iptables

iptables で初期化(iptables -F)しても、ポリシーは最初の状態に戻らないのですね。
少し悩みました。

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

##
#iptables execute
##

# iptables -F
# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination         

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

#!/bin/bash

LANG=C
#
LAN=eth0
#
LOCALNET=192.168.11.0/24
HOMENET=192.168.11.0/24


# iptables clear
iptables -F
iptables -X

# default rule
iptables -P INPUT   DROP   # Input Drop
iptables -P OUTPUT  ACCEPT # Output Accept
iptables -P FORWARD DROP   # Forward Drop

#
iptables -A INPUT -i lo -j ACCEPT

#
iptables -A INPUT -s $LOCALNET -j ACCEPT

#
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#
sysctl -w net.ipv4.tcp_syncookies=1 > /dev/null
sed -i '/net.ipv4.tcp_syncookies/d' /etc/sysctl.conf
echo "net.ipv4.tcp_syncookies=1" >> /etc/sysctl.conf

#
#
sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1 > /dev/null
sed -i '/net.ipv4.icmp_echo_ignore_broadcasts/d' /etc/sysctl.conf
echo "net.ipv4.icmp_echo_ignore_broadcasts=1" >> /etc/sysctl.conf

#
sed -i '/net.ipv4.conf.*.accept_redirects/d' /etc/sysctl.conf
for dev in `ls /proc/sys/net/ipv4/conf/`
do
    sysctl -w net.ipv4.conf.$dev.accept_redirects=0 > /dev/null
    echo "net.ipv4.conf.$dev.accept_redirects=0" >> /etc/sysctl.conf
done

#
sed -i '/net.ipv4.conf.*.accept_source_route/d' /etc/sysctl.conf
for dev in `ls /proc/sys/net/ipv4/conf/`
do
    sysctl -w net.ipv4.conf.$dev.accept_source_route=0 > /dev/null
    echo "net.ipv4.conf.$dev.accept_source_route=0" >> /etc/sysctl.conf
done

# fragment
iptables -A INPUT -f -j LOG --log-prefix '[IPTABLES FRAGMENT] : '
iptables -A INPUT -f -j DROP

# NetBIOS
iptables -A INPUT ! -s $LOCALNET -p tcp -m multiport --dports 135,137,138,139,445 -j DROP
iptables -A INPUT ! -s $LOCALNET -p udp -m multiport --dports 135,137,138,139,445 -j DROP
iptables -A OUTPUT ! -d $LOCALNET -p tcp -m multiport --sports 135,137,138,139,445 -j DROP
iptables -A OUTPUT ! -d $LOCALNET -p udp -m multiport --sports 135,137,138,139,445 -j DROP

# Ping of Death
iptables -N LOG_PINGDEATH
iptables -A LOG_PINGDEATH -m limit --limit 1/s --limit-burst 4 -j ACCEPT
iptables -A LOG_PINGDEATH -j LOG --log-prefix '[IPTABLES PINGDEATH] : '
iptables -A LOG_PINGDEATH -j DROP
iptables -A INPUT -p icmp --icmp-type echo-request -j LOG_PINGDEATH

# 
iptables -A INPUT -d 255.255.255.255 -j DROP
iptables -A INPUT -d 224.0.0.1 -j DROP

# ident.113
iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset

#
#
#

# ssh.22
iptables -A INPUT  -p tcp -m state --state NEW -s $HOMENET --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp -m state --state NEW -d $HOMENET --dport 22 -j ACCEPT
iptables -A INPUT  -p tcp -m state --state NEW -s 172.27.61.0/255.255.255.0 --dport 22 -j ACCEPT

#
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name ssh_attack
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 180 --hitcount 5 --rttl --name ssh_attack -j LOG --log-prefix 'SSH attack: '
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 180 --hitcount 5 --rttl --name ssh_attack -j DROP

# dns.tcp.udp.53
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT

# http.80
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# https.443
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# http.8080
iptables -A INPUT -p tcp --dport 8080 -j ACCEPT

# ftp.21
iptables -A INPUT -p tcp --dport 21 -j ACCEPT

# ftp
iptables -A INPUT -p tcp --dport 60000:60030 -j ACCEPT

# smtp.25
iptables -A INPUT -p tcp --dport 25 -j ACCEPT

# ssmtp.465
iptables -A INPUT -p tcp --dport 465 -j ACCEPT

# pop3.110
iptables -A INPUT -p tcp --dport 110 -j ACCEPT

# pop3s.995
iptables -A INPUT -p tcp --dport 995 -j ACCEPT

# imap.143
iptables -A INPUT -p tcp --dport 143 -j ACCEPT

# imaps.993
iptables -A INPUT -p tcp --dport 993 -j ACCEPT

#
iptables -A INPUT -m limit --limit 1/s -j LOG --log-prefix '[IPTABLES INPUT] : '
iptables -A INPUT -j DROP
iptables -A FORWARD -m limit --limit 1/s -j LOG --log-prefix '[IPTABLES FORWARD] : '
iptables -A FORWARD -j DROP

#

iptables -L が遅い場合は
iptables -nL

情報元
http://www.aconus.com/~oyaji/security/iptables.htm
http://fedorasrv.com/iptables.shtml
http://d.hatena.ne.jp/Ubuntu/20080128/1201462048
http://tobysoft.net/wiki/index.php?Ubuntu%2Fiptables(firewall)

http://cyberlib.enterbrainz.com/1177122736.html