-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathiptables-leg
191 lines (191 loc) · 7.01 KB
/
iptables-leg
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
# Generated by xtables-save v1.8.2 on Wed Jun 17 05:15:38 2020
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT DROP [0:0]
#:INPUT DROP [0:0]
#:FORWARD DROP [0:0]
#:POSTROUTING DROP [0:0]
#:TCP DROP [0:0]
#:UDP DROP [0:0]
#:ICMP DROP [0:0]
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 80 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 443 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 68 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 67 -j ACCEPT
#-A PREROUTING -m conntrack --ctstate ESTABLISHED -j ACCEPT
#-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
#-A INPUT -m conntrack --ctstate INVALID -j DROP
COMMIT
# Completed on Wed Jun 17 05:15:38 2020
# Generated by xtables-save v1.8.2 on Wed Jun 17 05:15:38 2020
*security
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:PREROUTING - [0:0]
:POSTROUTING - [0:0]
-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 80 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 443 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 68 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 67 -j ACCEPT
-A PREROUTING -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
COMMIT
# Completed on Wed Jun 17 05:15:38 2020
# Generated by xtables-save v1.8.2 on Wed Jun 17 05:15:38 2020
*mangle
:PREROUTING DROP [0:0]
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j TOS --set-tos 0x10/0xff
-A OUTPUT -p tcp -m tcp --dport 80 -j TOS --set-tos 0x08/0xff
-A OUTPUT -p tcp -m tcp --dport 443 -j TOS --set-tos 0x08/0xff
-A OUTPUT -p tcp -m tcp --dport 8080 -j TOS --set-tos 0x08/0xff
-A OUTPUT -p tcp -m tcp --dport 21 -j TOS --set-tos 0x08/0xff
-A OUTPUT -p tcp -m tcp --dport 53 -j TOS --set-tos 0x10/0xff
-A OUTPUT -p tcp -m tcp --dport 53 -j TOS --set-tos 0x10/0xff
COMMIT
# Completed on Wed Jun 17 05:15:38 2020
# Generated by xtables-save v1.8.2 on Wed Jun 17 05:15:38 2020
*nat
:PREROUTING DROP [0:0]
:INPUT DROP [0:0]
:POSTROUTING DROP [0:0]
:OUTPUT DROP [0:0]
-A POSTROUTING -o enp3s0f1 -j MASQUERADE
-A POSTROUTING -o ppp+ -j MASQUERADE
-A POSTROUTING -o tun+ -j MASQUERADE
-A POSTROUTING -o wlp2s0 -j MASQUERADE
-A OUTPUT -j ACCEPT
COMMIT
# Completed on Wed Jun 17 05:15:38 2020
# Generated by xtables-save v1.8.2 on Wed Jun 17 05:15:38 2020
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:TCP - [0:0]
:UDP - [0:0]
:ICMP - [0:0]
:ufw-after-forward - [0:0]
:ufw-after-input - [0:0]
:ufw-after-logging-forward - [0:0]
:ufw-after-logging-input - [0:0]
:ufw-after-logging-output - [0:0]
:ufw-after-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-before-input - [0:0]
:ufw-before-logging-forward - [0:0]
:ufw-before-logging-input - [0:0]
:ufw-before-logging-output - [0:0]
:ufw-before-output - [0:0]
:ufw-logging-allow - [0:0]
:ufw-logging-deny - [0:0]
:ufw-not-local - [0:0]
:ufw-reject-forward - [0:0]
:ufw-reject-input - [0:0]
:ufw-reject-output - [0:0]
:ufw-skip-to-policy-forward - [0:0]
:ufw-skip-to-policy-input - [0:0]
:ufw-skip-to-policy-output - [0:0]
:ufw-track-forward - [0:0]
:ufw-track-input - [0:0]
:ufw-track-output - [0:0]
:ufw-user-forward - [0:0]
:ufw-user-input - [0:0]
:ufw-user-limit - [0:0]
:ufw-user-limit-accept - [0:0]
:ufw-user-logging-forward - [0:0]
:ufw-user-logging-input - [0:0]
:ufw-user-logging-output - [0:0]
:ufw-user-output - [0:0]
## method for establishing a new TCP connection
#-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
#-A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
#-A INPUT -p icmp -m conntrack --ctstate NEW -j ICMP
# Reject anything that's fallen through to this point
## Try to be protocol-specific w/ rejection message
#-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
#-A INPUT -p tcp -j REJECT --reject-with tcp-reset
#-A INPUT -j REJECT --reject-with icmp-proto-unreachable
-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -j DROP
-A INPUT -j DROP
-A INPUT -j DROP
-A INPUT -i lo -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A INPUT -p icmp -j DROP
-A INPUT -p icmp -j DROP
-A INPUT -p tcp -m tcp --dport 80 -j DROP
-A INPUT -p tcp -m tcp --dport 443 -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A INPUT -p tcp -m tcp --dport 113 -j DROP
-A INPUT -p udp -m udp -j DROP
-A INPUT -p tcp -m tcp -j DROP
-A INPUT -j DROP
-A INPUT -j DROP
-A INPUT -j DROP
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -j DROP
-A INPUT -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
-A FORWARD -p tcp -m string --string "apollo.archlinux.org" --algo kmp --to 65535 -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
-A OUTPUT -j ACCEPT
-A OUTPUT -o lo -j DROP
-A OUTPUT -p icmp -j DROP
-A OUTPUT -p icmp -j DROP
-A OUTPUT -s 167.99.198.217/32 -j DROP
-A OUTPUT -s 167.99.198.217/32 -j DROP
-A OUTPUT -s 163.53.140.136/32 -j DROP
-A OUTPUT -s 151.101.0.201/32 -j DROP
-A OUTPUT -s 180.211.201.0/24 -p tcp -m tcp --dport 25 -j DROP
-A OUTPUT -p tcp -m string --string "apollo.archlinux.org" --algo kmp --to 65535 -j DROP
-A OUTPUT
-A OUTPUT -j DROP
-A OUTPUT -j DROP
-A OUTPUT -j DROP
-A OUTPUT -j DROP
-A ufw-after-logging-forward -m limit --limit 1/sec --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-after-logging-input -m limit --limit 1/sec --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-logging-allow -m limit --limit 1/sec --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
-A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
-A ufw-logging-deny -m limit --limit 1/sec --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-user-input -p tcp -m tcp --dport 48898 -j DROP
-A ufw-user-input -p tcp -m tcp --dport 4101 -j DROP
-A ufw-user-input -p udp -m udp --dport 4101 -j DROP
-A ufw-user-input -p tcp -m tcp --dport 443 -j DROP
-A ufw-user-input -p udp -m udp --dport 443 -j DROP
-A ufw-user-limit -m limit --limit 1/sec -j LOG --log-prefix "[UFW LIMIT BLOCK] "
-A ufw-user-output -p tcp -m tcp --dport 48898 -j DROP
-A ufw-user-output -p tcp -m tcp --dport 4101 -j DROP
-A ufw-user-output -p udp -m udp --dport 4101 -j DROP
-A ufw-user-output -p tcp -m tcp --dport 443 -j DROP
-A ufw-user-output -p udp -m udp --dport 443 -j DROP
COMMIT
# Completed on Wed Jun 17 05:15:38 2020