-
Notifications
You must be signed in to change notification settings - Fork 150
/
iptables.sh
94 lines (77 loc) · 3.48 KB
/
iptables.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
#!/bin/bash
# Variables used in the script
IPTABLES="/sbin/iptables"
IP6TABLES="/sbin/ip6tables"
RTP="16384:16485"
TURN="49152:65535"
#Flush tables
$IPTABLES -F
$IPTABLES -X
$IP6TABLES -F
$IP6TABLES -X
#Default policy
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IP6TABLES -P INPUT DROP
$IP6TABLES -P FORWARD ACCEPT
$IP6TABLES -P OUTPUT ACCEPT
# Allow replies to outgoing requests
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IP6TABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow ping
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
$IP6TABLES -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT
$IP6TABLES -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 130 -j ACCEPT
$IP6TABLES -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m hl --hl-eq 255 -j ACCEPT
$IP6TABLES -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m hl --hl-eq 255 -j ACCEPT
$IP6TABLES -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m hl --hl-eq 255 -j ACCEPT
$IP6TABLES -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m hl --hl-eq 255 -j ACCEPT
$IP6TABLES -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 137 -m hl --hl-eq 255 -j ACCEPT
# loopback rules
$IPTABLES -A INPUT -i lo -j ACCEPT
$IP6TABLES -A INPUT -i lo -j ACCEPT
# SIP
$IPTABLES -A INPUT -p tcp --dport 5061 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 5060 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 5060 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 4443 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 8080 -j ACCEPT
$IP6TABLES -A INPUT -p tcp --dport 5061 -j ACCEPT
$IP6TABLES -A INPUT -p tcp --dport 5060 -j ACCEPT
$IP6TABLES -A INPUT -p udp --dport 5060 -j ACCEPT
$IP6TABLES -A INPUT -p tcp --dport 4443 -j ACCEPT
$IP6TABLES -A INPUT -p tcp --dport 8080 -j ACCEPT
# HTTP (load + web)
$IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 443 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 3443 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 3480 -j ACCEPT
$IP6TABLES -A INPUT -p tcp --dport 80 -j ACCEPT
$IP6TABLES -A INPUT -p tcp --dport 443 -j ACCEPT
$IP6TABLES -A INPUT -p tcp --dport 3443 -j ACCEPT
$IP6TABLES -A INPUT -p tcp --dport 3480 -j ACCEPT
# TURN
$IPTABLES -A INPUT -p udp --dport 3478 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 3478 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 3479 -j ACCEPT
$IP6TABLES -A INPUT -p udp --dport 3478 -j ACCEPT
$IP6TABLES -A INPUT -p tcp --dport 3478 -j ACCEPT
$IP6TABLES -A INPUT -p tcp --dport 3479 -j ACCEPT
# RTPEngine
$IPTABLES -I INPUT -p udp -j RTPENGINE --dport $RTP --id 0
$IP6TABLES -I INPUT -p udp -j RTPENGINE --dport $RTP --id 0
# Allow TURN RTP
$IPTABLES -I INPUT -p udp --dport $TURN -j ACCEPT
$IP6TABLES -I INPUT -p udp --dport $TURN -j ACCEPT
# Brute-force block
$IPTABLES -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --rsource
$IP6TABLES -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --rsource
$IPTABLES -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 180 --hitcount 3 --name DEFAULT --rsource -j DROP
$IP6TABLES -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 180 --hitcount 3 --name DEFAULT --rsource -j DROP
# Allow SSH
$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT
$IP6TABLES -A INPUT -p tcp --dport 22 -j ACCEPT
# Save IP-tables and save for enabling after reboot
/sbin/iptables-save > /etc/iptables/firewall.conf
/sbin/ip6tables-save > /etc/iptables/firewall6.conf