-
Notifications
You must be signed in to change notification settings - Fork 16
/
Copy pathfirewalling
executable file
·80 lines (59 loc) · 2.27 KB
/
firewalling
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
#!/bin/sh
### BEGIN INIT INFO
# Provides: Firewalling rules
# Required-Start:
# Required-Stop:
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: deploy iptables on boot
# Description:
### END INIT INFO
IPTABLE=/sbin/iptables
IP_GRANTED=XXX.XXX.XXX.XXX
# Vider les tables actuelles
$IPTABLE -t filter -F
# Vider les règles personnelles
$IPTABLE -t filter -X
# Interdire toute connexion entrante et sortante
$IPTABLE -t filter -P INPUT DROP
$IPTABLE -t filter -P FORWARD DROP
$IPTABLE -t filter -P OUTPUT DROP
# Ne pas casser les connexions etablies
$IPTABLE -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLE -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Autoriser loopback
$IPTABLE -t filter -A INPUT -i lo -j ACCEPT
$IPTABLE -t filter -A OUTPUT -o lo -j ACCEPT
# ICMP (Ping)
$IPTABLE -t filter -A INPUT -p icmp -j ACCEPT
$IPTABLE -t filter -A OUTPUT -p icmp -j ACCEPT
# DNS In/Out
$IPTABLE -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT
$IPTABLE -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
$IPTABLE -t filter -A INPUT -p tcp --dport 53 -j ACCEPT
$IPTABLE -t filter -A INPUT -p udp --dport 53 -j ACCEPT
# NTP Out
$IPTABLE -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT
# HTTP + HTTPS Out
$IPTABLE -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
$IPTABLE -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT
# HTTP + HTTPS In
$IPTABLE -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
$IPTABLE -t filter -A INPUT -p tcp --dport 443 -j ACCEPT
$IPTABLE -t filter -A INPUT -p tcp --dport 8443 -j ACCEPT
# FTP Out
$IPTABLE -t filter -A OUTPUT -p tcp --dport 20:21 -j ACCEPT
# FTP In
$IPTABLE -t filter -A INPUT -p tcp --dport 20:21 -j ACCEPT
$IPTABLE -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# FTP passive mode
$IPTABLE -t filter -A INPUT -i eth0 -m state --state NEW -p tcp --dport 60000:61000 -j ACCEPT
# SVN
$IPTABLES -t filter -A OUTPUT -p tcp --dport 3690 -j ACCEPT
# MySQL Query Browser
$IPTBLES -t filter -A INPUT -p tcp --dport 3306 -j ACCEPT
# White list SSH
$IPTABLE -N SSH_WHITELIST
$IPTABLE -A SSH_WHITELIST -s $IP_GRANTED -m recent --remove --name SSH -j ACCEPT
$IPTABLE -A INPUT -p tcp --dport 5643 -m state --state NEW -m recent --set --name SSH
$IPTABLE -A INPUT -p tcp --dport 5643 -m state --state NEW -j SSH_WHITELIST