2018-08-16 11:42:25 +00:00
< h2 align = "center" > Iptables Essentials: Common Firewall Rules and Commands< / h2 >
2018-08-14 13:10:34 +00:00
< br >
< p align = "center" >
2019-12-01 09:17:33 +00:00
< a href = "https://github.com/trimstray/iptables-essentials/pulls" >
< img src = "https://img.shields.io/badge/PRs-welcome-brightgreen.svg?longCache=true" alt = "Pull Requests" >
< / a >
< a href = "LICENSE.md" >
< img src = "https://img.shields.io/badge/License-MIT-lightgrey.svg?longCache=true" alt = "MIT License" >
2018-08-14 13:10:34 +00:00
< / a >
< / p >
2019-12-02 21:31:36 +00:00
< p align = "center" >
< a href = "https://twitter.com/trimstray" target = "_blank" >
< img src = "https://img.shields.io/twitter/follow/trimstray.svg?logo=twitter" >
< / a >
< / p >
2018-08-14 13:10:34 +00:00
< div align = "center" >
< sub > Created by
< a href = "https://twitter.com/trimstray" > trimstray< / a > and
2019-03-25 14:29:37 +00:00
< a href = "https://github.com/trimstray/iptables-essentials/graphs/contributors" > contributors< / a >
2018-08-14 13:10:34 +00:00
< / div >
< br >
2020-01-10 14:01:35 +00:00
## :ballot_box_with_check: TODO
2018-08-15 10:57:33 +00:00
- [ ] Add useful Iptables configuration examples
2020-01-11 10:08:52 +00:00
- [x] Add useful Kernel Settings (sysctl) configuration
2018-08-15 10:57:33 +00:00
- [ ] Add links to useful external resources
- [ ] Add advanced configuration examples, commands, rules
2018-08-14 13:10:34 +00:00
****
2019-12-02 21:44:07 +00:00
## Table of Contents
2018-08-15 05:58:13 +00:00
- [Tools to help you configure Iptables ](#tools-to-help-you-configure-iptables )
2018-11-10 19:06:38 +00:00
- [Manuals/Howtos/Tutorials ](#manualshowtostutorials )
2020-01-10 13:53:29 +00:00
- [Useful Kernel Settings (sysctl) configuration ](#useful-kernel-settings-sysctl-configuration )
2020-01-11 10:08:52 +00:00
* [rp_filter ](#rp_filter )
* [log_martians ](#log_martians )
* [send_redirects ](#send_redirects )
* [accept_source_route ](#accept_source_route )
* [accept_redirects ](#accept_redirects )
* [tcp_syncookies ](#tcp_syncookies )
* [icmp_echo_ignore_broadcasts ](#icmp_echo_ignore_broadcasts )
* [ip_forward ](#ip_forward )
2018-11-10 19:06:38 +00:00
- [How it works? ](#how-it-works )
2018-08-15 05:58:13 +00:00
- [Iptables Rules ](#iptables-rules )
* [Saving Rules ](#saving-rules )
2018-09-17 07:57:16 +00:00
- [Debian Based ](#debian-based )
- [RedHat Based ](#redhat-based )
2018-08-15 10:38:52 +00:00
* [List out all of the active iptables rules with verbose ](#list-out-all-of-the-active-iptables-rules-with-verbose )
* [List out all of the active iptables rules with numeric lines and verbose ](#list-out-all-of-the-active-iptables-rules-with-numeric-lines-and-verbose )
* [Print out all of the active iptables rules ](#print-out-all-of-the-active-iptables-rules )
2018-08-15 05:58:13 +00:00
* [List Rules as Tables for INPUT chain ](#list-rules-as-tables-for-input-chain )
2018-08-15 10:38:52 +00:00
* [Print all of the rule specifications in the INPUT chain ](#print-all-of-the-rule-specifications-in-the-input-chain )
2018-08-15 05:58:13 +00:00
* [Show Packet Counts and Aggregate Size ](#show-packet-counts-and-aggregate-size )
2018-08-15 10:38:52 +00:00
* [To display INPUT or OUTPUT chain rules with numeric lines and verbose ](#to-display-input-or-output-chain-rules-with-numeric-lines-and-verbose )
2018-08-15 05:58:13 +00:00
* [Delete Rule by Chain and Number ](#delete-rule-by-chain-and-number )
* [Delete Rule by Specification ](#delete-rule-by-specification )
2020-01-10 14:01:35 +00:00
* [Flush All Rules, Delete All Chains, and Accept All ](#flush-all-rules-delete-all-chains-and-accept-all )
