#!/bin/bash
IPT="/sbin/iptables"
# Server IP
SERVER_IP="$(ip addr show eth0 | grep 'inet ' | cut -f2 | awk '{ print $2}')"
# Your DNS servers you use: cat /etc/resolv.conf
DNS_SERVER="10.1.1.15 10.1.1.8"
# Allow connections to this package servers: cat /etc/apt/sources.list
PACKAGE_SERVER="ftp.us.debian.org security.debian.org"
echo "- flushing iptable rules"
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -t raw -F
$IPT -t raw -X
echo "- setting default policy to 'DROP'"
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP
#
#
# DNS SHOULD ALWAYS COME FIRST
for ip in $DNS_SERVER
do
echo "- allowing dns on port 53 (upd/tcp) to server '$ip'"
$IPT -A OUTPUT -p udp -d $ip --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p udp -s $ip --sport 53 -m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -d $ip --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -s $ip --sport 53 -m state --state ESTABLISHED -j ACCEPT
done
#
# LOOPBACK
echo "- allowing everything on localhost"
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
#
#
# DEBIAN UPDATE SERVERS
for ip in $PACKAGE_SERVER
do
echo "- allow connection to '$ip' on port 21"
$IPT -A OUTPUT -p tcp -d "$ip" --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -s "$ip" --sport 21 -m state --state ESTABLISHED -j ACCEPT
echo "- allow connection to '$ip' on port 80"
$IPT -A OUTPUT -p tcp -d "$ip" --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -s "$ip" --sport 80 -m state --state ESTABLISHED -j ACCEPT
echo "- allow connection to '$ip' on port 443"
$IPT -A OUTPUT -p tcp -d "$ip" --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -s "$ip" --sport 443 -m state --state ESTABLISHED -j ACCEPT
done
#
#
# SERVICE OR SERVER SPECIFIC
echo "- allowing any outbound connectiong to exchange server (email)"
$IPT -A OUTPUT -p tcp -d 10.1.1.17/32 -o eth0 -j ACCEPT # OUTBOUND MAIL TO EXCHANGE
#
# GLOBAL RULES START
echo "- allow connections on 80/443"
$IPT -A INPUT -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED -j ACCEPT
echo "- allow connections on port 21098 (ssh)"
$IPT -A OUTPUT -o eth0 -p tcp --sport 21098 -m state --state ESTABLISHED -j ACCEPT
$IPT -A INPUT -i eth0 -p tcp --dport 21098 -m state --state NEW,ESTABLISHED -j ACCEPT
#echo "- allow icmp ping"
#$IPT -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#$IPT -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT
# log everything else before drop
$IPT -A INPUT -j LOG -m limit --limit 12/min --log-level 4 --log-prefix 'IP INPUT drop: '
$IPT -A INPUT -j DROP
$IPT -A OUTPUT -j LOG -m limit --limit 12/min --log-level 4 --log-prefix 'IP OUTPUT drop: '
$IPT -A OUTPUT -j DROP
echo "- rules created, generating scripts: "
echo " > fw.rules - an export of all of the fw.rules created from this script" && /sbin/iptables-save > fw.rules
echo " > fw.start - start the firewall based on the rules in fw.rules file"
echo $'#!/bin/sh\necho "turning firewall on.."\n/sbin/iptables-restore < fw.rules\niptables -L' > fw.start
echo " > fw.stop - will flush out all iptables rules and accept all traffic"
echo $'#!/bin/sh\necho "stopping the firewall - all traffic is allowed."\nIPT="/sbin/iptables"\n[ ! -x "$IPT" ] && { echo "$0: \"${IPT}\" command not found."; exit 1; }\n$IPT -P INPUT ACCEPT\n$IPT -P FORWARD ACCEPT\n$IPT -P OUTPUT ACCEPT
\n$IPT -F\n$IPT -X\n$IPT -t nat -F\n$IPT -t nat -X\n$IPT -t mangle -F\n$IPT -t mangle -X\n$IPT -t raw -F\n$IPT -t raw -X\n' > fw.stop
echo "- setting permissions to fw.*.."
chmod +x fw.*
echo "_________________________"
echo ""
echo "CURRENT IP TABLES RULES: "
echo "_________________________"
echo "- all done"
exit 0
Source: Nate