Acasă Explorează Ajutor
Înregistrare Autentificare
tBKwtWS
/
netfilter-config
1
0
Bifurcare 0
Fisiere
Arbore: 580c9f30ff
Ramuri Etichete
netfilter-confi...
/
iptables.up.rules.stateless

iptables.up.rules.stateless 9.8 KB
Istoric Crud

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180 
  1. # Well known ports      0:1023
    2. 

  2. # Registered ports      1024:49151
    3. 

  3. # Goldielocks zone      32768:65535
    4. 

  4. # Dynamic/Private       49152:65535
    5. 

  5. 

  6. # Disables connection tracking in the raw table. 
    7. 

  7. *raw
    8. 

  8. -A PREROUTING -j NOTRACK
    9. 

  9. -A OUTPUT -j NOTRACK
    10. 

  10. COMMIT
    11. 

  11. 

  12. *filter
    13. 

  13. :INPUT ACCEPT [0:0]
    14. 

  14. :FORWARD ACCEPT [0:0]
    15. 

  15. :OUTPUT ACCEPT [0:0]
    16. 

  16. :clutter - [0:0]
    17. 

  17. 

  18. # Local loopback
    19. 

  19. -A INPUT ! -i lo -d 127.0.0.0/8 -m limit --limit 5/min -j LOG --log-prefix "iptables dropped 127.0.0.0/8, from non localhost: " --log-level 7
    20. 

  20. -A INPUT ! -i lo -d 127.0.0.0/8 -j DROP
    21. 

  21. -A INPUT -i lo -j ACCEPT
    22. 

  22. -A OUTPUT -o lo -j ACCEPT
    23. 

  23. 

  24. # Local docker
    25. 

  25. #-A OUTPUT ! -o eth0 -s 172.18.0.0/13 -d 172.18.0.0/13 -j ACCEPT -m comment --comment "Internal docker"
    26. 

  26. #-A FORWARD ! -o eth0 ! -i eth0 -s 172.18.0.1/13 -d 172.18.0.1/13 -j ACCEPT -m comment --comment "Internal docker"
    27. 

  27. 

  28. # ICMP: Ping
    29. 

  29. -A OUTPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
    30. 

  30. -A INPUT -d 185.87.185.45 -p icmp -m icmp --icmp-type 0 -j ACCEPT 
    31. 

  31. -A OUTPUT -p icmp -j ACCEPT
    32. 

  32. -A INPUT -d 185.87.185.45 -p icmp -j ACCEPT 
    33. 

  33. 

  34. 

  35. # FTP
    36. 

  36. #-A OUTPUT -p tcp -m tcp --dport 21 -j ACCEPT
    37. 

  37. #-A OUTPUT -p tcp -m tcp --sport 32768:65535 --dport 49152:65535 -j ACCEPT
    38. 

  38. 

  39. # SSH
    40. 

  40. -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource
    41. 

  41. -A INPUT -p tcp -m tcp --dport 22 -m limit --limit 5/min -m recent --rcheck --seconds 40 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "iptalbes dropped SSH flood: "
    42. 

  42. -A INPUT -p tcp -m tcp --dport 22 -m recent --update --seconds 40 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP
    43. 

  43. -A INPUT -s 86.83.121.29,185.66.250.42 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
    44. 

  44. #-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
    45. 

  45. #-A FORWARD -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource
    46. 

  46. #-A FORWARD -p tcp -m tcp --dport 22 -m limit --limit 5/min -m recent --rcheck --seconds 40 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "iptalbes dropped SSH flood: "
    47. 

  47. #-A FORWARD -p tcp -m tcp --dport 22 -m recent --update --seconds 40 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP
    48. 

  48. #-A FORWARD ! -o eth0 -d 172.18.0.0/13 -p tcp -m tcp --dport 22 -j ACCEPT
    49. 

  49. 

  50. # SMTP
    51. 

  51. #-A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
    52. 

  52. #-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
    53. 

  53. 

  54. # WHOIS
    55. 

  55. -A OUTPUT -p tcp -m tcp --sport 32768:65535 --dport 43 -j ACCEPT
    56. 

  56. 