2018-08-15 05:58:13 +00:00
* [Flush All Chains ](#flush-all-chains )
* [Flush a Single Chain ](#flush-a-single-chain )
2018-08-15 10:38:52 +00:00
* [Insert Firewall Rules ](#insert-firewall-rules )
2018-08-15 05:58:13 +00:00
* [Allow Loopback Connections ](#allow-loopback-connections )
* [Allow Established and Related Incoming Connections ](#allow-established-and-related-incoming-connections )
* [Allow Established Outgoing Connections ](#allow-established-outgoing-connections )
* [Internal to External ](#internal-to-external )
* [Drop Invalid Packets ](#drop-invalid-packets )
* [Block an IP Address ](#block-an-ip-address )
* [Block and IP Address and Reject ](#block-and-ip-address-and-reject )
2020-01-10 14:01:35 +00:00
* [Block Connections to a Network Interface ](#block-connections-to-a-network-interface )
2018-08-15 05:58:13 +00:00
* [Allow All Incoming SSH ](#allow-all-incoming-ssh )
* [Allow Incoming SSH from Specific IP address or subnet ](#allow-incoming-ssh-from-specific-ip-address-or-subnet )
* [Allow Outgoing SSH ](#allow-outgoing-ssh )
* [Allow Incoming Rsync from Specific IP Address or Subnet ](#allow-incoming-rsync-from-specific-ip-address-or-subnet )
* [Allow All Incoming HTTP ](#allow-all-incoming-http )
* [Allow All Incoming HTTPS ](#allow-all-incoming-https )
* [Allow All Incoming HTTP and HTTPS ](#allow-all-incoming-http-and-https )
* [Allow MySQL from Specific IP Address or Subnet ](#allow-mysql-from-specific-ip-address-or-subnet )
* [Allow MySQL to Specific Network Interface ](#allow-mysql-to-specific-network-interface )
* [PostgreSQL from Specific IP Address or Subnet ](#postgresql-from-specific-ip-address-or-subnet )
* [Allow PostgreSQL to Specific Network Interface ](#allow-postgresql-to-specific-network-interface )
* [Block Outgoing SMTP Mail ](#block-outgoing-smtp-mail )
* [Allow All Incoming SMTP ](#allow-all-incoming-smtp )
* [Allow All Incoming IMAP ](#allow-all-incoming-imap )
* [Allow All Incoming IMAPS ](#allow-all-incoming-imaps )
* [Allow All Incoming POP3 ](#allow-all-incoming-pop3 )
* [Allow All Incoming POP3S ](#allow-all-incoming-pop3s )
2018-08-15 10:38:52 +00:00
* [Drop Private Network Address On Public Interface ](#drop-private-network-address-on-public-interface )
* [Drop All Outgoing to Facebook Networks ](#drop-all-outgoing-to-facebook-networks )
2018-08-15 10:47:39 +00:00
* [Log and Drop Packets ](#log-and-drop-packets )
* [Log and Drop Packets with Limited Number of Log Entries ](#log-and-drop-packets-with-limited-number-of-log-entries )
* [Drop or Accept Traffic From Mac Address ](#drop-or-accept-traffic-from-mac-address )
* [Block or Allow ICMP Ping Request ](#block-or-allow-icmp-ping-request )
2020-01-10 14:01:35 +00:00
* [Specifying Multiple Ports with `multiport` ](#specifying-multiple-ports-with-multiport )
* [Load Balancing with `random*` or `nth*` ](#load-balancing-with-random-or-nth )
* [Restricting the Number of Connections with `limit` and `iplimit*` ](#restricting-the-number-of-connections-with-limit-and-iplimit )
2018-09-17 07:57:16 +00:00
* [Maintaining a List of recent Connections to Match Against ](#maintaining-a-list-of-recent-connections-to-match-against )
2020-01-10 14:01:35 +00:00
* [Matching Against a `string*` in a Packet's Data Payload ](#matching-against-a-string-in-a-packets-data-payload )
* [Time-based Rules with `time*` ](#time-based-rules-with-time )
2018-09-17 07:57:16 +00:00
* [Packet Matching Based on TTL Values ](#packet-matching-based-on-ttl-values )
2018-09-17 09:06:43 +00:00
* [Protection against port scanning ](#protection-against-port-scanning )
