######### Begin IPtables rule set for the web server ##########################
# These rules do the following.
# section 1: set a policy to drop all packets in and out.
# section 2: Allow all traffic on the loopback interface and preserve any 
# established connections.
# section 3: Allow any host to connect via port 443(HTTPS) to the web server. 
# section 4: Allow our subnets to connect via port 22(SSH) to the web server.
# section 5: Allow web(http & https),dns lookups, and ntp updates outbound.
# section 6: Allow rsync over SSH from the web server to the backup web server. 

###### Variables #################

WEBSERVER=192.168.0.50

###### section 1: #################################################################

# flush or remove any existing ipchains.
iptables --flush

# Set the default policy to drop anything that doesn't meet one of the 
# input or output rules in section 2 or below.
iptables -P INPUT DROP
iptables -P OUTPUT DROP

###### section 2: #################################################################

# Allow the loopback port to recieve all inbound traffic.
iptables -A INPUT -i lo -j ACCEPT

# Allow all inbound established connections to stay connected.
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow the loopback port to send packets out.
iptables -I OUTPUT -i lo -j ACCEPT

# Allow all outbound established connections to stay connected.
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

###### section 3: #################################################################

# Allow all inbound to port 443(https) to the IP $WEBSERVER. 
iptables -A INPUT -p tcp -d $WEBSERVER --dport https -j ACCEPT

###### section 4: #################################################################

# Allow nodes from the backbone subnet to connect using SSH to the IP of the webserver. 
iptables -A INPUT -p tcp -s 192.168.0.0/24 -d $WEBSERVER --dport ssh -j ACCEPT

###### section 5: #################################################################

# Allow outbound TCP packets on ports 80,53,443.
iptables -A OUTPUT -p tcp -m multiport --dports 80,53,443 -m state --state NEW -j ACCEPT

# Allow outbound UDP packets on 53,123.
iptables -A OUTPUT -p udp -m multiport --dports 53,123 -m state --state NEW -j ACCEPT

###### section 6: #################################################################

# Allow rsync over SSH from the webserver($WEBSERVER) to the backup 
# server(192.168.0.51).
iptables -A OUTPUT -p tcp -s $WEBSERVER -d 192.168.0.51 --dport ssh -j ACCEPT

############## End IPtables rule set for web server ########################