Skip to content

Instantly share code, notes, and snippets.

@andrewlkho

andrewlkho/rules.v4

Last active October 24, 2018 14:41
Download ZIP

Revisions

  1. andrewlkho revised this gist Nov 22, 2016. 3 changed files with 38 additions and 1 deletion.
    1 change: 0 additions & 1 deletion gistfile1.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -1 +0,0 @@
    .
    19 changes: 19 additions & 0 deletions rules.v4
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,19 @@
    *filter

    :INPUT DROP [0:0]
    :FORWARD DROP [0:0]
    :OUTPUT ACCEPT [0:0]

    # Boilerplate acceptance policy
    -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    -A INPUT -i lo -j ACCEPT

    # Drop invalid packets
    -A INPUT -m conntrack --ctstate INVALID -j DROP

    # SSH (SYN is the only valid method for establishing a new TCP connection)
    -A INPUT -p tcp --syn -m conntrack --ctstate NEW --dport 22 -j ACCEPT

    # ICMP
    -A INPUT -p icmp -m conntrack --ctstate new -j ACCEPT
    COMMIT
    19 changes: 19 additions & 0 deletions rules.v6
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,19 @@
    *filter

    :INPUT DROP [0:0]
    :FORWARD DROP [0:0]
    :OUTPUT ACCEPT [0:0]

    # Boilerplate acceptance policy
    -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    -A INPUT -i lo -j ACCEPT

    # Drop invalid packets
    -A INPUT -m conntrack --ctstate INVALID -j DROP

    # SSH (SYN is the only valid method for establishing a new TCP connection)
    -A INPUT -p tcp --syn -m conntrack --ctstate NEW --dport 22 -j ACCEPT

    # ICMP
    -A INPUT -p ipv6-icmp -j ACCEPT
    COMMIT
  2. andrewlkho created this gist Nov 22, 2016.
    1 change: 1 addition & 0 deletions gistfile1.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1 @@
    .