* [SSH brute-force protection ](#ssh-brute-force-protection )
* [Syn-flood protection ](#syn-flood-protection )
+ [Mitigating SYN Floods With SYNPROXY ](#mitigating-syn-floods-with-synproxy )
* [Block New Packets That Are Not SYN ](#block-new-packets-that-are-not-syn )
* [Force Fragments packets check ](#force-fragments-packets-check )
* [XMAS packets ](#xmas-packets )
* [Drop all NULL packets ](#drop-all-null-packets )
* [Block Uncommon MSS Values ](#block-uncommon-mss-values )
* [Block Packets With Bogus TCP Flags ](#block-packets-with-bogus-tcp-flags )
2020-01-10 14:01:35 +00:00
* [Block Packets From Private Subnets (Spoofing) ](#block-packets-from-private-subnets-spoofing )
2018-08-15 05:58:13 +00:00
****
2018-08-14 13:52:39 +00:00
### Tools to help you configure Iptables
2018-08-14 13:10:34 +00:00
2018-08-16 11:42:25 +00:00
< p >
:small_orange_diamond: < a href = "http://shorewall.org/" > < b > Shorewall< / b > < / a > - advanced gateway/firewall configuration tool for GNU/Linux.< br >
:small_orange_diamond: < a href = "https://firewalld.org/" > < b > Firewalld< / b > < / a > - provides a dynamically managed firewall.< br >
:small_orange_diamond: < a href = "https://wiki.ubuntu.com/UncomplicatedFirewall" > < b > UFW< / b > < / a > - default firewall configuration tool for Ubuntu.< br >
:small_orange_diamond: < a href = "https://github.com/firehol/firehol" > < b > FireHOL< / b > < / a > - offer simple and powerful configuration for all Linux firewall and traffic shaping requirements.< br >
< / p >
### Manuals/Howtos/Tutorials
< p >
:small_orange_diamond: < a href = "https://major.io/2010/04/12/best-practices-iptables/" > < b > Best practices: iptables - by Major Hayden< / b > < / a > < br >
:small_orange_diamond: < a href = "https://www.booleanworld.com/depth-guide-iptables-linux-firewall/" > < b > An In-Depth Guide to Iptables, the Linux Firewall< / b > < / a > < br >
:small_orange_diamond: < a href = "https://linuxgazette.net/108/odonovan.html" > < b > Advanced Features of netfilter/iptables< / b > < / a > < br >
2018-09-17 07:57:16 +00:00
:small_orange_diamond: < a href = "http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch14_:_Linux_Firewalls_Using_iptables" > < b > Linux Firewalls Using iptables< / b > < / a > < br >
2018-09-17 09:06:43 +00:00
:small_orange_diamond: < a href = "https://serverfault.com/questions/696182/debugging-iptables-and-common-firewall-pitfalls" > < b > Debugging iptables and common firewall pitfalls?< / b > < / a > < br >
2018-09-17 09:37:06 +00:00
:small_orange_diamond: < a href = "https://www.netfilter.org/documentation/HOWTO/netfilter-hacking-HOWTO-4.html" > < b > Netfilter Hacking HOWTO< / b > < / a > < br >
2018-10-02 20:25:43 +00:00
:small_orange_diamond: < a href = "https://making.pusher.com/per-ip-rate-limiting-with-iptables/" > < b > Per-IP rate limiting with iptables< / b > < / a > < br >
2018-09-17 07:57:16 +00:00
< / p >
2020-01-10 14:01:35 +00:00
### Useful Kernel Settings (sysctl) Configuration
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
##### rp_filter
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
> _Disable routing triangulation. Respond to queries out the same interface, not another. Also protects against IP spoofing._
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
```bash
cat < < EOF > > /etc/sysctl.d/40-custom.conf
2020-01-10 13:53:29 +00:00
net/ipv4/conf/all/rp_filter = 1
2020-01-11 10:08:52 +00:00
EOF
```
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
- [rp_filter and LPIC-3 Linux Security ](https://www.theurbanpenguin.com/rp_filter-and-lpic-3-linux-security/ )
