Skip to content

Instantly share code, notes, and snippets.

@cutmail

cutmail/setiptables.sh

Forked from tadasy/setiptables.sh
Created October 12, 2013 10:36
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save cutmail/6948492 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save cutmail/6948492 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @tadasy tadasy revised this gist Mar 6, 2013. No changes.
  2. @tadasy tadasy revised this gist Mar 6, 2013. No changes.
  3. @tadasy tadasy revised this gist Mar 6, 2013. No changes.
  4. @tadasy tadasy revised this gist Mar 6, 2013. No changes.
  5. @tadasy tadasy created this gist Mar 6, 2013.
    42 changes: 42 additions & 0 deletions setiptables.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,42 @@
    #!/bin/bash

    # フィルタリングルールを消去する
    /sbin/iptables -F

    # デフォルトポリシーを設定
    /sbin/iptables -P INPUT DROP
    /sbin/iptables -P FORWARD DROP
    /sbin/iptables -P OUTPUT DROP

    # ループバックを許可する
    /sbin/iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
    /sbin/iptables -A OUTPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT

    # プライベートアドレスが使われているパケットを破棄
    /sbin/iptables -A INPUT -i eth0 -s 10.0.0.0/8 -j DROP
    /sbin/iptables -A INPUT -i eth0 -d 10.0.0.0/8 -j DROP
    /sbin/iptables -A INPUT -i eth0 -s 172.16.0.0/12 -j DROP
    /sbin/iptables -A INPUT -i eth0 -d 172.16.0.0/12 -j DROP
    /sbin/iptables -A INPUT -i eth0 -s 192.168.0.0/16 -j DROP
    /sbin/iptables -A INPUT -i eth0 -d 192.168.0.0/16 -j DROP

    # 基本サービスを許可, SSH(portは内緒) HTTP HTTPS
    /sbin/iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport XXXXX -j ACCEPT
    /sbin/iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
    /sbin/iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT

    # すでにコネクションを確立しているものは許可
    /sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

    # Ping of Death対策
    /sbin/iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

    # 外への接続は全て許可
    /sbin/iptables -P OUTPUT ACCEPT

    # 保存 + iptables再起動
    /etc/init.d/iptables save
    /etc/init.d/iptables restart

    # 設定が適用されているか確認
    /sbin/iptables -L