blob: e6a598bb5124f60fec71c096b7786044c545fe48 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
# @sysconfdir@/firewall.d/global.d/rules
#
# Global Organization IPv4/IPv6 Firewall Rules for Linux Servers
#
# THIS FILE IS INTENDED TO CONTAIN FIREWALL RULES PUSHED OUT FROM A
# CENTRALIZED LOCATION IN ORDER TO ALLOW AN ORGANIZATION TO CREATE GLOBAL
# FIREWALL RULES ACROSS ALL SYSTEMS.
#
# PLACE HOST SPECIFIC RULES IN ONE OF THE FOLLOWING FILES:
# @sysconfdir@/firewall.d/ipsets
# @sysconfdir@/firewall.d/rules
# @sysconfdir@/firewall.d/rules4
# @sysconfdir@/firewall.d/rules6
#
##############################
# #
# FILTER Table (IPv4/IPv6) #
# #
##############################
*filter
# set default policies
:INPUT DROP
:FORWARD DROP
:OUTPUT ACCEPT
# allow all local host traffic
-I INPUT -i lo -j ACCEPT
# drop black hole traffic
-I INPUT -m set --match-set BLACKHOLE src -j DROP
-I INPUT -m set --match-set BLACKHOLE src \
-m limit --limit 1/minute \
-j LOG --log-level 7 --log-prefix "iptables blackhole: "
# reject ident lookups (fixes delays when connecting to misconfigured hosts)
-A INPUT -m set --match-set PRIVATE src \
-p tcp --dport ident \
-j REJECT --reject-with tcp-reset
# allow established connections
-I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# allow local networks to access services
-A INPUT -m set --match-set PRIVATE src -p tcp --dport ssh -j ACCEPT
-A INPUT -m set --match-set PRIVATE src -p tcp --dport domain -j ACCEPT
-A INPUT -m set --match-set PRIVATE src -p udp --dport domain -j ACCEPT
# log everything else
-A INPUT -m limit --limit 10/minute -j LOG --log-level 7 --log-prefix "iptables drop input: "
# blackhole filter misses
-A INPUT -m set ! --match-set DYNAMIC_EXEMPTION src -j SET --add-set DYNAMIC_BLACKHOLE src
COMMIT
###########################
# #
# RAW Table (IPv4/IPv6) #
# #
###########################
*raw
# exclude local host traffic from conntrack
-I PREROUTING -i lo -j NOTRACK
-I OUTPUT -o lo -j NOTRACK
COMMIT
# end of rules
|