  57. # DNS
    58. 

  58. -A OUTPUT -p udp -m udp --sport 1024:65535 --dport 53 -j ACCEPT
    59. 

  59. 

  60. # DHCP
    61. 

  61. -A INPUT -i eth0 -d 255.255.255.255 -p udp -m udp --sport 67 --dport 68 -m limit --limit 5/min -j LOG --log-prefix "iptables allowed DHCP: " --log-level 7
    62. 

  62. -A INPUT -i eth0 -d 255.255.255.255 -p udp -m udp --sport 67 --dport 68 -j ACCEPT
    63. 

  63. -A OUTPUT -o eth0 -p udp -m udp --sport 68 --dport 67 -m limit --limit 5/min -j LOG --log-prefix "iptables allowed DHCP: " --log-level 7
    64. 

  64. -A OUTPUT -o eth0 -p udp -m udp --sport 68 --dport 67 -j ACCEPT
    65. 

  65. 

  66. # HTTP & HTTPS
    67. 

  67. #-A INPUT -p tcp -m tcp --dport 80 -m state --state NEW -m recent --set --name HTTP --rsource
    68. 

  68. #-A INPUT -p tcp -m tcp --dport 80 -m recent --rcheck --seconds 10 --hitcount 20 --rttl --name HTTP --rsource -j LOG --log-prefix "iptables dropped HTTP flood: " --log-level 4
    69. 

  69. #-A INPUT -p tcp -m tcp --dport 80 -m recent --update --seconds 10 --hitcount 20 --rttl --name HTTP --rsource -j DROP
    70. 

  70. -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -m comment --comment "Tor Dir port"
    71. 

  71. -A OUTPUT -d 45.79.136.0/24 -p tcp -m tcp --dport 80 -j REJECT -m comment --comment "WebIron complaint #YUL-135-74376"
    72. 

  72. -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
    73. 

  73. 

  74. #-A INPUT -p tcp -m tcp --dport 443 -m state --state NEW -m recent --set --name HTTPS --rsource
    75. 

  75. #-A INPUT -p tcp -m tcp --dport 443 -m recent --rcheck --seconds 10 --hitcount 20 --rttl --name HTTPS --rsource -j LOG --log-prefix "iptables dropped HTTPS flood: " --log-level 4
    76. 

  76. #-A INPUT -p tcp -m tcp --dport 443 -m recent --update --seconds 10 --hitcount 20 --rttl --name HTTPS --rsource -j DROP
    77. 

  77. -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT -m comment --comment "Tor relay ORport"
    78. 

  78. -A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
    79. 

  79. 

  80. # NTP
    81. 

  81. -A OUTPUT -p udp -m udp --dport 123 -j ACCEPT
    82. 

  82. 

  83. # IMAP
    84. 

  84. -A OUTPUT -p tcp -m tcp --sport 32768:65535 --dport 143 -j ACCEPT 
    85. 

  85. 

  86. # IMAPS
    87. 

  87. -A OUTPUT -p tcp -m tcp --sport 32768:65535 --dport 993 -j ACCEPT
    88. 

  88. 

  89. # PIP
    90. 

  90. #-A OUTPUT -d 185.31.17.223 -p tcp -m tcp --sport 32768:65535 --dport 443 -j ACCEPT -m comment --comment "pip"
    91. 

  91. 

  92. # SMTPS
    93. 

  93. -A OUTPUT -p tcp -m tcp --sport 32768:65535 --dport 465 -j ACCEPT -m comment --comment "SMTP SSL/TLS"
    94. 

  94. -A OUTPUT -p tcp -m tcp --sport 32768:65535 --dport 587 -j ACCEPT -m comment --comment "STARTTLS"
    95. 

  95. 

  96. # Socks5
    97. 

  97. -A INPUT -s 86.83.121.29 -p tcp -m tcp --dport 1080 -j ACCEPT
    98. 

  98. 

  99. # OpenVPN
    100. 

  100. -A INPUT -p udp -m udp --dport 1194 -j ACCEPT -m comment --comment "OpenVPN"
    101. 

  101. -A INPUT -i tun0 -j ACCEPT
    102. 

