| View previous topic :: View next topic |
| Author |
Message |
WarMachine
Apprentice
Joined: 15 Jul 2002
Posts: 181
|
 Posted: Fri Apr 18, 2003 12:10 am Post subject: anyone want to take a look at my iptables script? |
 |
|
Much appreciated if you have any corrections or suggestions.
| Quote: |
#!/bin/sh
IPTABLES=/sbin/iptables
IIFACE=eth0
OIFACE=ppp0
depend() {
need net procparam
}
rules() {
stop
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
echo 0 > /proc/sys/ipv4/conf/all/accept_source_route
$IPTABLES -N syn-flood
$IPTABLES -A INPUT -i $OIFACE -p tcp --syn -j syn-flood
$IPTABLES -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A syn-flood -j DROP
$IPTABLES -A INPUT -i $OIFACE -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A INPUT -i $OIFACE -f -j LOG --log-prefix "IPTABLES FRAGMENTS:"
$IPTABLES -A INPUT -i $OIFACE -f -j DROP
$IPTABLES -A INPUT -i $OIFACE -d lo -j DROP
$IPTABLES -A INPUT -i $OIFACE -m state --state INVALID -j DROP
$IPTABLES -A FORWARD -i $OIFACE -m state --state INVALID -j DROP
$IPTABLES -I INPUT -s 208.13.0.0/16 -p TCP --dport 80 -j DROP
echo 1 >/proc/sys/net/ipv4/ip_forward
$IPTABLES -t nat -A POSTROUTING -o $OIFACE -j MASQUERADE
}
start() {
rules
}
stop() {
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -X
$IPTABLES -t nat -X
}
|
|
|
| Back to top |
|
 |
dook43
Tux's lil' helper
Joined: 11 Jun 2002
Posts: 116
Location: Baton Rouge, LA
|
| Posted: Fri Apr 18, 2003 3:01 am Post subject: |
|
|
Plausible additions:
Of course, this is if you want everything behind the firewall to go out 
iptables -A FORWARD -i $ext_if -o $int_if -m state --state NEW -j REJECT
iptables -A FORWARD -i $ext_if -o $int_if -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $int_if -o $ext_if -j ACCEPT
_________________
"We who are about to die salute you!" |
|
| Back to top |
|
|
|
Networking & Security
