Administrace komentářů

# Zákaz komunikace
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# Vadne pakety
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# WWW, MAIL
iptables -N tcp_seg
iptables -A INPUT -p TCP -i eth0 -j tcp_seg
iptables -A tcp_seg -p TCP --dport 80 -j ACCEPT
iptables -A tcp_seg -p TCP --dport 25 -j ACCEPT

# ICMP
iptables -A INPUT -p ICMP -i eth0 --icmp-type 0 -j ACCEPT
iptables -A INPUT -p ICMP -i eth0 --icmp-type 3 -j ACCEPT
iptables -A INPUT -p ICMP -i eth0 --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP -i eth0 --icmp-type 11 -j ACCEPT

# Komunikace z vnitrni site, Internet, NAT
iptables -A INPUT -p ALL -i eth1 -j ACCEPT
iptables -A INPUT -p ALL -i lo -j ACCEPT
iptables -A INPUT -j LOG
iptables -A OUTPUT -p ALL -s 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -p ALL -s 172.17.18.2 -j ACCEPT
iptables -A OUTPUT -p ALL -s 1.2.3.4 -j ACCEPT
iptables -A OUTPUT -j LOG
iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -m recent --set --name SSH -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j LOG --$
iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP

# RDP
IPTABLES -t nat -A PREROUTING -p tcp -i eth0 --dport 3390 -j DNAT --to 172.17.18.60
IPTABLES -A FORWARD -p tcp -i eth0 -d 172.17.18.60 --dport 3390 -j ACCEPT


echo 1 > /proc/sys/net/ipv4/ip_forward