptables -A OUTPUT  -o lo  -p udp -m multiport --sports 5298 -j ACCEPT
  479.  
  480. ############################### NNTP #####################################################
  481. iptables -A INPUT  -i lo  -p udp -m multiport --dports 119,563 -j ACCEPT
  482. iptables -A INPUT  -i lo  -p udp -m multiport --sports 119,563 -j ACCEPT
  483. iptables -A OUTPUT  -o lo  -p udp -m multiport --dports 119,563 -j ACCEPT
  484. iptables -A OUTPUT  -o lo  -p udp -m multiport --sports 119,563 -j ACCEPT
  485.  
  486. iptables -A INPUT  -i lo  -p tcp -m multiport --dports 119,563 -j ACCEPT
  487. iptables -A INPUT  -i lo  -p tcp -m multiport --sports 119,563 -j ACCEPT
  488. iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 119,563 -j ACCEPT
  489. iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 119,563 -j ACCEPT
  490.  
  491. ###################################  HKP PGP ##########################################################
  492. iptables -A INPUT  -i lo  -p tcp -m multiport --dports 11371 -j ACCEPT
  493. iptables -A INPUT  -i lo  -p tcp -m multiport --sports 11371 -j ACCEPT
  494. iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 11371 -j ACCEPT
  495. iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 11371 -j ACCEPT
  496.  
  497. ####################################  TOR #############################################################
  498. iptables -A INPUT  -i lo  -p tcp -m multiport --dports 9040,9050,9051,9150,9151,9001 -j ACCEPT
  499. iptables -A INPUT  -i lo  -p tcp -m multiport --sports 9040,9050,9051,9150,9151,9001 -j ACCEPT
  500. iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 9040,9050,9051,9150,9151,9001 -j ACCEPT
  501. iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 9040,9050,9051,9150,9151,9001 -j ACCEPT
  502.  
  503. ###################################  LDAP  ############################################################
  504. iptables -A INPUT  -i lo  -p tcp -m multiport --dports 389 -j ACCEPT
  505. iptables -A INPUT  -i lo  -p tcp -m multiport --sports 389 -j ACCEPT
  506. iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 389 -j ACCEPT
  507. iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 389 -j ACCEPT
  508.  
  509. iptables -A INPUT  -i lo  -p udp -m multiport --dports 389 -j ACCEPT
  510. iptables -A INPUT  -i lo  -p udp -m multiport --sports 389 -j ACCEPT
  511. iptables -A OUTPUT  -o lo  -p udp -m multiport --dports 389 -j ACCEPT
  512. iptables -A OUTPUT  -o lo  -p udp -m multiport --sports 389 -j ACCEPT
  513.  
  514. ###################################### BIT TORRENT #####################################################
  515. #iptables -A INPUT  -i lo  -p tcp -m multiport --dports 6880,6881,6882,6883,6884,6885,6969 -j ACCEPT
  516. #iptables -A INPUT  -i lo  -p tcp -m multiport --dports 6886,6887,6888,6889,6890 -j ACCEPT
  517. #iptables -A INPUT  -i lo  -p tcp -m multiport --sports 6880,6881,6882,6883,6884,6885,6969 -j ACCEPT
  518. #iptables -A INPUT  -i lo  -p tcp -m multiport --sports 6886,6887,6888,6889,6890 -j ACCEPT
  519. #iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 6880,6881,6882,6883,6884,6885,6969 -j ACCEPT
  520. #iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 6886,6887,6888,6889,6890 -j ACCEPT
  521. #iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 6880,6881,6882,6883,6884,6885,6969 -j ACCEPT
  522. #iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 6886,6887,6888,6889,6890 -j ACCEPT
  523.  
  524. #iptables -A INPUT  -i lo  -p udp -m multiport --dports 6880,6881,6882,6883,6884,6885,6969 -j ACCEPT
  525. #iptables -A INPUT  -i lo  -p udp -m multiport --dports 6886,6887,6888,6889,6890 -j ACCEPT
  526. #iptables -A INPUT  -i lo  -p udp -m multiport --sports 6880,6881,6882,6883,6884,6885,6969 -j ACCEPT
  527. #iptables -A INPUT  -i lo  -p udp -m multiport --sports 6886,6887,6888,6889,6890 -j ACCEPT
  528. #iptables -A OUTPUT  -o lo  -p udp -m multiport --dports 6880,6881,6882,6883,6884,6885,6969 -j ACCEPT
  529. #iptables -A OUTPUT  -o lo  -p udp -m multiport --dports 6886,6887,6888,6889,6890 -j ACCEPT
  530. #iptables -A OUTPUT  -o lo  -p udp -m multiport --sports 6880,6881,6882,6883,6884,6885,6969 -j ACCEPT
  531. #iptables -A OUTPUT  -o lo  -p udp -m multiport --sports 6886,6887,6888,6889,6890 -j ACCEPT
  532.  
  533. #iptables -A INPUT  -i lo  -p tcp -m multiport --dports 58846,2710 -j ACCEPT
  534. #iptables -A INPUT  -i lo  -p tcp -m multiport --sports 58846,2710 -j ACCEPT
  535. #iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 58846,2710 -j ACCEPT
  536. #iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 58846,2710 -j ACCEPT
  537.  
  538. #iptables -A INPUT  -i lo  -p udp -m multiport --dports 4444,6969,1337,2710,80 -j ACCEPT
  539. #iptables -A INPUT  -i lo  -p udp -m multiport --sports 4444,6969,1337,2710,80 -j ACCEPT
  540. #iptables -A OUTPUT  -o lo  -p udp -m multiport --dports 4444,6969,1337,2710,80 -j ACCEPT
  541. #iptables -A OUTPUT  -o lo  -p udp -m multiport --sports 4444,6969,1337,2710,80 -j ACCEPT
  542.  
  543. #iptables -A INPUT  -i lo  -p udp -m multiport --dports 4444,80 -j ACCEPT
  544. #iptables -A INPUT  -i lo  -p udp -m multiport --sports 4444,80 -j ACCEPT
  545. #iptables -A OUTPUT  -o lo  -p udp -m multiport --dports 4444,80 -j ACCEPT
  546. #iptables -A OUTPUT  -o lo  -p udp -m multiport --sports 4444,80 -j ACCEPT
  547.  
  548. #################################### SQUID HTTP ALTERNATE ###########################################
  549. iptables -A INPUT  -i lo  -p tcp -m multiport --dports 3128,8000,8080,8082,8445,8123,8443 -j ACCEPT
  550. iptables -A INPUT  -i lo  -p tcp -m multiport --sports 3128,8000,8080,8082,8445,8123,8443 -j ACCEPT
  551. iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 3128,8000,8080,8082,8445,8123,8443 -j ACCEPT
  552. iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 3128,8000,8080,8082,8445,8123,8443 -j ACCEPT
  553. #################################### SOCKS 4/5  #########################################################
  554. iptables -A INPUT  -i lo  -p tcp -m multiport --dports 1080,1085 -j ACCEPT
  555. iptables -A INPUT  -i lo  -p tcp -m multiport --sports 1080,1085 -j ACCEPT
  556. iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 1080,1085 -j ACCEPT
  557. iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 1080,1085 -j ACCEPT
  558. ################################## NETBIOS  #########################################################
  559. #iptables -A INPUT  -i lo  -p tcp -m multiport --dports 135,137,138,139 -j ACCEPT
  560. #iptables -A INPUT  -i lo  -p tcp -m multiport --sports 135,137,138,139 -j ACCEPT
  561. #iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 135,137,138,139 -j ACCEPT
  562. #iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 135,137,138,139 -j ACCEPT
  563.  
  564. #iptables -A INPUT  -i lo  -p udp -m multiport --dports 135,137,138,139 -j ACCEPT
  565. #iptables -A INPUT  -i lo  -p udp -m multiport --sports 135,137,138,139 -j ACCEPT
  566. #iptables -A OUTPUT  -o lo  -p udp -m multiport --dports 135,137,138,139 -j ACCEPT
  567. #iptables -A OUTPUT  -o lo  -p udp -m multiport --sports 135,137,138,139 -j ACCEPT
  568.  
