diff options
author | Jan Wagner <mail@jwagner.eu> | 2016-03-06 10:55:03 +0100 |
---|---|---|
committer | Jan Wagner <mail@jwagner.eu> | 2016-03-06 10:55:03 +0100 |
commit | 58eaf5383a31138af369e2fbe29fdff8b4857306 (patch) | |
tree | 50065ae7e80e37d1ea303c36b46b4d000e98910a /files/iptables/iptables.rules | |
parent | a03e217233d19052cc24f51e8ed4efcd78c6aafd (diff) | |
parent | c8a035bfc03fabf4384f4e207571d2c81e028b65 (diff) | |
download | rpi2-gen-image-58eaf5383a31138af369e2fbe29fdff8b4857306.tar.gz rpi2-gen-image-58eaf5383a31138af369e2fbe29fdff8b4857306.tar.bz2 rpi2-gen-image-58eaf5383a31138af369e2fbe29fdff8b4857306.zip |
Merge branch 'master' of https://github.com/fpytloun/rpi2-gen-image into fpytloun-master
Diffstat (limited to 'files/iptables/iptables.rules')
-rw-r--r-- | files/iptables/iptables.rules | 43 |
1 files changed, 43 insertions, 0 deletions
diff --git a/files/iptables/iptables.rules b/files/iptables/iptables.rules new file mode 100644 index 0000000..2fc4ca4 --- /dev/null +++ b/files/iptables/iptables.rules @@ -0,0 +1,43 @@ +*filter +:INPUT DROP [0:0] +:FORWARD DROP [0:0] +:OUTPUT ACCEPT [0:0] +:TCP - [0:0] +:UDP - [0:0] +:SSH - [0:0] + +# Rate limit ping requests +-A INPUT -p icmp --icmp-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT +-A INPUT -p icmp --icmp-type echo-request -j DROP + +# Accept established connections +-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + +# Accept all traffic on loopback interface +-A INPUT -i lo -j ACCEPT + +# Drop packets declared invalid +-A INPUT -m conntrack --ctstate INVALID -j DROP + +# SSH rate limiting +-A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH +-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP +-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP +-A SSH -m recent --name sshbf --set -j ACCEPT + +# Send TCP and UDP connections to their respective rules chain +-A INPUT -p udp -m conntrack --ctstate NEW -j UDP +-A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP + +# Reject dropped packets with a RFC compliant responce +-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable +-A INPUT -p tcp -j REJECT --reject-with tcp-rst +-A INPUT -j REJECT --reject-with icmp-proto-unreachable + +## TCP PORT RULES +# -A TCP -p tcp -j LOG + +## UDP PORT RULES +# -A UDP -p udp -j LOG + +COMMIT |