- [Linux kernel rp_filter settings (Reverse path filtering) ](https://www.slashroot.in/linux-kernel-rpfilter-settings-reverse-path-filtering )
- [Reverse Path Filtering ](http://tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.kernel.rpf.html )
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
##### log_martians
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
> _Enable logging of packets with malformed IP addresses._
```bash
cat < < EOF > > /etc/sysctl.d/40-custom.conf
2020-01-10 13:53:29 +00:00
net/ipv4/conf/all/log_martians = 1
2020-01-11 10:08:52 +00:00
EOF
```
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
- [What is the usefulness of logging of martians packet? ](https://serverfault.com/questions/570980/what-is-the-usefulness-of-logging-of-martians-packet-e-g-net-ipv4-conf-all-lo )
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
##### send_redirects
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
> _Disables sending of all IPv4 ICMP redirected packets on all interfaces._
```bash
cat < < EOF > > /etc/sysctl.d/40-custom.conf
2020-01-10 13:53:29 +00:00
net/ipv4/conf/all/send_redirects = 0
2020-01-11 10:08:52 +00:00
EOF
```
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
- [Disable source routing ](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-server_security-disable-source-routing )
- [What are ICMP redirects and should they be blocked? ](https://askubuntu.com/questions/118273/what-are-icmp-redirects-and-should-they-be-blocked )
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
##### accept_source_route
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
> _Disable source routed packets (packets with the Strict Source Route (SSR) or Loose Source Routing (LSR) option set)._
```bash
cat < < EOF > > /etc/sysctl.d/40-custom.conf
2020-01-10 13:53:29 +00:00
net/ipv4/conf/all/accept_source_route = 0
2020-01-11 10:08:52 +00:00
EOF
```
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
- [Disable source routing ](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-server_security-disable-source-routing )
- [The system must not accept IPv4 source-routed packets by default. ](https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2017-12-08/finding/V-38529 )
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
##### accept_redirects
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
> _Disable acceptance of ICMP redirects._
```bash
cat < < EOF > > /etc/sysctl.d/40-custom.conf
2020-01-10 13:53:29 +00:00
net/ipv4/conf/all/accept_redirects = 0
2020-01-11 10:08:52 +00:00
EOF
```
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
- [What are ICMP redirects and should they be blocked? ](https://askubuntu.com/questions/118273/what-are-icmp-redirects-and-should-they-be-blocked )
- [The Red Hat Enterprise Linux operating system must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages. ](https://www.stigviewer.com/stig/red_hat_enterprise_linux_7/2018-11-28/finding/V-73175 )
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
##### tcp_syncookies
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
> _Turn on SYN-flood protections (protection from Denial of Service (DOS) attacks)._
```bash
cat < < EOF > > /etc/sysctl.d/40-custom.conf
2020-01-10 13:53:29 +00:00
net/ipv4/tcp_syncookies = 1
2020-01-11 10:08:52 +00:00
EOF
```
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
- [Hardening your TCP/IP Stack Against SYN Floods ](https://www.ndchost.com/wiki/server-administration/hardening-tcpip-syn-flood )
- [Linux: Turn On TCP SYN Cookie Protection ](https://www.cyberciti.biz/faq/enable-tcp-syn-cookie-protection/ )