  569. ################################### SMB SAMBA #######################################################
  570. #iptables -A INPUT  -i lo  -p tcp -m multiport --dports 445 -j ACCEPT
  571. #iptables -A INPUT  -i lo  -p tcp -m multiport --sports 445 -j ACCEPT
  572. #iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 445 -j ACCEPT
  573. #iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 445 -j ACCEPT
  574. ##############################  PULSE AUDIO SERVER
  575. #iptables -A INPUT  -i lo  -p tcp -m multiport --dports 4713 -j ACCEPT
  576. #iptables -A INPUT  -i lo  -p tcp -m multiport --sports 4713 -j ACCEPT
  577. #iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 4713 -j ACCEPT
  578. #iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 4713 -j ACCEPT
  579. ###############################  CUPS ################################################################
  580. iptables -A INPUT  -i lo  -p tcp -m multiport --dports 631 -j ACCEPT
  581. iptables -A INPUT  -i lo  -p tcp -m multiport --sports 631 -j ACCEPT
  582. iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 631 -j ACCEPT
  583. iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 631 -j ACCEPT
  584.  
  585. iptables -A INPUT  -i lo  -p udp -m multiport --dports 631 -j ACCEPT
  586. iptables -A INPUT  -i lo  -p udp -m multiport --sports 631 -j ACCEPT
  587. iptables -A OUTPUT  -o lo  -p udp -m multiport --dports 631 -j ACCEPT
  588. iptables -A OUTPUT  -o lo  -p udp -m multiport --sports 631 -j ACCEPT
  589. ################################### GIT HUB ##########################################################
  590. iptables -A INPUT  -i lo  -p tcp -m multiport --dports 9418 -j ACCEPT
  591. iptables -A INPUT  -i lo  -p tcp -m multiport --sports 9418 -j ACCEPT
  592. iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 9418 -j ACCEPT
  593. iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 9418 -j ACCEPT
  594. ######################## ICMP ########################################################################
  595. iptables -A INPUT  -i lo  -p icmp --icmp-type ping -m limit --limit 1/second -j ACCEPT
  596. iptables -A OUTPUT  -o lo  -p icmp --icmp-type ping -m limit --limit 2/second -j ACCEPT
  597.  
  598. iptables -A INPUT  -i lo  -p icmp --icmp-type 0 -m limit --limit 1/second -j ACCEPT
  599. iptables -A OUTPUT  -o lo  -p icmp --icmp-type 0 -m limit --limit 2/second -j ACCEPT
  600. iptables -A INPUT  -i lo  -p icmp --icmp-type 3 -m limit --limit 1/second -j ACCEPT
  601. iptables -A OUTPUT  -o lo  -p icmp --icmp-type 3 -m limit --limit 2/second -j ACCEPT
  602. iptables -A INPUT  -i lo  -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT
  603. iptables -A OUTPUT  -o lo  -p icmp --icmp-type 8 -m limit --limit 2/second -j ACCEPT
  604. iptables -A INPUT  -i lo  -p icmp --icmp-type 11 -m limit --limit 1/second -j ACCEPT
  605. iptables -A OUTPUT  -o lo  -p icmp --icmp-type 11 -m limit --limit 2/second -j ACCEPT
  606.  
  607. ip6tables -A INPUT  -i lo  -p icmp -m limit --limit 1/second -j ACCEPT
  608. ip6tables -A OUTPUT  -o lo  -p icmp -m limit --limit 2/second -j ACCEPT
  609.  
  610. ############################## SYSLOG ###############################################
  611. iptables -A INPUT  -i lo  -p udp -m multiport --dports 514 -j ACCEPT
  612. iptables -A INPUT  -i lo  -p udp -m multiport --sports 514 -j ACCEPT
  613. iptables -A OUTPUT  -o lo  -p udp -m multiport --dports 514 -j ACCEPT
  614. iptables -A OUTPUT  -o lo  -p udp -m multiport --sports 514 -j ACCEPT
  615.  
  616. ############################### NTP #####################################################
  617. iptables -A INPUT  -i lo  -p udp -m multiport --dports 123 -j ACCEPT
  618. iptables -A INPUT  -i lo  -p udp -m multiport --sports 123 -j ACCEPT
  619. iptables -A OUTPUT  -o lo  -p udp -m multiport --dports 123 -j ACCEPT
  620. iptables -A OUTPUT  -o lo  -p udp -m multiport --sports 123 -j ACCEPT
  621.  
  622. iptables -A INPUT  -i lo  -p tcp -m multiport --dports 123 -j ACCEPT
  623. iptables -A INPUT  -i lo  -p tcp -m multiport --sports 123 -j ACCEPT
  624. iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 123 -j ACCEPT
  625. iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 123 -j ACCEPT
  626.  
  627. ################################ RCP   #################################################
  628. #iptables -A INPUT  -i lo  -p tcp -m multiport --dports 111 -j ACCEPT
  629. #iptables -A INPUT  -i lo  -p tcp -m multiport --sports 111 -j ACCEPT
  630. #iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 111 -j ACCEPT
  631. #iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 111 -j ACCEPT
  632.  
  633. #iptables -A INPUT  -i lo  -p udp -m multiport --dports 111 -j ACCEPT
  634. #iptables -A INPUT  -i lo  -p udp -m multiport --sports 111 -j ACCEPT
  635. #iptables -A OUTPUT  -o lo  -p udp -m multiport --dports 111 -j ACCEPT
  636. #iptables -A OUTPUT  -o lo  -p udp -m multiport --sports 111 -j ACCEPT
  637.  
  638. ################################ RSYNC   #################################################
  639. iptables -A INPUT  -i lo  -p tcp -m multiport --dports 873 -j ACCEPT
  640. iptables -A INPUT  -i lo  -p tcp -m multiport --sports 873 -j ACCEPT
  641. iptables -A OUTPUT  -o lo  -p tcp -m multiport --dports 873 -j ACCEPT
  642. iptables -A OUTPUT  -o lo  -p tcp -m multiport --sports 873 -j ACCEPT
  643.  
  644. ###########################################################################################
  645.  
  646. ################################################################################################
  647. #                         Router and Internal Network Rules
  648. ###################################################################################################
  649. #
  650. #                    REMOVED /ADD YOUR OWN according to your needs  sshd etc
  651. #
  652. #
  653. ##############################################################################################################################
  654. #                             Application and Port Specific Rules for INTERNET
  655. ##############################################################################################################################
  656. #                                              PUBLIC OUTPUT
  657. #############################################################################################################################################
  658.  
  659. ##################################################   HTTP HTTPS Client    ###############################################################################  
  660. iptables -A OUTPUT  -o $int_if -s $int_ip1 -p tcp -m multiport --dports 80,443,8000,8080,8443,8082,8445,3128 -m state --state NEW,ESTABLISHED -j ACCEPT
  661. iptables -A INPUT   -i $int_if -d $int_ip1 -p tcp -m multiport --sports 80,443,8000,8080,8443,8082,8445,3128 -m state --state ESTABLISHED -j ACCEPT
  662. iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 80,443,8000,8080,8443,8082,8445,3128 -m state --state NEW,ESTABLISHED -j ACCEPT
  663. iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --dports 80,443,8000,8080,8443,8082,8445,3128 -m state --state ESTABLISHED -j ACCEPT
  664.  
