RTFM.WIKI

Ordnung muß sein. Ordnung über alles (18+)

Инструменты пользователя

Инструменты сайта


Боковая панель


Навигация

Линкшэринг

ALARM!

Добавить новую страницу

You are not allowed to add pages
linux:iptables:basic_firewall


Базовый набор правил SSH/HTTP/DNS/NTP

# Flush INPUT/OUTPUT/FORWARD chains
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
 
# Drop invalid packets
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
 
# Accept everything on loopback
iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
 
# Accept incoming packets for established connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 
# Accept incoming ICMP
iptables -A INPUT -p icmp -j ACCEPT
 
# Pass incoming SSH
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
 
# Accept outgoing packets for established connections
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 
# Accept outgoing DNS
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
 
# Accept outgoing NTP
iptables -A OUTPUT -p tcp --dport 123 -j ACCEPT
iptables -A OUTPUT -p udp --dport 123 -j ACCEPT
 
# Accept outgoing HTTP/S
iptables -A OUTPUT -p tcp --dport 80  -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
 
# Accept outgoing SSH
iptables -A OUTPUT -p tcp --dport 22  -j ACCEPT
 
# Accept outgoing ICMP
iptables -A OUTPUT -p icmp -j ACCEPT
 
# Drop everything else
iptables -P INPUT   DROP
iptables -P FORWARD DROP
iptables -P OUTPUT  DROP

Источник: https://blog.sleeplessbeastie.eu/2018/06/13/how-to-create-iptables-firewall/

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies

Discussion

Enter your comment. Wiki syntax is allowed:
 
linux/iptables/basic_firewall.txt · Последнее изменение: 2020/04/29 15:14 — dx