Lockdown IP tables

#!/bin/bash

IPT="/sbin/iptables"

# Server IP

SERVER_IP="$(ip addr show eth0 | grep 'inet ' | cut -f2 | awk '{ print $2}')"

# Your DNS servers you use: cat /etc/resolv.conf

DNS_SERVER="10.1.1.15 10.1.1.8"

# Allow connections to this package servers: cat /etc/apt/sources.list

PACKAGE_SERVER="ftp.us.debian.org security.debian.org"

echo "- flushing iptable rules"

$IPT -P INPUT ACCEPT

$IPT -P FORWARD ACCEPT

$IPT -P OUTPUT ACCEPT

$IPT -F

$IPT -X

$IPT -t nat -F

$IPT -t nat -X

$IPT -t mangle -F

$IPT -t mangle -X

$IPT -t raw -F

$IPT -t raw -X

echo "- setting default policy to 'DROP'"

$IPT -P INPUT   DROP

$IPT -P FORWARD DROP

$IPT -P OUTPUT  DROP

#

#

# DNS SHOULD ALWAYS COME FIRST

for ip in $DNS_SERVER

do

        echo "- allowing dns on port 53 (upd/tcp) to server '$ip'"

        $IPT -A OUTPUT -p udp -d $ip --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT

        $IPT -A INPUT  -p udp -s $ip --sport 53 -m state --state ESTABLISHED     -j ACCEPT

        $IPT -A OUTPUT -p tcp -d $ip --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT

        $IPT -A INPUT  -p tcp -s $ip --sport 53 -m state --state ESTABLISHED     -j ACCEPT

done

#

# LOOPBACK

echo "- allowing everything on localhost"

$IPT -A INPUT -i lo -j ACCEPT

$IPT -A OUTPUT -o lo -j ACCEPT

#

#

# DEBIAN UPDATE SERVERS

for ip in $PACKAGE_SERVER

do

        echo "- allow connection to '$ip' on port 21"

        $IPT -A OUTPUT -p tcp -d "$ip" --dport 21  -m state --state NEW,ESTABLISHED -j ACCEPT

        $IPT -A INPUT  -p tcp -s "$ip" --sport 21  -m state --state ESTABLISHED     -j ACCEPT

        echo "- allow connection to '$ip' on port 80"

        $IPT -A OUTPUT -p tcp -d "$ip" --dport 80  -m state --state NEW,ESTABLISHED -j ACCEPT

        $IPT -A INPUT  -p tcp -s "$ip" --sport 80  -m state --state ESTABLISHED     -j ACCEPT

        echo "- allow connection to '$ip' on port 443"

        $IPT -A OUTPUT -p tcp -d "$ip" --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT

        $IPT -A INPUT  -p tcp -s "$ip" --sport 443 -m state --state ESTABLISHED     -j ACCEPT

done

#

#

# SERVICE OR SERVER SPECIFIC

echo "- allowing any outbound connectiong to exchange server (email)"

$IPT -A OUTPUT -p tcp -d 10.1.1.17/32 -o eth0 -j ACCEPT # OUTBOUND MAIL TO EXCHANGE

#

# GLOBAL RULES START

echo "- allow connections on 80/443"

$IPT -A INPUT  -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT

$IPT -A OUTPUT -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED     -j ACCEPT

echo "- allow connections on port 21098 (ssh)"

$IPT -A OUTPUT -o eth0 -p tcp --sport 21098 -m state --state ESTABLISHED -j ACCEPT

$IPT -A INPUT  -i eth0 -p tcp --dport 21098 -m state --state NEW,ESTABLISHED -j ACCEPT

#echo "- allow icmp ping"

#$IPT -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

#$IPT -A INPUT  -p icmp -m state --state ESTABLISHED,RELATED     -j ACCEPT

# log everything else before drop

$IPT -A INPUT  -j LOG  -m limit --limit 12/min --log-level 4 --log-prefix 'IP INPUT drop: '

$IPT -A INPUT  -j DROP

$IPT -A OUTPUT -j LOG  -m limit --limit 12/min --log-level 4 --log-prefix 'IP OUTPUT drop: '

$IPT -A OUTPUT -j DROP

echo "- rules created, generating scripts: "

echo "    > fw.rules - an export of all of the fw.rules created from this script" && /sbin/iptables-save > fw.rules

echo "    > fw.start - start the firewall based on the rules in fw.rules file"

echo $'#!/bin/sh\necho "turning firewall on.."\n/sbin/iptables-restore < fw.rules\niptables -L' > fw.start

echo "    > fw.stop - will flush out all iptables rules and accept all traffic"

echo $'#!/bin/sh\necho "stopping the firewall - all traffic is allowed."\nIPT="/sbin/iptables"\n[ ! -x "$IPT" ] && { echo "$0: \"${IPT}\" command not found."; exit 1; }\n$IPT -P INPUT ACCEPT\n$IPT -P FORWARD ACCEPT\n$IPT -P OUTPUT ACCEPT

\n$IPT -F\n$IPT -X\n$IPT -t nat -F\n$IPT -t nat -X\n$IPT -t mangle -F\n$IPT -t mangle -X\n$IPT -t raw -F\n$IPT -t raw -X\n' > fw.stop

echo "- setting permissions to fw.*.."

chmod +x fw.*

echo "_________________________"

echo ""

echo "CURRENT IP TABLES RULES: "

echo "_________________________"

echo "- all done"

exit 0

 Source: Nate