  665. ip6tables -A OUTPUT  -o $int_if -p tcp -m multiport --dports 80,443,8000,8080,8443,8082,8445,3128 -m state --state NEW,ESTABLISHED -j ACCEPT
  666. ip6tables -A INPUT   -i $int_if -p tcp -m multiport --sports 80,443,8000,8080,8443,8082,8445,3128 -m state --state ESTABLISHED -j ACCEPT
  667. ip6tables -A OUTPUT -o $int_if -p tcp -m multiport --sports 80,443,8000,8080,8443,8082,8445,3128 -m state --state NEW,ESTABLISHED -j ACCEPT
  668. ip6tables -A INPUT  -i $int_if -p tcp -m multiport --dports 80,443,8000,8080,8443,8082,8445,3128 -m state --state ESTABLISHED -j ACCEPT
  669. ##################################################      HKP OPEN PGP SERVER CLIENT       ###############################################################################
  670. iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 11371 -m state --state NEW,ESTABLISHED -j ACCEPT
  671. iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --sports 11371 -m state --state ESTABLISHED -j ACCEPT
  672. ##################################################      RSYNC CLIENT  #######################################################################
  673. iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 873 -m state --state NEW,ESTABLISHED -j ACCEPT
  674. iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --sports 873 -m state --state ESTABLISHED -j ACCEPT
  675. ##################################################      HTTPS PROXY       ###############################################################################
  676. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 8081,8000,8090,9090 -m state --state NEW,ESTABLISHED -j ACCEPT
  677. #iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --sports 8081,8000,8090,9090 -m state --state ESTABLISHED,RELATED -j ACCEPT
  678. #################################################  SQUID HTTPS PROXY  ################################################################################
  679. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 3128 -m state  --state NEW,ESTABLISHED -j ACCEPT
  680. #iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --sports 3128 -m state --state ESTABLISHED -j ACCEPT
  681. ##########################################        SOCK4,SOCK5 Client    ##################################################################################
  682. iptables -A OUTPUT  -o $int_if -s $int_ip1 -p tcp -m multiport --dports 1080,1085 -m state  --state NEW,ESTABLISHED -j ACCEPT
  683. iptables -A INPUT   -i $int_if -d $int_ip1 -p tcp -m multiport --sports 1080,1085 -m state --state ESTABLISHED -j ACCEPT
  684. ##########################################         IRC Client           ###################################################################################
  685. iptables -A OUTPUT  -o $int_if -s $int_ip1 -p tcp -m multiport --dports 6667,6668,6669,6697,9999 -m state  --state NEW,ESTABLISHED -j ACCEPT
  686. iptables -A INPUT   -i $int_if -d $int_ip1 -p tcp -m multiport --sports 6667,6668,6669,6697,9999 -m state --state ESTABLISHED -j ACCEPT
  687. ##########################################        XMPP Client           ###################################################################################
  688. iptables -A OUTPUT  -o $int_if -s $int_ip1 -p tcp -m multiport --dports 5190,5222,5223,5269,5280,5281,5298,8010 -m state  --state NEW,ESTABLISHED -j ACCEPT
  689. iptables -A INPUT   -i $int_if -d $int_ip1 -p tcp -m multiport --sports 5190,5222,5223,5269,5280,5281,5298,8010 -m state --state ESTABLISHED -j ACCEPT
  690.  
  691. iptables -A OUTPUT  -o $int_if -s $int_ip1 -p udp -m multiport --dports 5298 -m state  --state NEW,ESTABLISHED -j ACCEPT
  692. iptables -A INPUT   -i $int_if -d $int_ip1 -p udp -m multiport --sports 5298 -m state --state ESTABLISHED -j ACCEPT
  693. ##########################################       MSN Client           ###################################################################################
  694. #iptables -A OUTPUT  -o $int_if -s $int_ip1 -p tcp -m multiport --dports 1863 -m state  --state NEW,ESTABLISHED -j ACCEPT
  695. #iptables -A INPUT   -i $int_if -d $int_ip1 -p tcp -m multiport --sports 1863 -m state --state ESTABLISHED -j ACCEPT
  696.  
  697. ##########################################         FTP Client           ###################################################################################
  698. iptables -A OUTPUT  -o $int_if -s $int_ip1 -p tcp -m multiport --dports 20,21,989,990 -m state  --state NEW,ESTABLISHED -j ACCEPT
  699. iptables -A INPUT   -i $int_if -d $int_ip1 -p tcp -m multiport --sports 20,21,989,990 -m state --state ESTABLISHED -j ACCEPT
  700. iptables -A OUTPUT  -o $int_if -s $int_ip1 -p udp -m multiport --dports 20,21,989,990 -m state  --state NEW,ESTABLISHED -j ACCEPT
  701. iptables -A INPUT   -i $int_if -d $int_ip1 -p udp -m multiport --sports 20,21,989,990 -m state --state ESTABLISHED -j ACCEPT
  702. ##########################################         NNTP Client           ###################################################################################
  703. iptables -A OUTPUT  -o $int_if -s $int_ip1 -p tcp -m multiport --dports 119,563 -m state  --state NEW,ESTABLISHED -j ACCEPT
  704. iptables -A INPUT   -i $int_if -d $int_ip1 -p tcp -m multiport --sports 119,563 -m state --state ESTABLISHED -j ACCEPT
  705. iptables -A OUTPUT  -o $int_if -s $int_ip1 -p udp -m multiport --dports 119,563 -m state  --state NEW,ESTABLISHED -j ACCEPT
  706. iptables -A INPUT   -i $int_if -d $int_ip1 -p udp -m multiport --sports 119,563 -m state --state ESTABLISHED -j ACCEPT
  707. ##########################################        TELNET  Client        ####################################################################################
  708. iptables -A OUTPUT  -o $int_if -s $int_ip1 -p tcp -m multiport --dports 23 -m state --state NEW,ESTABLISHED -j ACCEPT
  709. iptables -A INPUT   -i $int_if -d $int_ip1 -p tcp -m multiport --sports 23 -m state --state ESTABLISHED -j ACCEPT
  710. ###########################################        SSH  Client          ##################################################################################
  711. iptables -A OUTPUT  -o $int_if -s $int_ip1 -p tcp -m multiport --dports 22 -m state --state NEW,ESTABLISHED -j ACCEPT
  712. iptables -A INPUT   -i $int_if -d $int_ip1 -p tcp -m multiport --sports 22 -m state --state ESTABLISHED -j ACCEPT
  713. iptables -A OUTPUT  -o $int_if -s $int_ip1 -p tcp -m multiport --sports 22 -m state --state NEW,ESTABLISHED -j ACCEPT
  714. iptables -A INPUT   -i $int_if -d $int_ip1 -p tcp -m multiport --dports 22 -m state --state ESTABLISHED -j ACCEPT
  715. #############################################       SMTP  Client        #####################################################################################
  716. iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 25,465,587,2525  -m limit --limit 5/second --limit-burst 10 -m state --state NEW,ESTABLISHED -j ACCEPT
  717. iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --sports 25,465,587,2525 -m state --state ESTABLISHED -j ACCEPT
  718. iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 25,465,587,2525  -m limit --limit 5/second --limit-burst 10 -m state --state NEW,ESTABLISHED -j ACCEPT
  719. iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --dports 25,465,587,2525 -m state --state ESTABLISHED -j ACCEPT
  720.  
  721. ip6tables -A OUTPUT -o $int_if -p tcp -m multiport --dports 25,465,587,2525  -m limit --limit 5/second --limit-burst 10 -m state --state NEW,ESTABLISHED -j ACCEPT
  722. ip6tables -A INPUT  -i $int_if -p tcp -m multiport --sports 25,465,587,2525 -m state --state ESTABLISHED -j ACCEPT
  723. ip6tables -A OUTPUT -o $int_if -p tcp -m multiport --sports 25,465,587,2525  -m limit --limit 5/second --limit-burst 10 -m state --state NEW,ESTABLISHED -j ACCEPT
  724. ip6tables -A INPUT  -i $int_if -p tcp -m multiport --dports 25,465,587,2525 -m state --state ESTABLISHED -j ACCEPT
  725.  
  726. ##########################################         POP3  Client          ###############################################################################
  727. iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 110,995 -m state --state NEW,ESTABLISHED -j ACCEPT
  728. iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --sports 110,995 -m state --state ESTABLISHED -j ACCEPT
  729. ##########################################         IMAP  Client        ###################################################################################
  730. iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 143,993 -m state --state NEW,ESTABLISHED -j ACCEPT
  731. iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --sports 143,993 -m state --state ESTABLISHED -j ACCEPT
  732. ########################################          DNS   Client        #######################################################################################
  733. iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 53,953 -m state --state NEW,ESTABLISHED -j ACCEPT
  734. iptables -A INPUT  -i $int_if -d $int_ip1 -p udp -m multiport --sports 53,953 -m state --state ESTABLISHED -j ACCEPT
  735.  
  736. iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 53,953 -m state --state NEW,ESTABLISHED -j ACCEPT
  737. iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --sports 53,953 -m state --state ESTABLISHED -j ACCEPT
  738.  
