I'd like to basically drop all packets, but still allow port 22, 80 and 52533. At the moment this firewall doesn't allow pinging, or for me to use yum update
. How can I add that? Also, is there an easier way to open port 80? The current rule seems a bit verbose.
#!/bin/sh
#
# Flush all current rules from iptables
#
iptables -F
iptables -t nat -F
#
# Allow SSH connections on tcp port 22
#
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -j ACCEPT
#
# Open port 80
#
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d 209.177.156.154 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s 209.177.156.154 --sport 80 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
#
# Set access for localhost
#
iptables -A INPUT -i lo -j ACCEPT
#
# Accept connections on 1195 for vpn access from client
#
iptables -A INPUT -i eth0 -p udp --dport 1195 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 1195 -m state --state ESTABLISHED -j ACCEPT
#
# Apply forwarding
#
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 209.177.156.154
iptables -A FORWARD -j REJECT
#
# Enable forwarding
#
echo 1 > /proc/sys/net/ipv4/ip_forward
#
# PREROUTE ports
#
iptables -t nat -A PREROUTING -p udp -m multiport --dports 10001:65535 -j REDIRECT --to-ports 52533
#
# Set default policies for INPUT, FORWARD and OUTPUT chains
#
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
#
# IPv6 configuration
#
ip6tables -F INPUT
ip6tables -F FORWARD
ip6tables -F OUTPUT
ip6tables -F
echo -n "1" >/proc/sys/net/ipv6/conf/all/forwarding
echo -n "1" >/proc/sys/net/ipv6/conf/all/proxy_ndp
echo -n "0" >/proc/sys/net/ipv6/conf/all/autoconf
echo -n "0" >/proc/sys/net/ipv6/conf/all/accept_ra
ip6tables -A INPUT -p icmpv6 -j ACCEPT
ip6tables -A FORWARD -m state --state NEW -i tun0 -o eth0 -s 2607:f740:101:f::/64 -j ACCEPT
ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT DROP