#!/bin/bash
#
# iptables configuration script
IPTABLES=/sbin/iptables
#
# Flush all current rules
#
$IPTABLES -F
#
# Allow SSH connections on tcp port 22
# This is essential when working on remote servers
# via SSH to prevent locking yourself out of the system
#
$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT
#
# Allow HTTP connections on tcp port 80 from 10.20.30.40
#
$IPTABLES -A INPUT -s 10.20.30.40 -p tcp --dport 80 -j ACCEPT
#
# Set default policies for INPUT, FORWARD and OUTPUT chains
#
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT ACCEPT
#
# Set access for localhost
#
$IPTABLES -A INPUT -i lo -j ACCEPT
#
# Accept packets belonging to established and related connections
#
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Log drops to /var/log/messages
LOGLIMIT="2/s"
$IPTABLES -N LOGDROP
$IPTABLES -A LOGDROP -p tcp -m limit --limit $LOGLIMIT -j LOG --log-prefix "TCP LOGDROP: "
$IPTABLES -A LOGDROP -p udp -m limit --limit $LOGLIMIT -j LOG --log-prefix "UDP LOGDROP: "
$IPTABLES -A LOGDROP -p icmp -m limit --limit $LOGLIMIT -j LOG --log-prefix "ICMP LOGDROP: "
$IPTABLES -A LOGDROP -f -m limit --limit $LOGLIMIT -j LOG --log-prefix "FRAGMENT LOGDROP: "
$IPTABLES -A LOGDROP -j DROP
$IPTABLES -A INPUT -p icmp -i eth0 -j LOGDROP
$IPTABLES -A INPUT -p tcp -i eth0 -j LOGDROP
$IPTABLES -A INPUT -p udp -i eth0 -j LOGDROP
#
# In case you want to save these settings
#
# /sbin/service iptables save
#
#
# List rules
#
$IPTABLES -L -v
ref:
http://www.linuxquestions.org/questions/linux-security-4/iptables-logging-385165/
http://www.centos.org/docs/5/html/5.1/Deployment_Guide/s1-iptables-saving.html
Suscribirse a:
Enviar comentarios (Atom)
No hay comentarios:
Publicar un comentario