  739. iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 53,953 -m state --state NEW,ESTABLISHED -j ACCEPT
  740. iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --dports 53,953 -m state --state ESTABLISHED -j ACCEPT
  741. #######################################            BOOTP  Client       #######################################################################################
  742. iptables -A OUTPUT -o $int_if -s $int_ip1 -d $gateway_ip -p udp -m multiport --dports 67,68 -m state --state NEW,ESTABLISHED -j ACCEPT
  743. iptables -A INPUT  -i $int_if -d $int_ip1 -s $gateway_ip -p udp -m multiport --sports 67,68 -m state --state ESTABLISHED -j ACCEPT
  744. ##########################################         NTP   Client        ##########################################################################################
  745. iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 123 -m state --state NEW,ESTABLISHED -j ACCEPT
  746. iptables -A INPUT  -i $int_if -d $int_ip1 -p udp -m multiport --sports 123 -m state --state ESTABLISHED -j ACCEPT
  747. iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 123 -m state --state NEW,ESTABLISHED -j ACCEPT
  748. iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --sports 123 -m state --state ESTABLISHED -j ACCEPT
  749.  
  750. ###########################################        ICMP Ping         ###############################################################################
  751. iptables -A OUTPUT -o $int_if -s $int_ip1 -p icmp --icmp-type ping  -m state --state NEW,ESTABLISHED -j ACCEPT
  752. iptables -A INPUT  -i $int_if -d $int_ip1 -p icmp --icmp-type ping  -m state --state ESTABLISHED -j ACCEPT
  753.  
  754. # echo reply from ping
  755. iptables -A INPUT -i $int_if -p icmp --icmp-type 0 -d $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  756. # rejection messages
  757. iptables -A INPUT -i $int_if -p icmp --icmp-type 3 -d $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  758. # time out signal
  759. iptables -A INPUT -i $int_if -p icmp --icmp-type 11 -d $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  760. # echo request from ping
  761. iptables -A INPUT -i $int_if -p icmp --icmp-type 8 -m limit --limit 1/second -d $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  762.  
  763. # ip6tables -A OUTPUT -o $int_if -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT
  764. # ip6tables -A INPUT  -i $int_if -p icmp -m state --state ESTABLISHED -j ACCEPT
  765.  
  766. ##########################################    SPECIALIZED OUTPUT   #########################################################################################
  767. ##########################################        GIT Client        ####################################################################################
  768. iptables -A OUTPUT  -o $int_if -s $int_ip1 -p tcp -m multiport --dports 9418 -m state --state NEW,ESTABLISHED -j ACCEPT
  769. iptables -A INPUT   -i $int_if -d $int_ip1 -p tcp -m multiport --sports 9418 -m state --state ESTABLISHED -j ACCEPT
  770. iptables -A OUTPUT  -o $int_if -s $int_ip1 -p tcp -m multiport --sports 9418 -m state --state NEW,ESTABLISHED -j ACCEPT
  771. iptables -A INPUT   -i $int_if -d $int_ip1 -p tcp -m multiport --dports 9418 -m state --state ESTABLISHED -j ACCEPT
  772.  
  773. #########################################           FTP SSL Client        #########################################################################################
  774. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp --dport 2121 -m state --state NEW,ESTABLISHED -j ACCEPT
  775. #iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp --sport 2121 -m state --state ESTABLISHED -j ACCEPT
  776. #########################################            I2P Client         ##########################################################################################
  777. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 19648 -m state --state NEW,ESTABLISHED -j ACCEPT
  778. #iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --sports 19648 -m state --state ESTABLISHED -j ACCEPT
  779. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 19648 -m state --state NEW,ESTABLISHED -j ACCEPT
  780. #iptables -A INPUT  -i $int_if -d $int_ip1 -p udp -m multiport --sports 19648 -m state --state ESTABLISHED -j ACCEPT
  781. ##########################################         FREENET  Client     #########################################################################################
  782. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 12701,29732 -m state --state NEW,ESTABLISHED -j ACCEPT
  783. #iptables -A INPUT  -i $int_if -d $int_ip1 -p udp -m multiport --sports 12701,29732 -m state --state ESTABLISHED -j ACCEPT
  784. ##########################################          TOR  Client    ###############################################################################
  785. iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 9001,9040,9050,9051,9150,9151 -m state --state NEW,ESTABLISHED -j ACCEPT
  786. iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --sports 9001,9040,9050,9051,9150,9151 -m state --state ESTABLISHED -j ACCEPT
  787. iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 9001,9040,9050,9051,9150,9151 -m state --state NEW,ESTABLISHED -j ACCEPT
  788. iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --dports 9001,9040,9050,9051,9150,9151 -m state --state ESTABLISHED -j ACCEPT
  789. ##########################################         BitTorrent  Client     #########################################################################################
  790. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 2710,6881,6887,6888,6889,6890,6969 -m state --state NEW,ESTABLISHED -j ACCEPT
  791. #iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --sports 2710,6881,6887,6888,6889,6890,6969 -m state --state ESTABLISHED -j ACCEPT
  792. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 2710,6881,6887,6888,6889,6890,6969 -m state --state NEW,ESTABLISHED -j ACCEPT
  793. #iptables -A INPUT  -i $int_if -d $int_ip1 -p udp -m multiport --sports 2710,6881,6887,6888,6889,6890,6969 -m state --state ESTABLISHED -j ACCEPT
  794.  
  795. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 6969,2710,4444,1337,80 -m state --state NEW,ESTABLISHED -j ACCEPT
  796. #iptables -A INPUT  -i $int_if -d $int_ip1 -p udp -m multiport --sports 6969,2710,4444,1337,80 -m state --state ESTABLISHED -j ACCEPT
  797. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 6969,2710,4444,1337,80 -m state --state NEW,ESTABLISHED -j ACCEPT
  798. #iptables -A INPUT  -i $int_if -d $int_ip1 -p udp -m multiport --dports 6969,2710,4444,1337,80 -m state --state ESTABLISHED -j ACCEPT
  799.  
  800. ##########################################       NETBIOS  Client   ###############################################################################
  801. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 135,137,138,139 -m state --state NEW,ESTABLISHED -j ACCEPT
  802. #iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --sports 135,137,138,139 -m state --state ESTABLISHED -j ACCEPT
  803. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 135,137,138,139 -m state --state NEW,ESTABLISHED -j ACCEPT
  804. #iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --dports 135,137,138,139 -m state --state ESTABLISHED -j ACCEPT
  805. #
  806. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 135,137,138,139 -m state --state NEW,ESTABLISHED -j ACCEPT
  807. #iptables -A INPUT  -i $int_if -d $int_ip1 -p udp -m multiport --sports 135,137,138,139 -m state --state ESTABLISHED -j ACCEPT
  808. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 135,137,138,139 -m state --state NEW,ESTABLISHED -j ACCEPT
  809. #iptables -A INPUT  -i $int_if -d $int_ip1 -p udp -m multiport --dports 135,137,138,139 -m state --state ESTABLISHED -j ACCEPT
  810. ##########################################        SMB   Client      ###############################################################################
  811. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 445 -m state --state NEW,ESTABLISHED-j ACCEPT
  812. #iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --sports 445 -m state --state ESTABLISHED -j ACCEPT
  813. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 445 -m state --state NEW,ESTABLISHED -j ACCEPT
  814. #iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --dports 445 -m state --state ESTABLISHED -j ACCEPT
  815.  
  816. ##########################################        CUPS   Client     ###############################################################################
  817. iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 631 -m state --state NEW,ESTABLISHED -j ACCEPT
  818. iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --sports 631 -m state --state ESTABLISHED -j ACCEPT
  819. iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 631 -m state --state NEW,ESTABLISHED -j ACCEPT
  820. iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --dports 631 -m state --state ESTABLISHED -j ACCEPT
  821. #
  822. iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 631 -m state --state NEW,ESTABLISHED -j ACCEPT
  823. iptables -A INPUT  -i $int_if -d $int_ip1 -p udp -m multiport --sports 631 -m state --state ESTABLISHED -j ACCEPT
  824. iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 631 -m state --state NEW,ESTABLISHED -j ACCEPT
  825. iptables -A INPUT  -i $int_if -d $int_ip1 -p udp -m multiport --dports 631 -m state --state ESTABLISHED -j ACCEPT
  826.  