- [Better alternative for tcp_syncookies in Linux ](https://serverfault.com/questions/705504/better-alternative-for-tcp-syncookies-in-linux )
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
##### icmp_echo_ignore_broadcasts
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
> _Disable responding to ping broadcasts._
```bash
cat < < EOF > > /etc/sysctl.d/40-custom.conf
2020-01-10 13:53:29 +00:00
net/ipv4/icmp_echo_ignore_broadcasts = 1
2020-01-11 10:08:52 +00:00
EOF
```
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
- [What is ICMP broadcast good for? ](https://superuser.com/questions/306065/what-is-icmp-broadcast-good-for )
- [The system must not respond to ICMPv4 sent to a broadcast address. ](https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2018-11-28/finding/V-38535 )
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
##### ip_forward
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
> _Enable IP routing. Required if your firewall is protecting a network, NAT included._
2020-01-10 13:53:29 +00:00
2020-01-11 10:08:52 +00:00
```bash
cat < < EOF > > /etc/sysctl.d/40-custom.conf
net/ipv4/ip_forward = 1
2020-01-10 13:53:29 +00:00
EOF
```
2020-01-11 10:08:52 +00:00
- [Introduction to routers ](http://linux-training.be/security/ch10.html )
- [How to Enable IP Forwarding in Linux ](http://www.ducea.com/2006/08/01/how-to-enable-ip-forwarding-in-linux/ )
- [What is kernel ip forwarding? ](https://unix.stackexchange.com/questions/14056/what-is-kernel-ip-forwarding )
2018-09-17 07:57:16 +00:00
### How it works?
< p align = "center" >
2019-03-25 14:59:36 +00:00
< img src = "https://github.com/trimstray/iptables-essentials/blob/master/static/img/iptables-packet-flow-ng.png"
2018-09-17 07:57:16 +00:00
alt="Master">
2018-08-16 11:42:25 +00:00
< / p >
2018-08-14 13:52:39 +00:00
### Iptables Rules
2018-08-15 05:58:13 +00:00
#### Saving Rules
2018-08-14 13:10:34 +00:00
###### Debian Based
```bash
netfilter-persistent save
```
###### RedHat Based
```bash
service iptables save
```
2018-08-15 10:38:52 +00:00
#### List out all of the active iptables rules with verbose
2018-08-14 13:10:34 +00:00
```bash
2018-08-15 10:28:44 +00:00
iptables -n -L -v
2018-08-14 13:10:34 +00:00
```
2018-08-15 10:28:44 +00:00
#### List out all of the active iptables rules with numeric lines and verbose
2018-08-14 13:10:34 +00:00
```bash
2018-08-15 10:28:44 +00:00
iptables -n -L -v --line-numbers
2018-08-14 13:10:34 +00:00
```
2018-08-15 10:28:44 +00:00
#### Print out all of the active iptables rules
2018-08-14 13:10:34 +00:00
```bash
2018-08-15 10:28:44 +00:00
iptables -S
2018-08-14 13:10:34 +00:00
```
2018-08-15 05:58:13 +00:00
#### List Rules as Tables for INPUT chain
2018-08-14 13:10:34 +00:00
```bash
iptables -L INPUT
```
2018-08-15 10:28:44 +00:00
#### Print all of the rule specifications in the INPUT chain
2018-08-14 13:10:34 +00:00
```bash
iptables -S INPUT
```
2018-08-15 05:58:13 +00:00
#### Show Packet Counts and Aggregate Size
2018-08-14 13:10:34 +00:00
```bash
iptables -L INPUT -v
```
2018-08-15 10:28:44 +00:00
#### To display INPUT or OUTPUT chain rules with numeric lines and verbose
```bash
iptables -L INPUT -n -v
iptables -L OUTPUT -n -v --line-numbers
```
2018-08-15 05:58:13 +00:00
#### Delete Rule by Chain and Number
2018-08-14 13:10:34 +00:00
```bash
iptables -D INPUT 10
```
2018-08-15 05:58:13 +00:00
#### Delete Rule by Specification
2018-08-14 13:10:34 +00:00
```bash
iptables -D INPUT -m conntrack --ctstate INVALID -j DROP
```
2018-08-15 05:58:13 +00:00
#### Flush All Rules, Delete All Chains, and Accept All
2018-08-14 13:10:34 +00:00
```bash
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X
