Iptables commands .

#!/bin/sh

#File: /etc/rc.d/rc.firewall

# At once log and drop any known abusive IPs

iptables -A INPUT -p tcp -s 87.118.104.44 -m limit –limit 1/minute –limit-burst 10 -j LOG –log-prefix “[DROPPED_NODE]“ –log-level 4

iptables -A INPUT -p tcp -s 87.118.104.44 -j DROP

# Allow fr?m ?n? t? ?n? ?n 127.0.0.1/32

iptables -A INPUT -s 127.0.0.1/32 -j ACCEPT

iptables -A OUTPUT -s 127.0.0.1/32 -j ACCEPT

# Track connection state

iptables -A INPUT -p tcp -m state –state ESTABLISHED -j ACCEPT

iptables -A OUTPUT -p tcp -m state –state NEW,ESTABLISHED -j ACCEPT

# Allow ??? foreign IPs t? access ports 443 ?n? 80

iptables -A INPUT -p TCP –dport 443 -j ACCEPT

iptables -A INPUT -p TCP –dport 80 -j ACCEPT

# Allow access fr?m a specified foreign IP

# t? th?? server’s port 8080

iptables -A INPUT -p TCP -s 172.16.88.2/32 –dport 8080 -j ACCEPT

# Allow access fr?m a specified foreign IP

# t? ?n? port listening ?n th?? server

iptables -A INPUT -p TCP -s 172.13.88.3/32 -j ACCEPT

# Drop incoming UDP packets ?n port 137 ?n? 138 without logging

iptables -A INPUT -p UDP –dport 137 -j DROP

iptables -A INPUT -p UDP –dport 138 -j DROP

# Accept ??? ?th?r incoming UDP packets

iptables -A INPUT -p UDP -j ACCEPT

#  Log ?n? Drop everything ????

iptables -A INPUT -j LOG -m limit –limit 1/minute –limit-burst 10 –log-prefix “[DROPPED_NODE]” –log-level 4

iptables -A INPUT -j DROP

# View all rules

iptables -L -v

# View INPUT rules

iptables -L INPUT -nv



# View max tracked relations

cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max

# Set max tracked relations

# add th? subsequent line t? rc.local ?f sysctl.conf doesn’t exist

echo 128000 > /proc/sys/net/ipv4/netfilter/ip_conntrack_max

# View Current HASHSIZE

cat /proc/sys/net/ipv4/netfilter/ip_conntrack_buckets