  827. ##########################################       PULSE AUDIO  Client   ###############################################################################
  828. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 4713 -m state --state NEW,ESTABLISHED, -j ACCEPT
  829. #iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --sports 4713 -m state --state ESTABLISHED -j ACCEPT
  830. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 4713 -m state --state NEW,ESTABLISHED -j ACCEPT
  831. #iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --dports 4713 -m state --state ESTABLISHED -j ACCEPT
  832.  
  833. ##########################################       LDAP  Client   ###############################################################################
  834. iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --dports 389 -m state --state NEW,ESTABLISHED -j ACCEPT
  835. iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --sports 389 -m state --state ESTABLISHED -j ACCEPT
  836. iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 389 -m state --state NEW,ESTABLISHED -j ACCEPT
  837. iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --dports 389 -m state --state ESTABLISHED -j ACCEPT
  838.  
  839. iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --dports 389 -m state --state NEW,ESTABLISHED -j ACCEPT
  840. iptables -A INPUT  -i $int_if -d $int_ip1 -p udp -m multiport --sports 389 -m state --state ESTABLISHED -j ACCEPT
  841. iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 389 -m state --state NEW,ESTABLISHED -j ACCEPT
  842. iptables -A INPUT  -i $int_if -d $int_ip1 -p udp -m multiport --dports 389 -m state --state ESTABLISHED -j ACCEPT
  843.  
  844. ###########################################################################################################################################################
  845.  
  846. #########################################################################################################################
  847. #                                           PUBLIC  INPUTS
  848. #########################################################################################################################
  849. ###################################            NTP SERVER        ###############################################################
  850. #iptables -A INPUT  -i $int_if -d $int_ip1 -p udp  -m multiport --dports 123 -m state --state NEW,ESTABLISHED  -j ACCEPT
  851. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp  -m multiport --sports 123 -m state --state ESTABLISHED  -j ACCEPT
  852. ###################################            NNTP SERVER        ###############################################################
  853. #iptables -A INPUT  -i $int_if -d $int_ip1 -p udp  -m multiport --dports 119,563 -m state --state NEW,ESTABLISHED  -j ACCEPT
  854. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp  -m multiport --sports 119,563 -m state --state ESTABLISHED  -j ACCEPT
  855. ###################################           SMTP SERVER             #####################################################################################################
  856. #iptables -A INPUT  -i $int_if -p tcp -m multiport --dports 25,465,587,2525 -m limit --limit 10/s --limit-burst 12 -m state --state NEW,ESTABLISHED -j ACCEPT
  857. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 25,465,587,2525 -m state --state ESTABLISHED -j ACCEPT
  858. #iptables -A INPUT  -i $int_if -p tcp -m multiport --sports 25,465,587,2525 -m limit --limit 10/s --limit-burst 12 -m state --state NEW,ESTABLISHED -j ACCEPT
  859. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 25,465,587,2525 -m state --state ESTABLISHED -j ACCEPT
  860. ###################################         POP3 SERVER            ######################################################################################################
  861. #iptables -A INPUT  -i $int_if -p tcp -m multiport --dports 110,995 -m state --state NEW,ESTABLISHED -j ACCEPT
  862. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 110,995 -m state --state ESTABLISHED -j ACCEPT
  863. #iptables -A INPUT  -i $int_if -p tcp -m multiport --sports 110,995 -m state --state NEW,ESTABLISHED -j ACCEPT
  864. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 110,995 -m state --state ESTABLISHED -j ACCEPT
  865. ###################################         IMAP4 SERVER            ######################################################################################################
  866. #iptables -A INPUT  -i $int_if -p tcp -m multiport --dports 143,993 -m state --state NEW,ESTABLISHED -j ACCEPT
  867. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 143,993 -m state --state ESTABLISHED -j ACCEPT
  868. #iptables -A INPUT  -i $int_if -p tcp -m multiport --sports 143,993 -m state --state NEW,ESTABLISHED -j ACCEPT
  869. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 143,993 -m state --state ESTABLISHED -j ACCEPT
  870. ###################################         TELNET SERVER            #################################################################################################
  871. #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp  -m multiport --dports 23 -m state --state NEW,ESTABLISHED -j ACCEPT
  872. #iptables -A OUTPUT -o $int_if -p tcp -s $int_ip1 -m multiport --sports 23 -m state --state ESTABLISHED -j ACCEPT
  873. ##################################           SSH SERVER            ####################################################################################################
  874. #iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp  -m multiport --dports 22 -m state --state NEW,ESTABLISHED -j ACCEPT
  875. #iptables -A OUTPUT -o $int_if -p tcp -s $int_ip1 -m multiport --sports 22 -m state --state ESTABLISHED -j ACCEPT
  876. ###################################          FTP  SERVER             #####################################################################################################
  877. #iptables -A INPUT  -i $int_if -p tcp  -m multiport --dports 20,21,2121 -m state --state NEW,ESTABLISHED -j ACCEPT
  878. #iptables -A OUTPUT -o $int_if -p tcp  -m multiport --dports 20,21,2121 -m state --state ESTABLISHED -j ACCEPT
  879. ##################################          HTTP HTTPS SERVER        #######################################################################################################
  880. #iptables -A INPUT  -i $int_if -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
  881. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED -j ACCEPT
  882. #iptables -A INPUT  -i $int_if -p tcp -m multiport --sports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
  883. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 80,443 -m state --state ESTABLISHED -j ACCEPT
  884.  
  885. #ip6tables -A INPUT  -i $int_if -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
  886. #ip6tables -A OUTPUT -o $int_if -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED -j ACCEPT
  887. #ip6tables -A INPUT  -i $int_if -p tcp -m multiport --sports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
  888. #ip6tables -A OUTPUT -o $int_if -p tcp -m multiport --dports 80,443 -m state --state ESTABLISHED -j ACCEPT
  889. ###################################            FREENET  SERVER              ###############################################################################################
  890. #iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --dports 12701,29732 -m state --state NEW,ESTABLISHED -j ACCEPT
  891. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 12701,29732 -m state --state ESTABLISHED -j ACCEPT
  892. ###################################           BitTorrent  SERVER              ###############################################################################################
  893. #iptables -A INPUT -i $int_if -d $int_ip1 -p tcp -m multiport --dports 6880,6881,6882,6883,6884,6885,6886 -m state --state NEW,ESTABLISHED -j ACCEPT
  894. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 6880,6881,6882,6883,6884,6885,6886 -m state --state ESTABLISHED -j ACCEPT
  895. #iptables -A INPUT -i $int_if -d $int_ip1 -p udp -m multiport --dports 6880,6881,6882,6883,6884,6885,6886 -m state --state NEW,ESTABLISHED -j ACCEPT
  896. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 6880,6881,6882,6883,6884,6885,6886 -m state --state ESTABLISHED -j ACCEPT
  897. #iptables -A INPUT  -i $int_if -p udp  --sport 53 --dport 4444 -d $int_ip1  -m state --state NEW,ESTABLISHED -j ACCEPT
  898. #iptables -A OUTPUT -o $int_if -p udp  --dport 53 --sport 4444 -s $int_ip1  -m state --state ESTABLISHED -j ACCEPT
  899.  
  900. ####################################            I2P  SERVER               #####################################################################################################
  901. #iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --dports 19648 -m state --state NEW,ESTABLISHED -j ACCEPT
  902. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 19648 -m state --state ESTABLISHED -j ACCEPT
  903. #iptables -A INPUT  -i $int_if -d $int_ip1 -p udp -m multiport --dports 19648 -m state --state NEW,ESTABLISHED -j ACCEPT
  904. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 19648 -m state --state ESTABLISHED -j ACCEPT
  905.  
  906. ####################################            TOR SERVER               #####################################################################################################
  907. #iptables -A INPUT  -i $int_if -d $int_ip1 -p tcp -m multiport --dports 9001,9040,9050,9051,9150,9151 -m state --state NEW,ESTABLISHED -j ACCEPT
  908. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p tcp -m multiport --sports 9001,9040,9050,9051,9150,9151 -m state --state ESTABLISHED -j ACCEPT
  909. #iptables -A INPUT  -i $int_if -d $int_ip1 -p udp -m multiport --dports 9001,9040,9050,9051,9150,9151 -m state --state NEW,ESTABLISHED -j ACCEPT
  910. #iptables -A OUTPUT -o $int_if -s $int_ip1 -p udp -m multiport --sports 9001,9040,9050,9051,9150,9151 -m state --state ESTABLISHED -j ACCEPT
  911.  
