#!/bin/bash
# firewall script using iptables
# Platform: Red Hat Linux 9 (Shrike)
# Author: webHauser
# Created: 2005.08.10.
IPTABLES="/sbin/iptables"
LAN="eth1"
WAN="eth0"
# Flush rules and delete all user chains
$IPTABLES -t filter -F
$IPTABLES -t filter -X
$IPTABLES -t nat -F
$IPTABLES -t nat -X
$IPTABLES -F
$IPTABLES -X
# Set default policies
$IPTABLES --policy INPUT DROP
$IPTABLES --policy OUTPUT DROP
$IPTABLES --policy FORWARD DROP
# enable masquerading to allow LAN internet access
$IPTABLES -t nat -A POSTROUTING -o $WAN -j MASQUERADE
# Forward all packets from internal network to eth0 (the internet).
$IPTABLES -A FORWARD -i $LAN -o $WAN -j ACCEPT
# Forward packets that are part of existing and related connections from eth0 to eth1.
$IPTABLES -A FORWARD -i $WAN -o $LAN -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow unlimited traffic on the loopback interface
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT
# Previously initiated and accepted exchanges bypass rule checking
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow ICMP echo requests on LAN interface
$IPTABLES -A INPUT -i $LAN -p icmp --icmp-type echo-request -j ACCEPT
# Allow incoming port 22 (ssh) connections on LAN interface
$IPTABLES -A INPUT -i $LAN -p tcp --destination-port 22 -m state --state NEW -j ACCEPT
# Allow DNS resolution on all interfaces
$IPTABLES -A INPUT -p udp --destination-port 53 -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -p tcp --destination-port 53 -m state --state NEW -j ACCEPT
$IPTABLES -A FORWARD -p udp --destination-port 53 -m state --state NEW -j ACCEPT
$IPTABLES -A FORWARD -p tcp --destination-port 53 -m state --state NEW -j ACCEPT
# Allow ntp synchronization
$IPTABLES -A INPUT -i $WAN -p udp --destination-port 123 -m state --state NEW -j ACCEPT
# Allow OpenVPN Port and VLAN tunnel
$IPTABLES -A INPUT -p udp --destination-port 1194 -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -p tcp --destination-port 1194 -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -i tun+ -p udp -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -i tun+ -p tcp -m state --state NEW -j ACCEPT
/sbin/iptables-save > /root/iptables-new
Recent Comments