mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
104 lines
4.1 KiB
Bash
104 lines
4.1 KiB
Bash
#!/bin/bash
|
|
# iptables Firewall Rules Template
|
|
# Customize and apply with: bash iptables-rules.sh
|
|
|
|
set -euo pipefail
|
|
|
|
# Flush existing rules
|
|
iptables -F
|
|
iptables -X
|
|
iptables -t nat -F
|
|
iptables -t nat -X
|
|
|
|
# Set default policies
|
|
iptables -P INPUT DROP
|
|
iptables -P FORWARD DROP
|
|
iptables -P OUTPUT ACCEPT
|
|
|
|
#------------------------------------------------------------------------------
|
|
# LOOPBACK
|
|
#------------------------------------------------------------------------------
|
|
iptables -A INPUT -i lo -j ACCEPT
|
|
iptables -A OUTPUT -o lo -j ACCEPT
|
|
|
|
#------------------------------------------------------------------------------
|
|
# ESTABLISHED CONNECTIONS
|
|
#------------------------------------------------------------------------------
|
|
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
|
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
#------------------------------------------------------------------------------
|
|
# INVALID PACKETS
|
|
#------------------------------------------------------------------------------
|
|
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
|
|
|
|
#------------------------------------------------------------------------------
|
|
# ICMP (Ping)
|
|
#------------------------------------------------------------------------------
|
|
# Allow ping (optional - comment out to disable)
|
|
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
|
|
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
|
|
|
|
#------------------------------------------------------------------------------
|
|
# SSH (Rate Limited)
|
|
#------------------------------------------------------------------------------
|
|
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name SSH
|
|
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP
|
|
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
|
|
|
#------------------------------------------------------------------------------
|
|
# WEB SERVICES (Uncomment as needed)
|
|
#------------------------------------------------------------------------------
|
|
# HTTP
|
|
# iptables -A INPUT -p tcp --dport 80 -j ACCEPT
|
|
|
|
# HTTPS
|
|
# iptables -A INPUT -p tcp --dport 443 -j ACCEPT
|
|
|
|
#------------------------------------------------------------------------------
|
|
# APPLICATION PORTS (Customize)
|
|
#------------------------------------------------------------------------------
|
|
# Application (example: 8080)
|
|
# iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
|
|
|
|
# From specific network only
|
|
# iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 8080 -j ACCEPT
|
|
|
|
#------------------------------------------------------------------------------
|
|
# DATABASE (Internal Only)
|
|
#------------------------------------------------------------------------------
|
|
# PostgreSQL from internal network
|
|
# iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 5432 -j ACCEPT
|
|
|
|
# MySQL from internal network
|
|
# iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 3306 -j ACCEPT
|
|
|
|
#------------------------------------------------------------------------------
|
|
# MONITORING
|
|
#------------------------------------------------------------------------------
|
|
# Prometheus metrics
|
|
# iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 9090 -j ACCEPT
|
|
|
|
# Node exporter
|
|
# iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 9100 -j ACCEPT
|
|
|
|
#------------------------------------------------------------------------------
|
|
# LOGGING
|
|
#------------------------------------------------------------------------------
|
|
# Log dropped packets (before final DROP)
|
|
iptables -A INPUT -j LOG --log-prefix "iptables-dropped: " --log-level 4 -m limit --limit 5/min
|
|
|
|
#------------------------------------------------------------------------------
|
|
# FINAL DROP (Implicit with policy, but explicit for clarity)
|
|
#------------------------------------------------------------------------------
|
|
iptables -A INPUT -j DROP
|
|
|
|
#------------------------------------------------------------------------------
|
|
# SAVE RULES
|
|
#------------------------------------------------------------------------------
|
|
echo "Saving rules..."
|
|
iptables-save > /etc/iptables/rules.v4 2>/dev/null || iptables-save > /tmp/iptables-rules.v4
|
|
|
|
echo "Firewall configured successfully!"
|
|
iptables -L -n -v
|