  912. ##############################################################################################################################################################################
  913. #                                   LOCAL / PRIVATE INPUTS  # mac address bind local clients to hosts
  914. #
  915. #######################################          BOOTP SERVER             ######################################################################################################
  916. iptables -A INPUT -i $int_if -s $gateway_ip -d $int_ip1 -p udp -m multiport --dports 67,68 -m state --state NEW,ESTABLISHED -j ACCEPT
  917. #######################################          RSYSLOG SERVER           ###########################################################################################################
  918. iptables -A INPUT -i $int_if -s $gateway_ip -d $int_ip1 -p udp --sport 514 --dport 514 -m state --state NEW,ESTABLISHED -j ACCEPT
  919. #######################################     DNS SERVER UNBOUND  ########################################################################################################
  920. iptables -A INPUT  -i $int_if -p udp  --sport 53 --dport 53 -d $int_ip1  -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  921. iptables -A OUTPUT -o $int_if -p udp  --dport 53 --sport 53 -s $int_ip1  -d $host_ip -m state --state ESTABLISHED -j ACCEPT
  922. iptables -A INPUT  -i $int_if -p udp  --dport 53 --sport 53 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  923. iptables -A OUTPUT -o $int_if -p udp  --sport 53 --dport 53 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  924.  
  925. iptables -A INPUT  -i $int_if -p tcp  --sport 53 --dport 53 -d $int_ip1  -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  926. iptables -A OUTPUT -o $int_if -p tcp  --dport 53 --sport 53 -s $int_ip1  -d $host_ip -m state --state ESTABLISHED -j ACCEPT
  927. iptables -A INPUT  -i $int_if -p tcp  --dport 53 --sport 53 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  928. iptables -A OUTPUT -o $int_if -p tcp  --sport 53 --dport 53 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  929.  
  930. iptables -A INPUT  -i $int_if -p udp  --sport 53 --dport 53 -d $int_ip1  -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  931. iptables -A OUTPUT -o $int_if -p udp  --dport 53 --sport 53 -s $int_ip1  -d $client1_ip -m state --state ESTABLISHED -j ACCEPT
  932. iptables -A INPUT  -i $int_if -p udp  --dport 53 --sport 53 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  933. iptables -A OUTPUT -o $int_if -p udp  --sport 53 --dport 53 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  934.  
  935. iptables -A INPUT  -i $int_if -p tcp  --sport 53 --dport 53 -d $int_ip1  -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  936. iptables -A OUTPUT -o $int_if -p tcp  --dport 53 --sport 53 -s $int_ip1  -d $client1_ip -m state --state ESTABLISHED -j ACCEPT
  937. iptables -A INPUT  -i $int_if -p tcp  --dport 53 --sport 53 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  938. iptables -A OUTPUT -o $int_if -p tcp  --sport 53 --dport 53 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  939.  
  940. iptables -A INPUT  -i $int_if -p udp  --sport 53 --dport 53 -d $int_ip1  -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  941. iptables -A OUTPUT -o $int_if -p udp  --dport 53 --sport 53 -s $int_ip1  -d $client2_ip -m state --state ESTABLISHED -j ACCEPT
  942. iptables -A INPUT  -i $int_if -p udp  --dport 53 --sport 53 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  943. iptables -A OUTPUT -o $int_if -p udp  --sport 53 --dport 53 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  944.  
  945. iptables -A INPUT  -i $int_if -p tcp  --sport 53 --dport 53 -d $int_ip1  -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  946. iptables -A OUTPUT -o $int_if -p tcp  --dport 53 --sport 53 -s $int_ip1  -d $client2_ip -m state --state ESTABLISHED -j ACCEPT
  947. iptables -A INPUT  -i $int_if -p tcp  --dport 53 --sport 53 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  948. iptables -A OUTPUT -o $int_if -p tcp  --sport 53 --dport 53 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  949.  
  950. ###################################         POP3 SERVER            ######################################################################################################
  951. #iptables -A INPUT  -i $int_if -p tcp -m multiport --dports 110,995 -d $int_ip1  -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  952. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 110,995 -s $int_ip1  -d $host_ip -m state --state ESTABLISHED -j ACCEPT
  953. #iptables -A INPUT  -i $int_if -p tcp -m multiport --sports 110,995 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  954. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 110,995 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  955.  
  956. #iptables -A INPUT  -i $int_if -p tcp -m multiport --dports 110,995 -d $int_ip1  -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  957. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 110,995 -s $int_ip1  -d $client1_ip -m state --state ESTABLISHED -j ACCEPT
  958. #iptables -A INPUT  -i $int_if -p tcp -m multiport --sports 110,995 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  959. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 110,995 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  960.  
  961. #iptables -A INPUT  -i $int_if -p tcp -m multiport --dports 110,995 -d $int_ip1  -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  962. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 110,995 -s $int_ip1  -d $client2_ip -m state --state ESTABLISHED -j ACCEPT
  963. #iptables -A INPUT  -i $int_if -p tcp -m multiport --sports 110,995 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  964. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 110,995 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  965.  
  966. ###################################         IMAP4 SERVER            ######################################################################################################
  967. #iptables -A INPUT  -i $int_if -p tcp -m multiport --dports 143,993 -d $int_ip1  -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  968. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 143,993 -s $int_ip1  -d $host_ip -m state --state ESTABLISHED -j ACCEPT
  969. #iptables -A INPUT  -i $int_if -p tcp -m multiport --sports 143,993 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  970. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 143,993 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  971.  
  972. #iptables -A INPUT  -i $int_if -p tcp -m multiport --dports 143,993 -d $int_ip1  -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  973. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 143,993 -s $int_ip1  -d $client1_ip -m state --state ESTABLISHED -j ACCEPT
  974. #iptables -A INPUT  -i $int_if -p tcp -m multiport --sports 143,993 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  975. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 143,993 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  976.  
  977. #iptables -A INPUT  -i $int_if -p tcp -m multiport --dports 143,993 -d $int_ip1  -s $client2_ip -m  state --state NEW,ESTABLISHED -j ACCEPT
  978. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 143,993 -s $int_ip1  -d $client2_ip -m state --state ESTABLISHED -j ACCEPT
  979. #iptables -A INPUT  -i $int_if -p tcp -m multiport --sports 143,993 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  980. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 143,993 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  981.  
  982. ####################################################        SMB SERVER         ##############################################################################################
  983. #iptables -A INPUT  -i $int_if -p tcp  --sport 445 --dport 445 -d $int_ip1  -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  984. #iptables -A OUTPUT -o $int_if -p tcp  --dport 445 --sport 445 -s $int_ip1  -d $host_ip -m state --state ESTABLISHED -j ACCEPT
  985. #iptables -A INPUT  -i $int_if -p tcp  --dport 445 --sport 445 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  986. #iptables -A OUTPUT -o $int_if -p tcp  --sport 445 --dport 445 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  987.  
  988. #iptables -A INPUT  -i $int_if -p tcp  --sport 445 --dport 445 -d $int_ip1  -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  989. #iptables -A OUTPUT -o $int_if -p tcp  --dport 445 --sport 445 -s $int_ip1  -d $client1_ip -m state --state ESTABLISHED -j ACCEPT
  990. #iptables -A INPUT  -i $int_if -p tcp  --dport 445 --sport 445 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  991. #iptables -A OUTPUT -o $int_if -p tcp  --sport 445 --sport 445 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  992.  
  993. #iptables -A INPUT  -i $int_if -p tcp  --sport 445 --dport 445 -d $int_ip1  -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  994. #iptables -A OUTPUT -o $int_if -p tcp  --dport 445 --sport 445 -s $int_ip1  -d $client2_ip -m state --state ESTABLISHED -j ACCEPT
  995. #iptables -A INPUT  -i $int_if -p tcp  --dport 445 --sport 445 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  996. #iptables -A OUTPUT -o $int_if -p tcp  --sport 445 --dport 445 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  997.  