```
2018-08-15 05:58:13 +00:00
#### Flush All Chains
2018-08-14 13:10:34 +00:00
```bash
iptables -F
```
2018-08-15 05:58:13 +00:00
#### Flush a Single Chain
2018-08-14 13:10:34 +00:00
```bash
iptables -F INPUT
```
2018-08-15 10:28:44 +00:00
#### Insert Firewall Rules
```bash
iptables -I INPUT 2 -s 202.54.1.2 -j DROP
```
2018-08-15 05:58:13 +00:00
#### Allow Loopback Connections
2018-08-14 13:10:34 +00:00
```bash
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Allow Established and Related Incoming Connections
2018-08-14 13:10:34 +00:00
```bash
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Allow Established Outgoing Connections
2018-08-14 13:10:34 +00:00
```bash
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Internal to External
2018-08-14 13:10:34 +00:00
```bash
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Drop Invalid Packets
2018-08-14 13:10:34 +00:00
```bash
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
```
2018-08-15 05:58:13 +00:00
#### Block an IP Address
2018-08-14 13:10:34 +00:00
```bash
2018-08-15 10:57:33 +00:00
iptables -A INPUT -s 192.168.252.10 -j DROP
2018-08-14 13:10:34 +00:00
```
2018-08-15 05:58:13 +00:00
#### Block and IP Address and Reject
2018-08-14 13:10:34 +00:00
```bash
2018-08-15 10:57:33 +00:00
iptables -A INPUT -s 192.168.252.10 -j REJECT
2018-08-14 13:10:34 +00:00
```
2018-08-15 05:58:13 +00:00
#### Block Connections to a Network Interface
2018-08-14 13:10:34 +00:00
```bash
2018-08-15 10:57:33 +00:00
iptables -A INPUT -i eth0 -s 192.168.252.10 -j DROP
2018-08-14 13:10:34 +00:00
```
2018-08-15 05:58:13 +00:00
#### Allow All Incoming SSH
2018-08-14 13:10:34 +00:00
```bash
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Allow Incoming SSH from Specific IP address or subnet
2018-08-14 13:10:34 +00:00
```bash
2018-08-15 10:57:33 +00:00
iptables -A INPUT -p tcp -s 192.168.240.0/24 --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
2018-08-14 13:10:34 +00:00
iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Allow Outgoing SSH
2018-08-14 13:10:34 +00:00
```bash
iptables -A OUTPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Allow Incoming Rsync from Specific IP Address or Subnet
2018-08-14 13:10:34 +00:00
```bash
2018-08-15 10:57:33 +00:00
iptables -A INPUT -p tcp -s 192.168.240.0/24 --dport 873 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
2018-08-14 13:10:34 +00:00
iptables -A OUTPUT -p tcp --sport 873 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Allow All Incoming HTTP
2018-08-14 13:10:34 +00:00
```bash
iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Allow All Incoming HTTPS
2018-08-14 13:10:34 +00:00
```bash
iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Allow All Incoming HTTP and HTTPS
2018-08-14 13:10:34 +00:00
```bash
iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Allow MySQL from Specific IP Address or Subnet
2018-08-14 13:10:34 +00:00
```bash
2018-08-15 10:57:33 +00:00
iptables -A INPUT -p tcp -s 192.168.240.0/24 --dport 3306 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
2018-08-14 13:10:34 +00:00
iptables -A OUTPUT -p tcp --sport 3306 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Allow MySQL to Specific Network Interface
2018-08-14 13:10:34 +00:00
```bash
iptables -A INPUT -i eth1 -p tcp --dport 3306 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth1 -p tcp --sport 3306 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### PostgreSQL from Specific IP Address or Subnet
2018-08-14 13:10:34 +00:00
```bash
2018-08-15 10:57:33 +00:00
iptables -A INPUT -p tcp -s 192.168.240.0/24 --dport 5432 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
