https://github.com/tim0n3/iptables
Firewall rules intended for single hosts (not excluding routers/firewalls)
https://github.com/tim0n3/iptables
iptables iptables-configurations iptables-firewall iptables-rules
Last synced: 12 months ago
JSON representation
Firewall rules intended for single hosts (not excluding routers/firewalls)
- Host: GitHub
- URL: https://github.com/tim0n3/iptables
- Owner: tim0n3
- License: gpl-3.0
- Created: 2021-08-19T08:32:00.000Z (almost 5 years ago)
- Default Branch: main
- Last Pushed: 2023-08-28T17:22:20.000Z (almost 3 years ago)
- Last Synced: 2025-03-03T18:48:33.399Z (over 1 year ago)
- Topics: iptables, iptables-configurations, iptables-firewall, iptables-rules
- Language: Shell
- Homepage:
- Size: 185 KB
- Stars: 2
- Watchers: 1
- Forks: 1
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Security: SECURITY.md
Awesome Lists containing this project
README
# iptables
Firewall rules intended for but not limited to single hosts. (router/firewall)
Function:
Mangle table:
```
Drop (quick) before conntrack, bogus tcp pkts and portscanners
```
Raw table:
```
Allow (quick) before conntrack, tcp pkts that set syn flag and jump to notrack
```
Filter table:
```
Allow (quick) loopback iface traffic
Allow (quick) ESTABLISHED and RELATED traffic
Stateful Packet Inspection filters to drop bogus traffic to ensure only legitimate traffic reaches the host/network.
Opened ports/services
SAFEZONE for whitelisted IP's (requires changing rules in IN_CUSTOMRULES chain to be more meaningful)
```
NAT table:
```
NAT connections destined for VPN clients
```
# Misc:
Logging functionality:
one of the INPUT chain rules logs packets before the default drop rule so in order to filter out the fluff we'll copy the records to a seperate logfile.
## Process:
Create the following file > `/etc/rsyslog.d/iptables.conf`
and use the following to log dropped packets in a seperate file from the syslog file.
```
:msg, contains, "[IPTABLES-BLOCKED]" - /var/log/iptables.log
& ~
```
then restart syslog process (assuming you're on ubuntu/debian) with the following command (as root):
` /etc/init.d/rsyslog restart
`