-
-
Save nigimaster/2ff47aa4218ddf6c5f9ffc9b5e07f513 to your computer and use it in GitHub Desktop.
Bash script to configure iptables for a web server. Some rules can be removed depending on used services.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/sh | |
| # Empty all rules | |
| sudo iptables -t filter -F | |
| sudo iptables -t filter -X | |
| # Bloc everything by default | |
| sudo iptables -t filter -P INPUT DROP | |
| sudo iptables -t filter -P FORWARD DROP | |
| sudo iptables -t filter -P OUTPUT DROP | |
| # Authorize already established connexions | |
| sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT | |
| sudo iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT | |
| sudo iptables -t filter -A INPUT -i lo -j ACCEPT | |
| sudo iptables -t filter -A OUTPUT -o lo -j ACCEPT | |
| # ICMP (Ping) | |
| sudo iptables -t filter -A INPUT -p icmp -j ACCEPT | |
| sudo iptables -t filter -A OUTPUT -p icmp -j ACCEPT | |
| # SSH | |
| sudo iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT | |
| sudo iptables -t filter -A OUTPUT -p tcp --dport 22 -j ACCEPT | |
| # DNS | |
| sudo iptables -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT | |
| sudo iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT | |
| sudo iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT | |
| sudo iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT | |
| # HTTP | |
| sudo iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT | |
| sudo iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT | |
| #HTTPS | |
| sudo iptables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT | |
| sudo iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT | |
| # FTP | |
| sudo iptables -t filter -A OUTPUT -p tcp --dport 20:21 -j ACCEPT | |
| sudo iptables -t filter -A INPUT -p tcp --dport 20:21 -j ACCEPT | |
| # Git | |
| sudo iptables -t filter -A OUTPUT -p tcp --dport 9418 -j ACCEPT | |
| sudo iptables -t filter -A INPUT -p tcp --dport 9418 -j ACCEPT | |
| # Mail SMTP | |
| iptables -t filter -A INPUT -p tcp --dport 25 -j ACCEPT | |
| iptables -t filter -A OUTPUT -p tcp --dport 25 -j ACCEPT | |
| # Mail POP3 | |
| iptables -t filter -A INPUT -p tcp --dport 110 -j ACCEPT | |
| iptables -t filter -A OUTPUT -p tcp --dport 110 -j ACCEPT | |
| # Mail IMAP | |
| iptables -t filter -A INPUT -p tcp --dport 143 -j ACCEPT | |
| iptables -t filter -A OUTPUT -p tcp --dport 143 -j ACCEPT | |
| # NTP (server time) | |
| sudo iptables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment