#!/bin/bash## iptables configuration scriptIPTABLES=/sbin/iptables## Flush all current rules#$IPTABLES -F## Allow SSH connections on tcp port 22# This is essential when working on remote servers
# via SSH to prevent locking yourself out of the system#$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT## Allow HTTP connections on tcp port 80 from 10.20.30.40#$IPTABLES -A INPUT -s 10.20.30.40 -p tcp --dport 80 -j ACCEPT## Set default policies for INPUT, FORWARD and OUTPUT chains#$IPTABLES -P INPUT DROP$IPTABLES -P FORWARD DROP$IPTABLES -P OUTPUT ACCEPT## Set access for localhost#$IPTABLES -A INPUT -i lo -j ACCEPT## Accept packets belonging to established and related connections#$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT# Log drops to /var/log/messagesLOGLIMIT="2/s"$IPTABLES -N LOGDROP$IPTABLES -A LOGDROP -p tcp -m limit --limit $LOGLIMIT -j LOG --log-prefix "TCP LOGDROP: "$IPTABLES -A LOGDROP -p udp -m limit --limit $LOGLIMIT -j LOG --log-prefix "UDP LOGDROP: "$IPTABLES -A LOGDROP -p icmp -m limit --limit $LOGLIMIT -j LOG --log-prefix "ICMP LOGDROP: "$IPTABLES -A LOGDROP -f -m limit --limit $LOGLIMIT -j LOG --log-prefix "FRAGMENT LOGDROP: "$IPTABLES -A LOGDROP -j DROP$IPTABLES -A INPUT -p icmp -i eth0 -j LOGDROP$IPTABLES -A INPUT -p tcp -i eth0 -j LOGDROP$IPTABLES -A INPUT -p udp -i eth0 -j LOGDROP## In case you want to save these settings## /sbin/service iptables save#
#
# List rules#$IPTABLES -L -vref:
http://www.linuxquestions.org/questions/linux-security-4/iptables-logging-385165/
http://www.centos.org/docs/5/html/5.1/Deployment_Guide/s1-iptables-saving.html