hmm.. da jeg smed dette ind og genstartede iptables gik netværket ud til mine client computer døde.. de kunne ikke bruge internettet:
sådan her ser den ud:# Created: Sun Sep 5 10:15:29 2004
# By :
LinWiz://ServerFirewall, 1.09
# URL :
http://www.lowth.com/LinWiz/1.09#
# This file is provided under the terms of the GNU General Public
# License which governs your rights to use and redistribute it, and
# highlights the fact that it is provided with NO WARRANTY what so ever.
# The full text of the license can be viewed on line at ..
#
http://www.lowth.com/LinWiz/1.09/COPYING.txt# Do not use this file if you disagree with these terms.
#
#
# This facility is available free of charge. If you have found it
# useful, please consider helping to keep it free by using the
#
www.lowth.com website as your gateway to Amazon.com or Amazon.co.uk
# when you buy books, music, computers etc from them. This costs you
# nothing extra - but Amazon pays Lowth.com a small commission on any
# purchases you make via this route. This goes to help funding the
# continued development of LinWiz and related tools.
#
# Please use the following links to get to the Amazon site
#
#
http://www.lowth.com/LinWiz/us-shop (USA and Canadian purchases)
#
http://www.lowth.com/LinWiz/uk-shop (UK and European)
#
# If you live elsewhere - just choose the one nearest to you.
# Thank You
IPTABLES=/sbin/iptables
# Flush, Init and Zero the 'built-in' chains
$IPTABLES -F INPUT; $IPTABLES -P INPUT ACCEPT; $IPTABLES -Z INPUT
$IPTABLES -F FORWARD; $IPTABLES -P FORWARD ACCEPT; $IPTABLES -Z FORWARD
$IPTABLES -F OUTPUT; $IPTABLES -P OUTPUT ACCEPT; $IPTABLES -Z OUTPUT
# Setup user-defined chains
$IPTABLES -X
$IPTABLES -N ADDRESS-FILTER;
$IPTABLES -N LINWIZ-INPUT;
$IPTABLES -N REJECT-PKT;
$IPTABLES -N SYN-FLOOD;
$IPTABLES -A INPUT -j LINWIZ-INPUT
######################################################################
# Allow all loopback interface traffic
$IPTABLES -A LINWIZ-INPUT -i lo -j ACCEPT
# Block all attempts to spoof the loopback address
$IPTABLES -A LINWIZ-INPUT -s 127.0.0.0/8 -j DROP
$IPTABLES -A LINWIZ-INPUT -d 127.0.0.0/8 -j DROP
# Block all attempts to spoof the local IP address
$IPTABLES -A LINWIZ-INPUT -s 80.196.247.167 -j DROP
# Block Syn Flood attacks
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --syn -j SYN-FLOOD
# Ensure that TCP connections start with syn packets
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp ! --syn -m state --state NEW -j DROP
# Allow session continuation traffic
$IPTABLES -A LINWIZ-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow ICMP ping requests from all hosts
$IPTABLES -A LINWIZ-INPUT -p icmp -m icmp --icmp-type ping -j ACCEPT
# Call the IP and MAC address filtering chain
$IPTABLES -A LINWIZ-INPUT -j ADDRESS-FILTER
# Allow selected TCP/IP and/or UDP services
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 20:22 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 25 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 80 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 110 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 139 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 161 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 194 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 389 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 411 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 443 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 465 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 515 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 636 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 994:995 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 1512 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p tcp -m tcp --dport 6000:6002 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p udp -m udp --dport 53 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p udp -m udp --dport 123 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p udp -m udp --dport 137:138 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p udp -m udp --dport 161:162 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p udp -m udp --dport 177 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p udp -m udp --dport 411 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p udp -m udp --dport 1512 -j ACCEPT
$IPTABLES -A LINWIZ-INPUT -p udp -m udp --sport 137:138 -j ACCEPT
# Block all other TCP/IP and UDP traffic
$IPTABLES -A LINWIZ-INPUT -j REJECT-PKT
######################################################################
# Syn flood filtering chain
$IPTABLES -A SYN-FLOOD -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A SYN-FLOOD -j DROP
######################################################################
# Chain used to reject all TCP/IP, UDP and ICMP/PING packets
$IPTABLES -A REJECT-PKT -p tcp -m tcp -j REJECT --reject-with tcp-reset
$IPTABLES -A REJECT-PKT -p udp -m udp -j REJECT --reject-with icmp-port-unreachable
$IPTABLES -A REJECT-PKT -p icmp -m icmp --icmp-type ping -j REJECT --reject-with icmp-host-unreachable
######################################################################
# IP and MAC address filtering chain
$IPTABLES -A ADDRESS-FILTER -s 192.168.0.1 -j RETURN
$IPTABLES -A ADDRESS-FILTER -s 192.168.0.2 -j RETURN
$IPTABLES -A ADDRESS-FILTER -s 192.168.0.3 -j RETURN
$IPTABLES -A ADDRESS-FILTER -s 192.168.0.4 -j RETURN
$IPTABLES -A ADDRESS-FILTER -s 192.168.0.5 -j RETURN
$IPTABLES -A ADDRESS-FILTER -s 192.168.0.6 -j RETURN
$IPTABLES -A ADDRESS-FILTER -s 192.168.0.7 -j RETURN
$IPTABLES -A ADDRESS-FILTER -s 192.168.0.8 -j RETURN
$IPTABLES -A ADDRESS-FILTER -s 192.168.0.9 -j RETURN
$IPTABLES -A ADDRESS-FILTER -j REJECT-PKT