2018-08-14 13:10:34 +00:00
iptables -A OUTPUT -p tcp --sport 5432 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Allow PostgreSQL to Specific Network Interface
2018-08-14 13:10:34 +00:00
```bash
iptables -A INPUT -i eth1 -p tcp --dport 5432 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth1 -p tcp --sport 5432 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Block Outgoing SMTP Mail
2018-08-14 13:10:34 +00:00
```bash
iptables -A OUTPUT -p tcp --dport 25 -j REJECT
```
2018-08-15 05:58:13 +00:00
#### Allow All Incoming SMTP
2018-08-14 13:10:34 +00:00
```bash
iptables -A INPUT -p tcp --dport 25 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 25 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Allow All Incoming IMAP
2018-08-14 13:10:34 +00:00
```bash
iptables -A INPUT -p tcp --dport 143 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 143 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Allow All Incoming IMAPS
2018-08-14 13:10:34 +00:00
```bash
iptables -A INPUT -p tcp --dport 993 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 993 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Allow All Incoming POP3
2018-08-14 13:10:34 +00:00
```bash
iptables -A INPUT -p tcp --dport 110 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 110 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
2018-08-15 05:58:13 +00:00
#### Allow All Incoming POP3S
2018-08-14 13:10:34 +00:00
```bash
iptables -A INPUT -p tcp --dport 995 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 995 -m conntrack --ctstate ESTABLISHED -j ACCEPT
```
2018-08-15 10:28:44 +00:00
#### Drop Private Network Address On Public Interface
```bash
iptables -A INPUT -i eth1 -s 192.168.0.0/24 -j DROP
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j DROP
```
#### Drop All Outgoing to Facebook Networks
Get Facebook AS:
```bash
2018-08-15 10:38:52 +00:00
whois -h v4.whois.cymru.com " -v $(host facebook.com | grep "has address" | cut -d " " -f4)" | tail -n1 | awk '{print $1}'
2018-08-15 10:28:44 +00:00
```
Drop:
```bash
for i in $(whois -h whois.radb.net -- '-i origin AS32934' | grep "^route:" | cut -d ":" -f2 | sed -e 's/^[ \t]*//' | sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 | cut -d ":" -f2 | sed 's/$/;/') ; do
iptables -A OUTPUT -s "$i" -j REJECT
done
```
2018-08-15 10:47:39 +00:00
#### Log and Drop Packets
```bash
2018-08-17 06:23:48 +00:00
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j LOG --log-prefix "IP_SPOOF A: "
2018-08-15 10:47:39 +00:00
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j DROP
```
By default everything is logged to `/var/log/messages` file:
```bash
tail -f /var/log/messages
grep --color 'IP SPOOF' /var/log/messages
```
#### Log and Drop Packets with Limited Number of Log Entries
```bash
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP_SPOOF A: "
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j DROP
```
#### Drop or Accept Traffic From Mac Address
```bash
iptables -A INPUT -m mac --mac-source 00:0F:EA:91:04:08 -j DROP
iptables -A INPUT -p tcp --destination-port 22 -m mac --mac-source 00:0F:EA:91:04:07 -j ACCEPT
```
#### Block or Allow ICMP Ping Request
```bash
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
iptables -A INPUT -i eth1 -p icmp --icmp-type echo-request -j DROP
```
2018-09-17 07:57:16 +00:00
#### Specifying Multiple Ports with `multiport`
```bash
iptables -A INPUT -i eth0 -p tcp -m state --state NEW -m multiport --dports ssh,smtp,http,https -j ACCEPT
```
#### Load Balancing with `random*` or `nth*`
```bash
_ips=("172.31.250.10" "172.31.250.11" "172.31.250.12" "172.31.250.13")
