# Tighten timeouts etc echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_intvl # Flush all existing chains CHAINS=`cat /proc/net/ip_tables_names 2>/dev/null` for i in $CHAINS do iptables -t $i -F iptables -t $i -Z iptables -t $i -X done # set default policy #iptables -P INPUT DROP #iptables -P OUTPUT DROP #iptables -P FORWARD DROP # Enable Anti DDOS & Block NEW without SYN echo 1 > /proc/sys/net/ipv4/tcp_syncookies iptables -A INPUT -i $EXTIF -p tcp ! --syn -m state --state NEW -j DROPNotice the three commented rules that all start with "iptables -P". These set the policy, but we aren't going to do this right now. Why not? Well, if you should set the policy to drop all right now, all traffic will be stopped. This also implies that if you are working from an SSH connection your connection will be lost, and no new connection will be accepted, thus locking you out from your own entire network (Uhhh, not that anyone here was dumb enough to actually have that happen to him...nope! - Ed.). In the end, when the entire script is complete, just remove the leading "#" from those lines and all is done.
# allow known connections iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Anti-spoofing rule iptables -A INPUT -i $EXTIF -s $EXTIP -j DROP iptables -A INPUT -i $EXTIF -s 127.0.0.0/8 -j DROP # Block fragments and Xmas tree as well as SYN,FIN and SYN,RST iptables -A INPUT -i $EXTIF -p ip -f -j DROP iptables -A INPUT -i $EXTIF -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP iptables -A INPUT -i $EXTIF -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP iptables -A INPUT -i $EXTIF -p tcp --tcp-flags SYN,RST SYN,RST -j DROP #allow icmp iptables -A INPUT -s $INTNET -p icmp -j ACCEPT # Fix loopback settings iptables -A INPUT -i lo -j ACCEPT # Allow outgoing traffic from the firewall iptables -A OUTPUT -m state --state NEW -j ACCEPT # User initiated and related traffic iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT # Internet access from subnets iptables -A FORWARD -s $INTNET -m state --state NEW -j ACCEPT
September 17 2021 | 10:20