######### Begin IPtables rule set for the web server ##########################
# These rules do the following.
# section 1: set a policy to drop all packets in and out.
# section 2: Allow all traffic on the loopback interface and preserve any
# established connections.
# section 3: Allow any host to connect via port 443(HTTPS) to the web server.
# section 4: Allow our subnets to connect via port 22(SSH) to the web server.
# section 5: Allow web(http & https),dns lookups, and ntp updates outbound.
# section 6: Allow rsync over SSH from the web server to the backup web server.
###### Variables #################
WEBSERVER=192.168.0.50
###### section 1: #################################################################
# flush or remove any existing ipchains.
iptables --flush
# Set the default policy to drop anything that doesn't meet one of the
# input or output rules in section 2 or below.
iptables -P INPUT DROP
iptables -P OUTPUT DROP
###### section 2: #################################################################
# Allow the loopback port to recieve all inbound traffic.
iptables -A INPUT -i lo -j ACCEPT
# Allow all inbound established connections to stay connected.
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow the loopback port to send packets out.
iptables -I OUTPUT -i lo -j ACCEPT
# Allow all outbound established connections to stay connected.
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
###### section 3: #################################################################
# Allow all inbound to port 443(https) to the IP $WEBSERVER.
iptables -A INPUT -p tcp -d $WEBSERVER --dport https -j ACCEPT
###### section 4: #################################################################
# Allow nodes from the backbone subnet to connect using SSH to the IP of the webserver.
iptables -A INPUT -p tcp -s 192.168.0.0/24 -d $WEBSERVER --dport ssh -j ACCEPT
###### section 5: #################################################################
# Allow outbound TCP packets on ports 80,53,443.
iptables -A OUTPUT -p tcp -m multiport --dports 80,53,443 -m state --state NEW -j ACCEPT
# Allow outbound UDP packets on 53,123.
iptables -A OUTPUT -p udp -m multiport --dports 53,123 -m state --state NEW -j ACCEPT
###### section 6: #################################################################
# Allow rsync over SSH from the webserver($WEBSERVER) to the backup
# server(192.168.0.51).
iptables -A OUTPUT -p tcp -s $WEBSERVER -d 192.168.0.51 --dport ssh -j ACCEPT
############## End IPtables rule set for web server ########################