91 lines
3.7 KiB
Bash
Executable File
91 lines
3.7 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
## These variables make setting up NAT easier, just uncomment the NAT sections
|
|
## below
|
|
PUBLIC_INTERFACE=
|
|
LAN_INTERFACE=
|
|
JFW_LOG_4='-j LOG --log-prefix "[ JFW IPv4 DROP ]"'
|
|
JFW_LOG_6='-j LOG --log-prefix "[ JFW IPv6 DROP ]"'
|
|
|
|
|
|
|
|
|
|
|
|
#########
|
|
# IPv4 #
|
|
#########
|
|
|
|
##======== General required =======##
|
|
iptables -A INPUT -i lo -m conntrack --ctstate NEW -j ACCEPT ## Loop device
|
|
iptables -A INPUT -p icmp -m conntrack --ctstate NEW -j ACCEPT ## ICMP, e.g. ping
|
|
iptables -A INPUT -p ALL -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT ## Existing and related to outgoing
|
|
|
|
##============= NAT ===============##
|
|
# iptables -A FORWARD -i $LAN_INTERFACE -o $PUBLIC_INTERFACE -m conntrack --ctstate NEW -j ACCEPT
|
|
# iptables -A FORWARD -p ALL -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
|
# iptables -t nat -A POSTROUTING -i $LAN_INTERFACE -o $PUBLIC_INTERFACE -j MASQUERADE
|
|
|
|
##============ Public =============##
|
|
# iptables -A INPUT -i $PUBLIC_INTERFACE -p tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT
|
|
# iptables -A INPUT -i $PUBLIC_INTERFACE -p tcp --dport 443 -m conntrack --ctstate NEW -j ACCEPT
|
|
iptables -A INPUT -i $PUBLIC_INTERFACE -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
|
|
|
|
##============= LAN ===============##
|
|
iptables -A INPUT -i enp4s0 -m conntrack --ctstate NEW -j ACCEPT
|
|
# iptables -A INPUT -i enp4s0 -p ALL -d 224.0.0.1 -m conntrack --ctstate NEW -j ACCEPT
|
|
# iptables -A INPUT -i enp4s0 -p udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT ## MDNS
|
|
|
|
##============ Logging ============##
|
|
# iptables -A INPUT -p ALL $JFW_LOG_4
|
|
# iptables -A INPUT -p ALL -j DROP
|
|
|
|
## Default policies for IPv4 ##
|
|
iptables -P INPUT DROP
|
|
iptables -P OUTPUT ACCEPT
|
|
iptables -P FORWARD DROP
|
|
|
|
|
|
|
|
|
|
|
|
|
|
########
|
|
# IPv6 #
|
|
########
|
|
|
|
##=========== General ===========##
|
|
ip6tables -A INPUT -i lo -m conntrack --ctstate NEW -j ACCEPT ## Loop device
|
|
ip6tables -A INPUT -p ipv6-icmp -m conntrack --ctstate NEW -j ACCEPT ## ICMP, e.g. ping
|
|
ip6tables -A INPUT -p icmpv6 -m conntrack --ctstate NEW -j ACCEPT ## These are required for IPv6
|
|
ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT ## Existing and related to outgoing
|
|
ip6tables -A INPUT -d fe80::/10 -p udp -m conntrack --ctstate NEW -m udp --dport 546 -j ACCEPT ## DHCPv6-client
|
|
# ip6tables -A INPUT -i $LAN_INTERFACE -p udp --dport 547 -m conntrack --ctstate NEW -j ACCEPT ## DHCPv6 server
|
|
|
|
##============= NAT ===============##
|
|
# ip6tables -A FORWARD -i $LAN_INTERFACE -o $PUBLIC_INTERFACE -m conntrack --ctstate NEW -j ACCEPT
|
|
# ip6tables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
|
#
|
|
### NAT may not be desired for IPv6, if the clients on your LAN get
|
|
### a public IPv6 address from the DHCP server, you may want to leave this
|
|
### commented
|
|
# ip6tables -t nat -A POSTROUTING -o $PUBLIC_INTERFACE -j MASQUERADE
|
|
|
|
##============ Public =============##
|
|
# ip6tables -A INPUT -i $PUBLIC_INTERFACE -p tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT
|
|
# ip6tables -A INPUT -i $PUBLIC_INTERFACE -p tcp --dport 443 -m conntrack --ctstate NEW -j ACCEPT
|
|
ip6tables -A INPUT -i $PUBLIC_INTERFACE -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
|
|
|
|
##============= LAN ===============##
|
|
ip6tables -A INPUT -i $LAN_INTERFACE -m conntrack --ctstate NEW -j ACCEPT
|
|
# ip6tables -A INPUT -i $LAN_INTERFACE -p udp --dport 5353 -j ACCEPT ## MDNS
|
|
|
|
##=========== Logging =============##
|
|
# ip6tables -A INPUT -p ALL $JFW_LOG_6
|
|
# ip6tables -A INPUT -p ALL -j DROP
|
|
|
|
##=== Default policies for IPv6 ===##
|
|
ip6tables -P INPUT DROP
|
|
ip6tables -P OUTPUT ACCEPT
|
|
ip6tables -P FORWARD DROP
|
|
|