LinuxQuestions.org - Iptables help

Eric's firewall generator is very good, but I tend to view it as a little bit of overkill for a simple workstation setup.

This is what I use on my workstation.

/etc/rc.d/rc.firewall:

Code:

#!/bin/sh



IPT='/usr/sbin/iptables'

MODPROBE="/sbin/modprobe"



########################################################################

#  Load FTP connection tracking helper modules

#    (needed for proper operation of ftp client connections)



$MODPROBE nf_conntrack 

$MODPROBE nf_conntrack_ftp 





########################################################################

#  Set default policies for packets that get to the end of a chain

#  without matching a rule.



#  DROP packets on reaching end of INPUT, FORWARD and OUTPUT chain

#  (a.k.a "Better safe than sorry" mode)



$IPT -P INPUT DROP

$IPT -P FORWARD DROP

$IPT -P OUTPUT DROP



#  These next ones aren't strictly necessary as we're not using these

#  chains, but setting them to a known state is never a bad idea.



$IPT -t nat -P PREROUTING ACCEPT

$IPT -t nat -P POSTROUTING ACCEPT

$IPT -t nat -P OUTPUT ACCEPT



$IPT -t mangle -P PREROUTING ACCEPT

$IPT -t mangle -P INPUT ACCEPT

$IPT -t mangle -P FORWARD ACCEPT

$IPT -t mangle -P OUTPUT ACCEPT

$IPT -t mangle -P POSTROUTING ACCEPT



# $IPT -t raw -P PREROUTING ACCEPT

# $IPT -t raw -P OUTPUT ACCEPT





########################################################################

#  Flush any existing rules and chains

#    



$IPT -F

$IPT -F -t nat

$IPT -F -t mangle

# $IPT -F -t raw



$IPT -X

$IPT -X -t nat

$IPT -X -t mangle

# $IPT -X -t raw



########################################################################



########################################################################

#  Now insert our own ruleset

#    



#  INPUT CHAIN



$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT



$IPT -A INPUT -i lo -j ACCEPT



#  Example of opening up ports to new incoming connections

#  $IPT -A INPUT -p tcp -i eth0 -m multiport --dports 21,22,25,80,443 \

#  --syn -m state --state NEW -j ACCEPT





#  OUTPUT CHAIN



$IPT -A OUTPUT -j ACCEPT



########################################################################

It doesn't block any outgoing connections, only incoming ones but that should be sufficient for a standalone/workstation type of machine.