  102. -A OUTPUT -o tun0 -j ACCEPT
    103. 

  103. -A INPUT -s 86.83.121.29 -j ACCEPT
    104. 

  104. 

  105. # XMPP
    106. 

  106. -A OUTPUT -p tcp -m tcp --sport 32768:65535 --dport 5223 -j ACCEPT -m comment --comment "xmpps"
    107. 

  107. -A OUTPUT -p udp -m udp --sport 32768:65535 --dport 1900 -j ACCEPT -m comment --comment "xmpp?"
    108. 

  108. 

  109. # Multicast DNS
    110. 

  110. -A OUTPUT -p udp -m udp --sport 5353 --dport 5353 -j clutter
    111. 

  111. -A OUTPUT -d 244.0.0.1 -j clutter -m comment --comment "Multicast DNS"
    112. 

  112. -A INPUT -d 224.0.0.1 -j clutter -m comment --comment "Multicast DNS"
    113. 

  113. 

  114. # IRC
    115. 

  115. -A OUTPUT -p tcp -m tcp --sport 32768:65535 --dport 6667 -j ACCEPT
    116. 

  116. -A OUTPUT -p tcp -m tcp --sport 32768:65535 --dport 6697 -j ACCEPT -m comment --comment "ircs"
    117. 

  117. 

  118. # Privoxy
    119. 

  119. -A INPUT -p tcp -m tcp --dport 8118 -j ACCEPT -m comment --comment "Privoxy"
    120. 

  120. 

  121. # Bitcoin
    122. 

  122. -A OUTPUT -p tcp -m tcp --sport 32768:65535 --dport 8333 -j ACCEPT -m comment --comment "Bitcoin"
    123. 

  123. 

  124. # Tor
    125. 

  125. -A OUTPUT -p tcp -m tcp --sport 32768:65535 --dport 8000 -j ACCEPT -m comment --comment "Tor"
    126. 

  126. -A OUTPUT -p tcp -m tcp --sport 32768:65535 --dport 9001:9002 -j ACCEPT -m comment --comment "Tor"
    127. 

  127. -A OUTPUT -p tcp -m tcp --sport 32768:65535 --dport 9030:9031 -j ACCEPT -m comment --comment "Tor"
    128. 

  128. 

  129. # OpenPGP HTTP Key servers
    130. 

  130. -A OUTPUT -p tcp -m tcp --sport 32768:65535 --dport 11371 -j ACCEPT -m comment --comment "OpenPGP hkp HTTP key servers"
    131. 

  131. 

  132. # Torrents
    133. 

  133. #-A OUTPUT -p udp -m udp --sport 51413 -j ACCEPT -m comment --comment "Torrents"
    134. 

  134. #-A INPUT -p udp -m udp  --dport 51413 -j ACCEPT -m comment --comment "Torrents"
    135. 

  135. 

  136. # Traceroute
    137. 

  137. -A OUTPUT -p udp -m udp --sport 32768:65535 --dport 6881:33534 -j ACCEPT -m comment --comment "Traceroute"
    138. 

  138. 

  139. # CloudFlare. Why see http://www.crimeflare.com/cfblock.html
    140. 

  140. #-A INPUT -s 103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,104.16.0.0/12,108.162.192.0/18,131.0.72.0/22,141.101.64.0/18,162.158.0.0/15,172.64.0.0/13,173.245.48.0/20,188.114.96.0/20,190.93.240.0/20,197.234.240.0/22,198.41.128.0/17,199.27.128.0/21 -m limit --limit 5/min -j LOG --log-prefix "iptables dropped cloudflare: " --log-level 7
    141. 

  141. #-A INPUT -s 103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,104.16.0.0/12,108.162.192.0/18,131.0.72.0/22,141.101.64.0/18,162.158.0.0/15,172.64.0.0/13,173.245.48.0/20,188.114.96.0/20,190.93.240.0/20,197.234.240.0/22,198.41.128.0/17,199.27.128.0/21 -j DROP -m comment --comment "CloudFlare http://www.crimeflare.com/cfblock.html"
    142. 

