iptables_rules.sh
· 3.3 KiB · Bash
Originalformat
#!/bin/bash
# === Basic Settings ===
# Clear all existing rules
iptables -F
iptables -X
iptables -Z
# Set default policies: drop all incoming and forwarding traffic, allow outgoing
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
# === Variables ===
TAIWAN_IPSET="taiwan_ips" # Name of the IP set for Taiwan
ALLOWED_SSH_IP="192.168.1.0/24" # Allowed SSH subnet
# === Basic Allow Rules ===
# Allow established and related connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Allow established connections"
# Allow loopback (local) traffic
iptables -A INPUT -i lo -j ACCEPT -m comment --comment "Allow local traffic"
# === SSH Rules ===
# Allow SSH from Taiwan IP set
iptables -A INPUT -p tcp --dport 22 -m set --match-set $TAIWAN_IPSET src -j ACCEPT -m comment --comment "Allow SSH from Taiwan IPs"
# Allow SSH from allowed internal network
iptables -A INPUT -p tcp --dport 22 -s $ALLOWED_SSH_IP -j ACCEPT -m comment --comment "Allow SSH from internal network"
# Limit SSH attempts to prevent brute force attacks
iptables -A INPUT -p tcp --dport 22 -m recent --name ssh_bruteforce --set
iptables -A INPUT -p tcp --dport 22 -m recent --name ssh_bruteforce --update --seconds 60 --hitcount 5 -j DROP -m comment --comment "Limit SSH attempts"
# Drop SSH from other sources
iptables -A INPUT -p tcp --dport 22 -j DROP -m comment --comment "Drop unauthorized SSH traffic"
# === HTTP/HTTPS Traffic ===
# Allow HTTP (port 80)
iptables -A INPUT -p tcp --dport 80 -j ACCEPT -m comment --comment "Allow HTTP traffic"
# Allow HTTPS (port 443)
iptables -A INPUT -p tcp --dport 443 -j ACCEPT -m comment --comment "Allow HTTPS traffic"
# === Attack Prevention ===
# Protect against SYN Flood
iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 4 -j ACCEPT -m comment --comment "Protect from SYN Flood"
# Detect and drop port scans
iptables -A INPUT -p tcp --syn -m recent --name portscan --set -m comment --comment "Detect port scans"
iptables -A INPUT -p tcp --syn -m recent --name portscan --update --seconds 60 --hitcount 10 -j DROP -m comment --comment "Drop port scans"
# Limit TCP, UDP, and ICMP traffic to prevent DoS attacks
iptables -A INPUT -p tcp -m limit --limit 10/s --limit-burst 20 -j ACCEPT -m comment --comment "Limit TCP traffic for DoS"
iptables -A INPUT -p udp -m limit --limit 10/s --limit-burst 20 -j ACCEPT -m comment --comment "Limit UDP traffic for DoS"
iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 3 -j ACCEPT -m comment --comment "Limit ICMP requests for DoS"
# Drop large ICMP packets to prevent Ping of Death
iptables -A INPUT -p icmp --icmp-type echo-request -m length --length 0:1024 -j ACCEPT -m comment --comment "Prevent Ping of Death"
# Drop packets with the same source and destination IP
iptables -A INPUT -s 192.168.1.1 -d 192.168.1.1 -j DROP -m comment --comment "Drop same source and destination"
# Drop invalid packets
iptables -A INPUT -m state --state INVALID -j DROP -m comment --comment "Drop invalid packets"
# === Logging ===
# Log dropped packets
iptables -A INPUT -m limit --limit 2/min -j LOG --log-prefix "Dropped: " --log-level 4 -m comment --comment "Log dropped packets"
# === Save Rules ===
# Save rules to /etc/iptables/rules.v4
iptables-save > /etc/iptables/rules.v4
| 1 | #!/bin/bash |
| 2 | |
| 3 | # === Basic Settings === |
| 4 | |
| 5 | # Clear all existing rules |
| 6 | iptables -F |
| 7 | iptables -X |
| 8 | iptables -Z |
| 9 | |
| 10 | # Set default policies: drop all incoming and forwarding traffic, allow outgoing |
| 11 | iptables -P INPUT DROP |
| 12 | iptables -P FORWARD DROP |
| 13 | iptables -P OUTPUT ACCEPT |
| 14 | |
| 15 | # === Variables === |
| 16 | TAIWAN_IPSET="taiwan_ips" # Name of the IP set for Taiwan |
| 17 | ALLOWED_SSH_IP="192.168.1.0/24" # Allowed SSH subnet |
| 18 | |
| 19 | # === Basic Allow Rules === |
| 20 | |
| 21 | # Allow established and related connections |
| 22 | iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Allow established connections" |
| 23 | |
| 24 | # Allow loopback (local) traffic |
| 25 | iptables -A INPUT -i lo -j ACCEPT -m comment --comment "Allow local traffic" |
| 26 | |
| 27 | # === SSH Rules === |
| 28 | |
| 29 | # Allow SSH from Taiwan IP set |
| 30 | iptables -A INPUT -p tcp --dport 22 -m set --match-set $TAIWAN_IPSET src -j ACCEPT -m comment --comment "Allow SSH from Taiwan IPs" |
| 31 | |
| 32 | # Allow SSH from allowed internal network |
| 33 | iptables -A INPUT -p tcp --dport 22 -s $ALLOWED_SSH_IP -j ACCEPT -m comment --comment "Allow SSH from internal network" |
| 34 | |
| 35 | # Limit SSH attempts to prevent brute force attacks |
| 36 | iptables -A INPUT -p tcp --dport 22 -m recent --name ssh_bruteforce --set |
| 37 | iptables -A INPUT -p tcp --dport 22 -m recent --name ssh_bruteforce --update --seconds 60 --hitcount 5 -j DROP -m comment --comment "Limit SSH attempts" |
| 38 | |
| 39 | # Drop SSH from other sources |
| 40 | iptables -A INPUT -p tcp --dport 22 -j DROP -m comment --comment "Drop unauthorized SSH traffic" |
| 41 | |
| 42 | # === HTTP/HTTPS Traffic === |
| 43 | |
| 44 | # Allow HTTP (port 80) |
| 45 | iptables -A INPUT -p tcp --dport 80 -j ACCEPT -m comment --comment "Allow HTTP traffic" |
| 46 | |
| 47 | # Allow HTTPS (port 443) |
| 48 | iptables -A INPUT -p tcp --dport 443 -j ACCEPT -m comment --comment "Allow HTTPS traffic" |
| 49 | |
| 50 | # === Attack Prevention === |
| 51 | |
| 52 | # Protect against SYN Flood |
| 53 | iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 4 -j ACCEPT -m comment --comment "Protect from SYN Flood" |
| 54 | |
| 55 | # Detect and drop port scans |
| 56 | iptables -A INPUT -p tcp --syn -m recent --name portscan --set -m comment --comment "Detect port scans" |
| 57 | iptables -A INPUT -p tcp --syn -m recent --name portscan --update --seconds 60 --hitcount 10 -j DROP -m comment --comment "Drop port scans" |
| 58 | |
| 59 | # Limit TCP, UDP, and ICMP traffic to prevent DoS attacks |
| 60 | iptables -A INPUT -p tcp -m limit --limit 10/s --limit-burst 20 -j ACCEPT -m comment --comment "Limit TCP traffic for DoS" |
| 61 | iptables -A INPUT -p udp -m limit --limit 10/s --limit-burst 20 -j ACCEPT -m comment --comment "Limit UDP traffic for DoS" |
| 62 | iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 3 -j ACCEPT -m comment --comment "Limit ICMP requests for DoS" |
| 63 | |
| 64 | # Drop large ICMP packets to prevent Ping of Death |
| 65 | iptables -A INPUT -p icmp --icmp-type echo-request -m length --length 0:1024 -j ACCEPT -m comment --comment "Prevent Ping of Death" |
| 66 | |
| 67 | # Drop packets with the same source and destination IP |
| 68 | iptables -A INPUT -s 192.168.1.1 -d 192.168.1.1 -j DROP -m comment --comment "Drop same source and destination" |
| 69 | |
| 70 | # Drop invalid packets |
| 71 | iptables -A INPUT -m state --state INVALID -j DROP -m comment --comment "Drop invalid packets" |
| 72 | |
| 73 | # === Logging === |
| 74 | |
| 75 | # Log dropped packets |
| 76 | iptables -A INPUT -m limit --limit 2/min -j LOG --log-prefix "Dropped: " --log-level 4 -m comment --comment "Log dropped packets" |
| 77 | |
| 78 | # === Save Rules === |
| 79 | |
| 80 | # Save rules to /etc/iptables/rules.v4 |
| 81 | iptables-save > /etc/iptables/rules.v4 |
| 82 |