# -== SEGURANÇA ==-
#
# .:: Dropar pacotes Fragmentados/ Gerar Log ::.

iptables -A INPUT -i ppp0 -f -j LOG --log-prefix "Pacote INPUT fragmentado: "
iptables -A INPUT -i ppp0 -f -j DROP
iptables -A FORWARD -m unclean -j DROP


# .:: Proteger contra synflood ::.

echo "1" > /proc/sys/net/ipv4/tcp_syncookies
#iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT


# .:: Proteger contra ICMP Broadcasting ::.

echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts


# .:: Proteger contra pacotes Indesejaveis ::.

iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP


# .:: Protege contra Ping of Death ::.

iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT


# .:: Protege contra Worms ::.

iptables -A FORWARD -p tcp --dport 135 -i eth1 -j REJECT


# .:: Protege contra IP-Spoofing ::.

iptables -N syn-flood
iptables -A INPUT -i eth1 -p tcp --syn -j syn-flood
iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
iptables -A syn-flood -j DROP


# .:: Protege contra Port-Scanners ocultos ::.

iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT