Basic/default iptables configuration:
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT-A INPUT -p icmp -j ACCEPT-A INPUT -i lo -j ACCEPT-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT-A INPUT -j REJECT --reject-with icmp-host-prohibited-A FORWARD -j REJECT --reject-with icmp-host-prohibitedRules should be added in the order of least restrictive to most restrictive.
iptables -N LOG_DROPiptables -N LOG_REJECTiptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPTiptables -A INPUT -p icmp -j ACCEPTiptables -A INPUT -i lo -j ACCEPTiptables -A INPUT -s 10.20.150.0/255.255.255.0 -j ACCEPTiptables -A INPUT -s 216.128.150.0/255.255.255.0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPTiptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 5060 -j ACCEPTiptables -A INPUT -p udp -m state --state NEW -m udp --dport 5060 -j ACCEPTiptables -A INPUT -j LOG_REJECTiptables -A FORWARD -j REJECT --reject-with icmp-host-prohibitediptables -A LOG_DROP -j LOG --log-prefix "INPUT:DROP: " --log-level 6iptables -A LOG_DROP -j DROPiptables -A LOG_REJECT -j LOG --log-prefix "INPUT:REJECT: " --log-level 6iptables -A LOG_REJECT -j REJECT --reject-with icmp-host-prohibitediptables -I [chain name] [line number] [firewall rule]iptables -I INPUT 6 -p tcp -m state --state NEW -m tcp --dport 5060 -j ACCEPTiptables -D [chain name] [full rule text]iptables -D [chain name] [line number]Persistant IPTables rules without iptables-persist
To make sure the iptables rules are started on a reboot we'll create a new file:
nano /etc/network/if-pre-up.d/iptablesAdd these lines to it:
#!/bin/sh /sbin/iptables-restore < /etc/iptables.up.rulesThe file needs to be executable so change the permissions:
chmod +x /etc/network/if-pre-up.d/iptablehttps://www.frozentux.net/iptables-tutorial/chunkyhtml/x4571.html
https://wiki.debian.org/iptables
IP6Tables
Default ip6tables configuration
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT-A INPUT -p ipv6-icmp -j ACCEPT-A INPUT -i lo -j ACCEPT-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT-A INPUT -d fe80::/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT-A INPUT -j REJECT --reject-with icmp6-adm-prohibited-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited