rendered paste body#!/bin/sh## Author: T.J.# Date: 5/21/07# Modified: 5/21/07# Name: Iptables Setup## Flush iptablesiptables -Xiptables -F -t filteriptables -F -t natiptables -F -t mangleiptables -Z# Policy: Drop Alliptables -P INPUT DROPiptables -P OUTPUT DROPiptables -P FORWARD DROP# LOCAL TRAFFIC# Allow loopback trafficiptables -A INPUT -i lo -j ACCEPTiptables -A OUTPUT -o lo -j ACCEPT# EXTERNAL TRAFFIC# Allow interfaces to receive trafficiptables -A INPUT -i eth0 -j ACCEPTiptables -A OUTPUT -o eth0 -j ACCEPTiptables -A INPUT -i eth1 -j ACCEPTiptables -A OUTPUT -o eth1 -j ACCEPT # ROUTING# Main Routingiptables -A INPUT -m state --state ESTABLISHED -j ACCEPTiptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT# Enable Forwardiptables -A FORWARD -m state -i eth1 -o eth0 --state NEW,RELATED,ESTABLISHED -j ACCEPTiptables -A FORWARD -m state -i ppp0 -o eth1 --state RELATED,ESTABLISHED -j ACCEPTiptables -A FORWARD -m state -i eth1 -o ppp0 --state RELATED,ESTABLISHED -j ACCEPTiptables -A FORWARD -i eth0 -o eth1 -j ACCEPTiptables -A FORWARD -i eth0 -o ppp0 -j ACCEPTiptables -A FORWARD -i eth1 -o ppp0 -j ACCEPTiptables -A FORWARD -i ppp0 -o eth1 -j ACCEPTiptables -A FORWARD -i ppp0 -o eth0 -j ACCEPT# Port Forwarding# OLD# VMWare#iptables -t nat -A PREROUTING -p tcp --dport 902 -i eth1 -j DNAT --to 10.0.0.11:902#iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to 10.0.0.11:902#iptables -A FORWARD -p tcp -i eth1 -d 10.0.0.11 --dport 902 -j ACCEPT# Apache#iptables -t nat -A PREROUTING -p tcp --dport 10101 -i eth1 -j DNAT --to 10.0.0.100:10101#iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to 10.0.0.100:10101#iptables -A FORWARD -p tcp -i eth1 -d 10.0.0.100 --dport 10101 -j ACCEPT# Post-routingiptables -t nat -A POSTROUTING -o eth1 -j MASQUERADEiptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE# FIREWALL# Drop malicious TCP packets that have errornous headersiptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROPiptables -A OUTPUT -p tcp --tcp-flags ALL ALL -j DROP# Drop malformed packets with NULL headersiptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROPiptables -A OUTPUT -p tcp --tcp-flags ALL NONE -j DROP# Drop stealth scans#iptables -A INPUT -i eth1 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE#iptables -A INPUT -i eth1 -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN#iptables -A INPUT -i eth1 -p tcp -m tcp --tcp-flags SYN,RST SYN,RST#iptables -A INPUT -i eth1 -p tcp -m tcp --tcp-flags FIN,RST FIN,RST#iptables -A INPUT -i eth1 -p tcp -m tcp --tcp-flags ACK,URG URG# Allow ICMP ECHO-REQUESTiptables -t filter -A INPUT -i eth0 -p icmp --icmp-type ! echo-request -j ACCEPTiptables -t filter -A INPUT -i eth1 -p icmp --icmp-type ! echo-request -j ACCEPT# Allow Arbitrary Ports - COMMENTED#iptables -A INPUT -p tcp --dport 1025:65535 -j ACCEPT#iptables -A OUTPUT -p tcp --dport 1025:65535 -j ACCEPT# Enable SSHiptables -A INPUT -p tcp --syn --dport 22 -j LOG --log-prefix "SSH SYN "iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT#iptables -A INPUT -s 0/0 -p tcp -m tcp --dport 22 -j ACCEPT# Enable 67/68iptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 67:68 -j ACCEPT# Enable identiptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 113 -j ACCEPT# Enable Webminiptables -A INPUT -i eth0 -p tcp -m tcp --dport 3180 -j ACCEPT# Enable 4040:4041iptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 4040:4041 -j ACCEPT# Enable IRCiptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 6660:6669 -j ACCEPT# Enable Apacheiptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 10101 -j ACCEPT# Enable VMWare Console#iptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 65500 -j ACCEPT# Enable 65505iptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 65505 -j ACCEPT# Enable 65516iptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 65516 -j ACCEPT# Enable 65534:65535iptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 65534:65535 -j ACCEPT# 65535 Highest Port Available# VMWareiptables -t nat -A PREROUTING -p tcp --dport 902 -i eth1 -j DNAT --to 10.0.0.11:902iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to 10.0.0.11:902iptables -A FORWARD -p tcp -i eth1 -d 10.0.0.11 --dport 902 -j ACCEPT# Apacheiptables -t nat -A PREROUTING -p tcp --dport 10101 -i eth1 -j DNAT --to 10.0.0.100:10101iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to 10.0.0.100:10101iptables -A FORWARD -p tcp -i eth1 -d 10.0.0.100 --dport 10101 -j ACCEPT# SAVEiptables-save > iptables.save