Forum Debian Users Gang

#!/bin/sh

IPT=/sbin/iptables
MOD=/sbin/modprobe

# Loading modules
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe xt_multiport

/bin/echo "1" > /proc/sys/net/ipv4/tcp_syncookies
/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
/bin/echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
/bin/echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
/bin/echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
/bin/echo "1" > /proc/sys/net/ipv4/tcp_timestamps

# Cleaning
$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -t mangle -F
$IPT -t mangle -X

# Setting default filter policy
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD DROP

# loopback rules
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

# ICMP (ping, traceroute)
$IPT -A INPUT -p icmp -i eth0 --icmp-type any -j ACCEPT

# Allow FTP connections @ port 21
$IPT -A INPUT  -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT


# Allow Active FTP Connections
$IPT -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT

# Allow Passive FTP Connections
$IPT -A INPUT -p tcp --sport 1024: --dport 1024:65535  -m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp --sport 1024: --dport 1024:65535  -m state --state ESTABLISHED,RELATED -j ACCEPT

# ssh connection
$IPT -A INPUT  -p tcp -i eth0 --dport 22 -s 192.168.1.0/24 -j ACCEPT
$IPT -A INPUT  -p udp -i eth0 --dport 22 -s 192.168.1.0/24 -j ACCEPT

# http,https connection
$IPT -A INPUT  -p tcp -i eth0 -m multiport --dport 80,443 -j ACCEPT
$IPT -A INPUT  -p udp -i eth0 -m multiport --dport 80,443 -j ACCEPT

### log and drop everything else
$IPT -A INPUT -j LOG
$IPT -A FORWARD -j LOG
$IPT -A INPUT -j DROP

Status:    Łączenie z 192.168.1.18:21...
Status:    Połączenie nawiązanie, oczekiwanie na wiadomość powitalną...
Błąd:    Przekroczony czas oczekiwania na połączenie
Błąd:    Nie można połączyć się z serwerem

[...]
Jul 27 10:04:28 host kernel: [ 4951.347769] IN=eth0 OUT= MAC=00:0d:56:c7:8a:4d:00:24:73:de:9a:c1:08:00 SRC=xxx.xxx.xxx.xxx DST=192.168.1.18 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=20222 DF PROTO=TCP SPT=40244 DPT=21 WINDOW=65535 RES=0x00 SYN URGP=0