  998. #######################################################        NETBIOS  SERVER       ##############################################################################################
  999. #iptables -A INPUT  -i $int_if -p tcp -m multiport --dports 135,137,138,139 -d $int_ip1 -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1000. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 135,137,138,139 -s $int_ip1 -d $host_ip -m state --state ESTABLISHED -j ACCEPT
  1001. #iptables -A INPUT  -i $int_if -p tcp -m multiport --sports 135,137,138,139 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1002. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 135,137,138,139 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1003.  
  1004. #iptables -A INPUT  -i $int_if -p udp -m multiport --dports 135,137,138,139 -d $int_ip1 -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1005. #iptables -A OUTPUT -o $int_if -p udp -m multiport --sports 135,137,138,139 -s $int_ip1 -d $host_ip -m state --state ESTABLISHED -j ACCEPT
  1006. #iptables -A INPUT  -i $int_if -p udp -m multiport --sports 135,137,138,139 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1007. #iptables -A OUTPUT -o $int_if -p udp -m multiport --dports 135,137,138,139 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1008.  
  1009. #iptables -A INPUT  -i $int_if -p tcp -m multiport --dports 135,137,138,139 -d $int_ip1 -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1010. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 135,137,138,139 -s $int_ip1 -d $client1_ip -m state --state ESTABLISHED -j ACCEPT
  1011. #iptables -A INPUT  -i $int_if -p tcp -m multiport --sports 135,137,138,139 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1012. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 135,137,138,139 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1013.  
  1014. #iptables -A INPUT  -i $int_if -p udp -m multiport --dports 135,137,138,139 -d $int_ip1 -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1015. #iptables -A OUTPUT -o $int_if -p udp -m multiport --sports 135,137,138,139 -s $int_ip1 -d $client1_ip -m state --state ESTABLISHED -j ACCEPT
  1016. #iptables -A INPUT  -i $int_if -p udp -m multiport --sports 135,137,138,139 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1017. #iptables -A OUTPUT -o $int_if -p udp -m multiport --dports 135,137,138,139 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1018.  
  1019. #iptables -A INPUT  -i $int_if -p tcp -m multiport --dports 135,137,138,139 -d $int_ip1 -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1020. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --sports 135,137,138,139 -s $int_ip1 -d $client2_ip -m state --state ESTABLISHED -j ACCEPT
  1021. #iptables -A INPUT  -i $int_if -p tcp -m multiport --sports 135,137,138,139 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1022. #iptables -A OUTPUT -o $int_if -p tcp -m multiport --dports 135,137,138,139 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1023.  
  1024. #iptables -A INPUT  -i $int_if -p udp -m multiport --dports 135,137,138,139 -d $int_ip1 -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1025. #iptables -A OUTPUT -o $int_if -p udp -m multiport --sports 135,137,138,139 -s $int_ip1 -d $client2_ip -m state --state ESTABLISHED -j ACCEPT
  1026. #iptables -A INPUT  -i $int_if -p udp -m multiport --sports 135,137,138,139 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1027. #iptables -A OUTPUT -o $int_if -p udp -m multiport --dports 135,137,138,139 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1028.  
  1029. ####################################################        CUPS SERVER         ##############################################################################################
  1030. #iptables -A INPUT  -i $int_if -p udp  --sport 631 --dport 631 -d $int_ip1  -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1031. #iptables -A OUTPUT -o $int_if -p udp  --dport 631 --sport 631 -s $int_ip1  -d $host_ip -m state --state ESTABLISHED -j ACCEPT
  1032. #iptables -A INPUT  -i $int_if -p udp  --dport 631 --sport 631 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1033. #iptables -A OUTPUT -o $int_if -p udp  --sport 631 --dport 631 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1034.  
  1035. #iptables -A INPUT  -i $int_if -p tcp  --sport 631 --dport 631 -d $int_ip1  -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1036. #iptables -A OUTPUT -o $int_if -p tcp  --dport 631 --sport 631 -s $int_ip1  -d $host_ip -m state --state ESTABLISHED -j ACCEPT
  1037. #iptables -A INPUT  -i $int_if -p tcp  --dport 631 --sport 631 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1038. #iptables -A OUTPUT -o $int_if -p tcp  --sport 631 --dport 631 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1039.  
  1040. #iptables -A INPUT  -i $int_if -p udp  --sport 631 --dport 631 -d $int_ip1  -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1041. #iptables -A OUTPUT -o $int_if -p udp  --dport 631 --sport 631 -s $int_ip1  -d $client1_ip -m state --state ESTABLISHED -j ACCEPT
  1042. #iptables -A INPUT  -i $int_if -p udp  --dport 631 --sport 631 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1043. #iptables -A OUTPUT -o $int_if -p udp  --sport 631 --dport 631 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1044.  
  1045. #iptables -A INPUT  -i $int_if -p tcp  --sport 631 --dport 631 -d $int_ip1  -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1046. #iptables -A OUTPUT -o $int_if -p tcp  --dport 631 --sport 631 -s $int_ip1  -d $client1_ip -m state --state ESTABLISHED -j ACCEPT
  1047. #iptables -A INPUT  -i $int_if -p tcp  --dport 631 --sport 631 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1048. #iptables -A OUTPUT -o $int_if -p tcp  --sport 631 --dport 631 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1049.  
  1050. #iptables -A INPUT  -i $int_if -p udp  --sport 631 --dport 631 -d $int_ip1  -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1051. #iptables -A OUTPUT -o $int_if -p udp  --dport 631 --sport 631 -s $int_ip1  -d $client2_ip -m state --state ESTABLISHED -j ACCEPT
  1052. #iptables -A INPUT  -i $int_if -p udp  --dport 631 --sport 631 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1053. #iptables -A OUTPUT -o $int_if -p udp  --sport 631 --dport 631 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1054.  
  1055. #iptables -A INPUT  -i $int_if -p tcp  --sport 631 --dport 631 -d $int_ip1  -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1056. #iptables -A OUTPUT -o $int_if -p tcp  --dport 631 --sport 631 -s $int_ip1  -d $client2_ip -m state --state ESTABLISHED -j ACCEPT
  1057. #iptables -A INPUT  -i $int_if -p tcp  --dport 631 --sport 631 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1058. #iptables -A OUTPUT -o $int_if -p tcp  --sport 631 --dport 631 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1059.  
  1060. #######################################    LDAP SERVER OPENLDAP  ########################################################################################################
  1061. #iptables -A INPUT  -i $int_if -p udp  --sport 389 --dport 389 -d $int_ip1  -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1062. #iptables -A OUTPUT -o $int_if -p udp  --dport 389 --sport 389 -s $int_ip1  -d $host_ip -m state --state ESTABLISHED -j ACCEPT
  1063. #iptables -A INPUT  -i $int_if -p udp  --dport 389 --sport 389 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1064. #iptables -A OUTPUT -o $int_if -p udp  --sport 389 --dport 389 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1065.  
  1066. #iptables -A INPUT  -i $int_if -p tcp  --sport 389 --dport 389 -d $int_ip1  -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1067. #iptables -A OUTPUT -o $int_if -p tcp  --dport 389 --sport 389 -s $int_ip1  -d $host_ip -m state --state ESTABLISHED -j ACCEPT
  1068. #iptables -A INPUT  -i $int_if -p tcp  --dport 389 --sport 389 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1069. #iptables -A OUTPUT -o $int_if -p tcp  --sport 389 --dport 389 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1070.  
  1071. #iptables -A INPUT  -i $int_if -p udp  --sport 389 --dport 389 -d $int_ip1  -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1072. #iptables -A OUTPUT -o $int_if -p udp  --dport 389 --sport 389 -s $int_ip1  -d $client1_ip -m state --state ESTABLISHED -j ACCEPT
  1073. #iptables -A INPUT  -i $int_if -p udp  --dport 389 --sport 389 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1074. #iptables -A OUTPUT -o $int_if -p udp  --sport 389 --dport 389 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1075.  
