fir3net
PPS-Firenetbanner-780.5x190-30-03-17

IPTables Template

Below is a basic template for setting up IPTables on a Linux box :

Create LOGDROP CHAIN. Add LOG and DROP to chain.

iptables -N LOGDROP
iptables -A LOGDROP -j LOG --log-level 6
iptables -A LOGDROP -j DROP

Create input and output policies

iptables --policy INPUT DROP
iptables --policy OUTPUT DROP

Add inbound rules

iptables -A INPUT  -m state --state ESTABLISHED,RELATED                 -j ACCEPT
iptables -A INPUT -p icmp                 --icmp-type echo-request     -j ACCEPT
iptables -A INPUT -p tcp                 --dport ssh             -j ACCEPT
iptables -A INPUT -j LOGDROP

Add outbound rules

iptables -A OUTPUT  -m state --state ESTABLISHED,RELATED                 -j ACCEPT
iptables -A OUTPUT -p icmp                 --icmp-type echo-request    -j ACCEPT
iptables -A OUTPUT -p tcp                 --dport 443             -j ACCEPT
iptables -A OUTPUT -p tcp                 --dport 80             -j ACCEPT
iptables -A OUTPUT -p udp                 --dport 53             -j ACCEPT
iptables -A OUTPUT -p udp     -d [syslog server ip]    --dport 514             -j ACCEPT
iptables -A OUTPUT -o lo                                -j ACCEPT
iptables -A OUTPUT -j LOGDROP   

Save Config

iptables-save

About the Author

RDonato

R Donato

Rick Donato is the Founder and Chief Editor of Fir3net.com. He currently works as a Principal Network Security Engineer and has a keen interest in automation and the cloud.

You can find Rick on Twitter @f3lix001