#!/bin/bash set -x # Load needed kernel modules modprobe ip_conntrack modprobe ip_conntrack_ftp # Clear any existing firewall stuff before we start iptables --flush iptables -t nat --flush iptables -t mangle --flush # As the default policies, drop all incoming traffic but allow all # outgoing traffic. This will allow us to make outgoing connections # from any port, but will only allow incoming connections on the ports # specified below. #changed from drop iptables --policy INPUT ACCEPT iptables --policy OUTPUT ACCEPT # Allow all incoming traffic if it is coming from the local loopback device iptables -A INPUT -i lo -j ACCEPT # Related and established connections: see # http://www.sns.ias.edu/~jns/security/iptables/iptables_conntrack.html # # Accept all incoming traffic associated with an established # connection, or a "related" connection # # This will automatically handle incoming UDP traffic associated with # DNS queries, as well as PASSIVE mode FTP (provided the # ip_conntrack_ftp module is loaded) iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT # Allow connections on selected ports to the firewalled computer: # 22 ssh # 80 web # 25 smtp (mail) # Block all MySQL connection just to be sure #iptables -A INPUT -p tcp -i eth0 --dport 22 -m state --state NEW -j ACCEPT #iptables -A INPUT -p tcp -i eth0 --dport 80 -m state --state NEW -j ACCEPT #iptables -A INPUT -p tcp -i eth0 --dport 25 -m state --state NEW -j ACCEPT #iptables -A FORWARD -p tcp -s 0/0 -d 62.3.3.0/24 --dport 3306 -j DROP #####################################################################3 #portmap TCP *:sunrpc (LISTEN) #rpc.statd TCP *:50176 (LISTEN) #named TCP *:domain (LISTEN) #named TCP xena.amphipolis.thrace.local:domain (LISTEN) #named TCP localhost:953 (LISTEN) #named TCP ip6-localhost:953 (LISTEN) #sshd TCP *:ssh (LISTEN) #ALLOW sshd TCP *:48004 (LISTEN) ----SETUP -p for port #mysqld TCP xena.amphipolis.thrace.local:mysql (LISTEN) #slapd TCP *:ldap (LISTEN) #approx TCP *:9999 (LISTEN) #cupsd TCP localhost:ipp (LISTEN) #exim4 TCP localhost:smtp (LISTEN) #rpc.mount TCP *:48217 (LISTEN) #inetd TCP *:auth (LISTEN) #inetd TCP *:swat (LISTEN) #smbd TCP *:microsoft-ds (LISTEN) #smbd TCP *:netbios-ssn (LISTEN) #VBoxHeadl TCP *:3389 (LISTEN) #sshd TCP localhost:6010 (LISTEN) #sshd TCP ip6-localhost:6010 (LISTEN) #sshd TCP localhost:6011 (LISTEN) #sshd TCP ip6-localhost:6011 (LISTEN) #sshd TCP localhost:6012 (LISTEN) #sshd TCP ip6-localhost:6012 (LISTEN) #transmiss TCP *:51413 (LISTEN) #transmiss TCP *:9091 (LISTEN) iptables -A INPUT -p tcp --dport 530 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp -dport 50176 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 53 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 953 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 22 -s 0.0.0.0/0 -m state --state NEW -j REJECT iptables -A INPUT -p tcp --dport 48004 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 3306 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 389 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 9999 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 631 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT #MAIL Server why is it on? #iptables -A INPUT -p tcp --dport 10024 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 48217 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 113 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 901 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 445 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 137 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 3389 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 6010 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 6012 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport -51413 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 9091 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT #-s 0.0.0.0/0 #-s 192.168.1.0/24 #################################################################### # Allow icmp input so that people can ping us iptables -A INPUT -p icmp -j ACCEPT # Logging: first, eliminate any packets that are going to broadcast # addresses, since they will overwhelm the log files if there are any # windows computers on our network. Also, don't log pesky multicast # packets that we block. iptables -A INPUT -d 255.255.255.255/0.0.0.255 -j DROP iptables -A INPUT -d 224.0.0.1 -j DROP # Log all other blocked packets, and change DROP to REJECT to be # polite and allow people connecting to a blocked port to receive a # "connection refused" message instead of timing out after 30 seconds. iptables -A INPUT -j LOG iptables -A INPUT -j REJECT