for ip in "${_ips[@]}" ; do
2018-09-17 09:06:43 +00:00
iptables -A PREROUTING -i eth0 -p tcp --dport 80 -m state --state NEW -m nth --counter 0 --every 4 --packet 0 \
2018-09-17 07:57:16 +00:00
-j DNAT --to-destination ${ip}:80
done
```
or
```bash
_ips=("172.31.250.10" "172.31.250.11" "172.31.250.12" "172.31.250.13")
for ip in "${_ips[@]}" ; do
2018-09-17 09:06:43 +00:00
iptables -A PREROUTING -i eth0 -p tcp --dport 80 -m state --state NEW -m random --average 25 \
2018-09-17 07:57:16 +00:00
-j DNAT --to-destination ${ip}:80
done
```
#### Restricting the Number of Connections with `limit` and `iplimit*`
```bash
iptables -A FORWARD -m state --state NEW -p tcp -m multiport --dport http,https -o eth0 -i eth1 \
-m limit --limit 20/hour --limit-burst 5 -j ACCEPT
```
or
```bash
iptables -A INPUT -p tcp -m state --state NEW --dport http -m iplimit --iplimit-above 5 -j DROP
```
#### Maintaining a List of recent Connections to Match Against
```bash
iptables -A FORWARD -m recent --name portscan --rcheck --seconds 100 -j DROP
iptables -A FORWARD -p tcp -i eth0 --dport 443 -m recent --name portscan --set -j DROP
```
#### Matching Against a `string*` in a Packet's Data Payload
```bash
iptables -A FORWARD -m string --string '.com' -j DROP
iptables -A FORWARD -m string --string '.exe' -j DROP
```
#### Time-based Rules with `time*`
```bash
iptables -A FORWARD -p tcp -m multiport --dport http,https -o eth0 -i eth1 \
-m time --timestart 21:30 --timestop 22:30 --days Mon,Tue,Wed,Thu,Fri -j ACCEPT
```
#### Packet Matching Based on TTL Values
```bash
iptables -A INPUT -s 1.2.3.4 -m ttl --ttl-lt 40 -j REJECT
```
2018-09-17 09:06:43 +00:00
#### Protection against port scanning
```bash
iptables -N port-scanning
iptables -A port-scanning -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j RETURN
iptables -A port-scanning -j DROP
```
#### SSH brute-force protection
```bash
iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --set
iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 -j DROP
```
#### Syn-flood protection
```bash
iptables -N syn_flood
iptables -A INPUT -p tcp --syn -j syn_flood
iptables -A syn_flood -m limit --limit 1/s --limit-burst 3 -j RETURN
iptables -A syn_flood -j DROP
iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j ACCEPT
iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j LOG --log-prefix PING-DROP:
iptables -A INPUT -p icmp -j DROP
iptables -A OUTPUT -p icmp -j ACCEPT
```
##### Mitigating SYN Floods With SYNPROXY
```bash
iptables -t raw -A PREROUTING -p tcp -m tcp --syn -j CT --notrack
iptables -A INPUT -p tcp -m tcp -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
```
#### Block New Packets That Are Not SYN
```bash
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
```
or
```bash
iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
```
#### Force Fragments packets check
```bash
iptables -A INPUT -f -j DROP
```
#### XMAS packets
```bash
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
```
#### Drop all NULL packets
```bash
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
```
#### Block Uncommon MSS Values
```bash
iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
```
#### Block Packets With Bogus TCP Flags
```bash
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
```
#### Block Packets From Private Subnets (Spoofing)
```bash
_subnets=("224.0.0.0/3" "169.254.0.0/16" "172.16.0.0/12" "192.0.2.0/24" "192.168.0.0/16" "10.0.0.0/8" "0.0.0.0/8" "240.0.0.0/5")
for _sub in "${_subnets[@]}" ; do
iptables -t mangle -A PREROUTING -s "$_sub" -j DROP
done
iptables -t mangle -A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP
```