(bad = réseau extérieur)

ipt=/sbin/iptables
E= "-m  state --state ESTABLISHED"
ER="-m  state --state ESTABLISHED,RELATED"
EN="-m  state --state ESTABLISHED,NEW"

#HTTP
$ipt -A cluster-bad -p tcp --sport 1024: --dport 80 $EN -j ACCEPT
$ipt -A bad-cluster -p tcp --dport 1024: --sport 80 $E -j ACCEPT

#HTTPS
$ipt -A cluster-bad -p tcp --sport 1024: --dport 443 $EN -j ACCEPT
$ipt -A bad-cluster -p tcp --dport 1024: --sport 443 $E -j ACCEPT

#DNS
$ipt -A cluster-bad -p tcp --sport 1024: --dport 53 -j ACCEPT
$ipt -A cluster-bad -p udp --sport 1024: --dport 53 -j ACCEPT
$ipt -A bad-cluster -p udp --sport 53 --dport 1024: -j ACCEPT

#NTP
$ipt -A cluster-bad -p udp --sport 123 --dport 123 -j ACCEPT
$ipt -A bad-cluster -p udp --dport 123 --sport 123 -j ACCEPT

#SSH pour GHenry LATP
$ipt -A bad-cluster -p tcp -s 147.94.64.102 --sport 1000: --dport 22 $EN   -j ACCEPT
$ipt -A cluster-bad -p tcp --sport 22 -d 147.94.64.102 --dport 1000: $E  -j ACCEPT