I want a more secure iptables firewall. but whenever I try to make it more secure... I lose internet access somewhere (depending on what I'm securing) this is my Current script It's undergoing major modifications so if anyone has suggestions. if I put > in front of something that means that, that rule has to go.
<br><br>iptables -F<br><br><br># Policies<br>iptables -P INPUT DROP<br>iptables -P FORWARD DROP<br>iptables -P OUTPUT ACCEPT<br><br># Input Policy<br>iptables -A INPUT -i lo -j ACCEPT<br><br>iptables -A INPUT -p tcp --syn -m limit --limit 5/s -i eth0 -j ACCEPT
<br>iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT<br>>iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # I don't want to allow this on all ports<br>iptables -A INPUT -p tcp --dport 80 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
<br>iptables -A INPUT -p udp --dport 80 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT<br>iptables -A INPUT -p tcp --dport 443 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT<br>iptables -A INPUT -p tcp --dport 22 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
<br>iptables -A INPUT -p tcp --dport 1863 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT<br>iptables -A INPUT -p tcp --dport 5050 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT<br>iptables -A INPUT -p tcp --dport 5190 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
<br>iptables -A INPUT -p tcp --dport 6667 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT<br>iptables -A INPUT -m state --state INVALID -j DROP<br>iptables -A INPUT -p tcp -i eth0 -j REJECT --reject-with tcp-reset<br>iptables -A INPUT -p udp -i eth0 -j REJECT --reject-with icmp-port-unreachable
<br><br><br># Forward Policy<br>iptables -A FORWARD -p tcp --syn -m limit --limit 5/s -i eth0 -j ACCEPT<br>iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT<br>iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
<br>iptables -A FORWARD -p tcp --dport 80 -m state --state NEW -j ACCEPT<br>iptables -A FORWARD -p tcp --dport 443 -m state --state NEW -j ACCEPT<br>iptables -A FORWARD -m state --state INVALID -j DROP<br>>iptables -A FORWARD -j ACCEPT #not secure at all but I can't get it to work without this.
<br><br>that's it can any one help?<br>