edwin
/
do-bastion
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Add 'iptables/rules.v4'

Browse Source
master
Edwin Lyon 2 years ago
parent d8b2e6f5c5
commit 1392661980
1 changed files with 60 additions and 0 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 60
      iptables/rules.v4

60
iptables/rules.v4
Unescape View File

@ -0,0 +1,60 @@
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i eth0 -d {PUBLIC_IP} -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.128.0.3:80
-A PREROUTING -i eth0 -d {PUBLIC_IP} -p tcp -m tcp --dport 443 -j DNAT --to-destination 10.128.0.3:443
-A POSTROUTING -d 10.128.0.3 -o eth1 -p tcp -m tcp --dport 80 -j SNAT --to-source 10.128.0.2
-A POSTROUTING -d 10.128.0.3 -o eth1 -p tcp -m tcp --dport 443 -j SNAT --to-source 10.128.0.2
-A POSTROUTING -s 10.128.0.2 -o eth0 -j SNAT --to-source {PUBLIC_IP}
-A POSTROUTING -s 10.128.0.0/20 ! -d 10.128.0.0/20 -j MASQUERADE
COMMIT
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:FILTERS - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 5/sec -j ACCEPT
-A INPUT -i eth1 -m conntrack --ctstate NEW -s 10.128.0.0/20 -j ACCEPT
-A INPUT -j FILTERS
-A INPUT -j DROP
-A FORWARD -o eth1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth1 -o eth1 -m conntrack --ctstate NEW -s 10.128.0.0/20 -j ACCEPT
-A FORWARD -o eth0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth1 -o eth0 -m conntrack --ctstate NEW -s 10.128.0.0/20 -j ACCEPT
-A FORWARD -i eth0 -o eth1 -j FILTERS
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o eth0 -j ACCEPT
-A OUTPUT -o eth1 -j ACCEPT
-A FILTERS -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FILTERS -p tcp -m conntrack --ctstate NEW -m tcp --syn --dport 22 -j ACCEPT
-A FILTERS -p tcp -m conntrack --ctstate NEW -m tcp --syn --dport 80 -j ACCEPT
-A FILTERS -p tcp -m conntrack --ctstate NEW -m tcp --syn --dport 443 -j ACCEPT
-A FILTERS -p udp -m conntrack --ctstate NEW -m udp --dport 51820 -j ACCEPT
-A FILTERS -p udp -m conntrack --ctstate NEW -m udp --dport 51821 -j ACCEPT
-A FILTERS -p tcp -m conntrack --ctstate NEW,RELATED,ESTABLISHED -m tcp --syn --dport 1719 -j REJECT
-A FILTERS -p tcp -m conntrack --ctstate NEW,RELATED,ESTABLISHED -m tcp --syn --dport 1720 -j REJECT
-A FILTERS -p tcp -m conntrack --ctstate NEW,RELATED,ESTABLISHED -m tcp --syn --dport 1723 -j REJECT
-A FILTERS -p tcp -m conntrack --ctstate NEW,RELATED,ESTABLISHED -m tcp --syn --dport 5060 -j REJECT
-A FILTERS -p tcp -m conntrack --ctstate NEW,RELATED,ESTABLISHED -m tcp --syn --dport 5061 -j REJECT
-A FILTERS -p tcp -m conntrack --ctstate NEW,RELATED,ESTABLISHED -m tcp --syn --dport 6566 -j REJECT
-A FILTERS -p tcp -m conntrack --ctstate NEW,RELATED,ESTABLISHED -m tcp --syn --dport 8080 -j REJECT
-A FILTERS -p tcp -m conntrack --ctstate NEW,RELATED,ESTABLISHED -m tcp --syn --dport 8443 -j REJECT
-A FILTERS -p tcp -m conntrack --ctstate NEW,RELATED,ESTABLISHED -m tcp --syn --dport 8880 -j REJECT
-A FILTERS -p tcp -m conntrack --ctstate NEW,RELATED,ESTABLISHED -m tcp --syn --dport 10080 -j REJECT
-A FILTERS -m conntrack --ctstate INVALID -j DROP
-A FILTERS -j REJECT
COMMIT
Write Preview
Loading…
Cancel
Save