  142. #-A OUTPUT -d 103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,104.16.0.0/12,108.162.192.0/18,131.0.72.0/22,141.101.64.0/18,162.158.0.0/15,172.64.0.0/13,173.245.48.0/20,188.114.96.0/20,190.93.240.0/20,197.234.240.0/22,198.41.128.0/17,199.27.128.0/21 -m limit --limit 5/min -j LOG --log-prefix "iptables dropped cloudflare: " --log-level 7
    143. 

  143. #-A OUTPUT -d 103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,104.16.0.0/12,108.162.192.0/18,131.0.72.0/22,141.101.64.0/18,162.158.0.0/15,172.64.0.0/13,173.245.48.0/20,188.114.96.0/20,190.93.240.0/20,197.234.240.0/22,198.41.128.0/17,199.27.128.0/21 -j REJECT -m comment --comment "CloudFlare http://www.crimeflare.com/cfblock.html"
    144. 

  144. 

  145. # Attacks, crawls, scans, etc
    146. 

  146. -A INPUT -p icmp -j clutter
    147. 

  147. -A INPUT -s 0.0.0.0 -d 255.255.255.255 -j clutter -m comment --comment "Broadcast messages"
    148. 

  148. -A INPUT -p udp -m udp --dport 19 -j clutter -m comment --comment "Character generator, looping to echo = DDoS"
    149. 

  149. -A INPUT -p tcp -m tcp --dport 23 -j clutter
    150. 

  150. -A INPUT -p udp -m udp --dport 53 -j clutter
    151. 

  151. -A INPUT -p udp -m udp --dport 111 -j clutter -m comment --comment "Probe/fingerprint Nix OS"
    152. 

  152. -A INPUT -p tcp -m tcp --dport 445 -j clutter -m comment --comment "MS-DS active directory"
    153. 

  153. -A INPUT -p tcp -m tcp --dport 2323 -j clutter -m comment --comment "3d-nfsd"
    154. 

  154. -A INPUT -p udp -m udp --dport 5060 -j clutter
    155. 

  155. -A INPUT -p tcp -m tcp --dport 3389 -j clutter -m comment --comment "MS terminal server RDP"
    156. 

  156. 

  157. #-A INPUT -d 255.255.255.255 -p tcp -m tcp --sport 67 --dport 68 -j clutter -m comment --comment "DHCP"
    158. 

  158. #-A INPUT -m iprange --dst-range 185.66.250.254-185.66.250.255 -j clutter
    159. 

  159. #-A INPUT -m mac --mac-source d4:ca:6d:74:87:0d -j clutter
    160. 

  160. #-A INPUT -p udp -m udp --dport 3076 -j clutter -m comment --comment "orbix-config"
    161. 

  161. 

  162. # Default policy
    163. 

  163. -A INPUT -p tcp ! --syn -j ACCEPT -m comment --comment "Allow already established incoming TCP connections"
    164. 

  164. -A INPUT -p udp -j ACCEPT -m comment --comment "Allow all incoming UDP connections because we do not use connection tracking"
    165. 

  165. -A OUTPUT -p tcp -m tcp --tcp-flags ACK,RST ACK,RST  --dport 1024:65535 -j ACCEPT -m comment --comment "Allow egress tcp 1024<, as statefull checking is to expensive on a Tor exit node."
    166. 

  166. #-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    167. 

  167. #-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    168. 

  168. 

  169. # Log & drop
    170. 

  170. -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables dropped: " --log-level 7
    171. 

  171. -A INPUT -j DROP
    172. 

  172. -A FORWARD -m limit --limit 5/min -j LOG --log-prefix "iptables forward dropped: " --log-level 7
    173. 

  173. -A FORWARD -j DROP
    174. 

  174. #-A OUTPUT -m limit --limit 5/min -j LOG --log-prefix "iptables rejected: " --log-level 7
    175. 

  175. #-A OUTPUT -j REJECT --reject-with icmp-port-unreachable
    176. 

  176. -A OUTPUT -j ACCEPT
    177. 

  177. -A clutter -m limit --limit 5/min -j LOG --log-prefix "iptables clutter dropped: " --log-level 7
    178. 

  178. -A clutter -j DROP
    179. 

  179. 

  180. COMMIT
    181.