  1076. #iptables -A INPUT  -i $int_if -p tcp  --sport 389 --dport 389 -d $int_ip1  -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1077. #iptables -A OUTPUT -o $int_if -p tcp  --dport 389 --sport 389 -s $int_ip1  -d $client1_ip -m state --state ESTABLISHED -j ACCEPT
  1078. #iptables -A INPUT  -i $int_if -p tcp  --dport 389 --sport 389 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1079. #iptables -A OUTPUT -o $int_if -p tcp  --sport 389 --dport 389 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1080.  
  1081. #iptables -A INPUT  -i $int_if -p udp  --sport 389 --dport 389 -d $int_ip1  -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1082. #iptables -A OUTPUT -o $int_if -p udp  --dport 389 --sport 389 -s $int_ip1  -d $client2_ip -m state --state ESTABLISHED -j ACCEPT
  1083. #iptables -A INPUT  -i $int_if -p udp  --dport 389 --sport 389 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1084. #iptables -A OUTPUT -o $int_if -p udp  --sport 389 --dport 389 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1085.  
  1086. #iptables -A INPUT  -i $int_if -p tcp  --sport 389 --dport 389 -d $int_ip1  -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1087. #iptables -A OUTPUT -o $int_if -p tcp  --dport 389 --sport 389 -s $int_ip1  -d $client2_ip -m state --state ESTABLISHED -j ACCEPT
  1088. #iptables -A INPUT  -i $int_if -p tcp  --dport 389 --sport 389 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1089. #iptables -A OUTPUT -o $int_if -p tcp  --sport 389 --dport 389 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1090.  
  1091. #######################################    XMPP SERVER   ########################################################################################################
  1092. #iptables -A INPUT  -i $int_if -p udp  --sport 5222 --dport 5222 -d $int_ip1  -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1093. #iptables -A OUTPUT -o $int_if -p udp  --dport 5222 --sport 5222 -s $int_ip1  -d $host_ip -m state --state ESTABLISHED -j ACCEPT
  1094. #iptables -A INPUT  -i $int_if -p udp  --dport 5222 --sport 5222 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1095. #iptables -A OUTPUT -o $int_if -p udp  --sport 5222 --dport 5222 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1096.  
  1097. #iptables -A INPUT  -i $int_if -p tcp  --sport 5222 --dport 5222 -d $int_ip1  -s $host_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1098. #iptables -A OUTPUT -o $int_if -p tcp  --dport 5222 --sport 5222 -s $int_ip1  -d $host_ip -m state --state ESTABLISHED -j ACCEPT
  1099. #iptables -A INPUT  -i $int_if -p tcp  --dport 5222 --sport 5222 -s $host_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1100. #iptables -A OUTPUT -o $int_if -p tcp  --sport 5222 --dport 5222 -d $host_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1101.  
  1102. #iptables -A INPUT  -i $int_if -p udp  --sport 5222 --dport 5222 -d $int_ip1  -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1103. #iptables -A OUTPUT -o $int_if -p udp  --dport 5222 --sport 5222 -s $int_ip1  -d $client1_ip -m state --state ESTABLISHED -j ACCEPT
  1104. #iptables -A INPUT  -i $int_if -p udp  --dport 5222 --sport 5222 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1105. #iptables -A OUTPUT -o $int_if -p udp  --sport 5222 --dport 5222 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1106.  
  1107. #iptables -A INPUT  -i $int_if -p tcp  --sport 5222 --dport 5222 -d $int_ip1  -s $client1_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1108. #iptables -A OUTPUT -o $int_if -p tcp  --dport 5222 --sport 5222 -s $int_ip1  -d $client1_ip -m state --state ESTABLISHED -j ACCEPT
  1109. #iptables -A INPUT  -i $int_if -p tcp  --dport 5222 --sport 5222 -s $client1_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1110. #iptables -A OUTPUT -o $int_if -p tcp  --sport 5222 --dport 5222 -d $client1_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1111.  
  1112. #iptables -A INPUT  -i $int_if -p udp  --sport 5222 --dport 5222 -d $int_ip1  -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1113. #iptables -A OUTPUT -o $int_if -p udp  --dport 5222 --sport 5222 -s $int_ip1  -d $client2_ip -m state --state ESTABLISHED -j ACCEPT
  1114. #iptables -A INPUT  -i $int_if -p udp  --dport 5222 --sport 5222 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1115. #iptables -A OUTPUT -o $int_if -p udp  --sport 5222 --dport 5222 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1116.  
  1117. #iptables -A INPUT  -i $int_if -p tcp  --sport 5222 --dport 5222 -d $int_ip1  -s $client2_ip -m state --state NEW,ESTABLISHED -j ACCEPT
  1118. #iptables -A OUTPUT -o $int_if -p tcp  --dport 5222 --sport 5222 -s $int_ip1  -d $client2_ip -m state --state ESTABLISHED -j ACCEPT
  1119. #iptables -A INPUT  -i $int_if -p tcp  --dport 5222 --sport 5222 -s $client2_ip -d $int_ip1 -m state --state NEW,ESTABLISHED -j ACCEPT
  1120. #iptables -A OUTPUT -o $int_if -p tcp  --sport 5222 --dport 5222 -d $client2_ip -s $int_ip1 -m state --state ESTABLISHED -j ACCEPT
  1121.  
  1122. #####################################################################################################################
  1123. #                                          ICMP INPUT
  1124. #######################################################################################################################
  1125. # accept ICMP packets (ping et.al.)
  1126.  
  1127. iptables -A INPUT -p icmp -j LnD
  1128. ip6tables -A INPUT -p icmp -j LnD
  1129.  
  1130. #######################################################################################################################
  1131. #                                   IP SPOOFING PROOFING
  1132. #######################################################################################################################
  1133. iptables -A INPUT -s 10.0.0.0/8     -j LnD
  1134. iptables -A INPUT -s 172.16.0.0/12  -j LnD
  1135. iptables -A INPUT -s 224.0.0.0/4    -j LnD
  1136. iptables -A OUTPUT -d 224.0.0.0/16  -j LnD
  1137. iptables -A INPUT -s 240.0.0.0/5   -j LnD
  1138. iptables -A INPUT -s 169.254.0.0/16  -j LnD
  1139. iptables -A OUTPUT -d 255.255.255.255 -j LnD
  1140. iptables -A INPUT -s 192.168.0.0/16 -j LnD
  1141. iptables -A INPUT -s 127.0.0.0/8    -j LnD
  1142. iptables -A INPUT -s 0.0.0.0/8       -j LnD
  1143. ########################################################################################################################
  1144. #                                       FINAL LOG DROP  
  1145. #######################################################################################################################
  1146.  
  1147. ##########################################################################################################################
  1148. # log all the rest before dropping
  1149. iptables -A INPUT   -j LOG --log-prefix "IPTables IN Dropped " --log-level=info;
  1150. iptables -A INPUT   -j REJECT --reject-with icmp-host-unreachable
  1151. iptables -A OUTPUT  -j LOG --log-prefix "IPTables OUT Dropped " --log-level=info;
  1152. iptables -A OUTPUT  -j REJECT --reject-with icmp-host-unreachable
  1153. iptables -A FORWARD -j LOG --log-prefix "IPTables FW Dropped " --log-level=info;
  1154. iptables -A FORWARD -j REJECT --reject-with icmp-host-unreachable
  1155.  
  1156. ip6tables -A INPUT   -j LOG --log-prefix "IPTables IN Dropped " --log-level=info;
  1157. ip6tables -A INPUT   -j REJECT
  1158. ip6tables -A OUTPUT  -j LOG --log-prefix "IPTables OUT Dropped " --log-level=info;
  1159. ip6tables -A OUTPUT  -j REJECT
  1160. ip6tables -A FORWARD -j LOG --log-prefix "IPTables FW Dropped " --log-level=info;
  1161. ip6tables -A FORWARD -j REJECT
  1162.  
  1163. ##########################################################################################################################
  1164. #                                 SAVE RULES
  1165. #####################################################################################################################
  1166. iptables-save  > /etc/iptables/iptables.rules
  1167. ip6tables-save > /etc/iptables/ip6tables.rules
  1168.  
  1169. #list the rules
  1170. #iptables -L -v
  1171. # print the time the script finishes
  1172. echo "ENDWALL LOADED"
  1173. date
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!