Administrace komentářů

#!/bin/bash

iptables -F
iptables -X

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

iptables -N spoofing
iptables -A spoofing -m limit --limit 1/minute --limit-burst 10 -j LOG --log-prefix "iptables spoofing: "
iptables -A spoofing -s 192.168.0.0/16 -j DROP
iptables -A spoofing -s 172.16.0.0/12 -j DROP
iptables -A spoofing -s 10.0.0.0/8 -j DROP

iptables -N syn_flood
iptables -A syn_flood -m limit --limit 1/s --limit-burst 5 -j ACCEPT
iptables -A syn_flood -m limit --limit 1/minute --limit-burst 10 -j LOG --log-prefix "iptables syn_flood: "
iptables -A syn_flood -p TCP --tcp-flags SYN,ACK SYN,ACK -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset
iptables -A syn_flood -m limit --limit 1/minute --limit-burst 10 -j LOG --log-prefix "iptables syn_flood_drop: "
iptables -A syn_flood -j DROP

iptables -N ssh-whitelist
iptables -A ssh-whitelist -j RETURN

iptables -N ssh-blacklist
iptables -A ssh-blacklist -m recent --name blacklist --set
iptables -A ssh-blacklist -m limit --limit 1/minute --limit-burst 10 -j LOG --log-prefix "iptables ssh-blacklist: "
iptables -A ssh-blacklist -j DROP

iptables -N ssh
iptables -A ssh -j ssh-whitelist
iptables -A ssh -m recent --update --name blacklist --seconds 43200 --hitcount 1 -j DROP         
iptables -A ssh -m recent --set --name short
iptables -A ssh -m recent --set --name long
iptables -A ssh -m recent --update --name short --seconds 60 --hitcount 5 -j ssh-blacklist
iptables -A ssh -m recent --update --name long --seconds 1800 --hitcount 20 -j ssh-blacklist
iptables -A ssh -j ACCEPT

iptables -N tcp_p
iptables -A tcp_p -p TCP --dport 465 -j ACCEPT
iptables -A tcp_p -p TCP --dport 993 -j ACCEPT
iptables -A tcp_p -p TCP --dport 995 -j ACCEPT
iptables -A tcp_p -p TCP --dport 113 -j REJECT
iptables -A tcp_p -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A tcp_p -m limit --limit 1/minute --limit-burst 10 -j LOG --log-prefix "iptables tcp_p: "
iptables -A tcp_p -p TCP -j DROP

iptables -N udp_p
iptables -A udp_p -p UDP -d 224.0.0.251 --dport 5353 -j ACCEPT #multicast DNS
iptables -A udp_p -p UDP -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A udp_p -m limit --limit 1/minute --limit-burst 10 -j LOG --log-prefix "iptables udp_p: "
iptables -A udp_p -p UDP -j DROP

iptables -N icmp_p
iptables -A icmp_p -p ICMP --icmp-type echo-request -m limit --limit 2/s --limit-burst 5 -j ACCEPT
iptables -A icmp_p -p ICMP --icmp-type 0 -j ACCEPT
iptables -A icmp_p -p ICMP --icmp-type 3 -j ACCEPT
iptables -A icmp_p -p ICMP --icmp-type 11 -j ACCEPT
iptables -A icmp_p -m limit --limit 1/minute --limit-burst 10 -j LOG --log-prefix "iptables icmp_p: "
iptables -A icmp_p -p ICMP -j DROP

iptables -A INPUT -p ALL -i lo -j ACCEPT
iptables -A tcp_p -i eth0 -p TCP --syn -j syn_flood
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ssh
iptables -A INPUT -i eth0 -j spoofing
iptables -A INPUT -p TCP -j tcp_p
iptables -A INPUT -p UDP -j udp_p
iptables -A INPUT -p ICMP -j icmp_p