Citation :
#!/bin/bash
# on va vider toutes les règles iptables -F iptables -X
# Pour accepter tout ce qui se passe sur l'interface lo (sinon ce n'est pas la peine d'activer le réseau !) : iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT # Pour accepter les résolutions de nom (ie: le dns) : iptables -A INPUT -i ppp0 --protocol udp --source-port 53 -j ACCEPT
iptables -A OUTPUT -o ppp0 --protocol udp --destination-port 53 -j ACCEPT
iptables -A INPUT -i ppp0 --protocol tcp --source-port 53 -j ACCEPT
iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 53 -j ACCEPT # Pour accepter le traffic web (on veut surfer en http(80) et https(443)) : iptables -A INPUT -i ppp0 --protocol tcp -m multiport --source-port 80,443 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o ppp0 --protocol tcp -m multiport --destination-port 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
# Pour accepter le traffic pour ecouter la radio : iptables -A INPUT -i ppp0 --protocol tcp -m multiport --source-port 8128,8018,8000 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o ppp0 --protocol tcp -m multiport --destination-port 8128,8018,8000 -m state --state NEW,ESTABLISHED -j ACCEPT
# Pour accepter le traffic SSH
iptables -A INPUT -i ppp0 --protocol tcp --source-port 22 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 22 -m state --state NEW,ESTABLISHED -j ACCEPT
# Pour accepter le traffic rsync
iptables -A INPUT -i ppp0 --protocol tcp --source-port 873 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 873 -m state --state NEW,ESTABLISHED -j ACCEPT
# Pour accepter le traffic IRC
iptables -A INPUT -i ppp0 --protocol tcp --source-port 6667 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 6667 -m state --state NEW,ESTABLISHED -j ACCEPT
# Pour accepter le traffic des emails
# smtp(25), pop3(110), imap(143), imap3(220)
iptables -A INPUT -i ppp0 --protocol tcp -m multiport --source-port 25,110,143,220 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o ppp0 --protocol tcp -m multiport --destination-port 25,110,143,220 -m state --state NEW,ESTABLISHED -j ACCEPT
# ping (accept les ping vers l'exterieur, mais pas entrant (flood))
iptables -A OUTPUT -p icmp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p icmp -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p icmp -m state --state NEW -m limit --limit 10/min -j ACCEPT # Instant messenger
# msn(1863),icq(5190), aim(5190)
iptables -A INPUT -i ppp0 --protocol tcp -m multiport --source-port 1863,5190 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o ppp0 --protocol tcp -m multiport --destination-port 1863,5190 -m state --state NEW,ESTABLISHED -j ACCEPT
# Pour accepter le protocol ntp (mise a l'heure du system via le net)
iptables -A INPUT -i ppp0 --protocol udp --source-port 123 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o ppp0 --protocol udp --destination-port 123 -m state --state NEW,ESTABLISHED -j ACCEPT
# enemy territory
iptables -A INPUT -i ppp0 --protocol tcp -m multiport --source-port 27960,27950,27951 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o ppp0 --protocol tcp -m multiport --destination-port 27960,27950,27951 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i ppp0 --protocol udp -m multiport --source-port 27960,27950,27951 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o ppp0 --protocol udp -m multiport --destination-port 27960,27950,27951 -m state --state NEW,ESTABLISHED -j ACCEPT
# Pour accepter le protocol Torrent
torrent_port="6969,6881,6882,6883,6884,6885,6886,6886,6887,6888,6889"
iptables -A INPUT -i ppp0 --protocol tcp -m multiport --source-port ${torrent_port} -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o ppp0 --protocol tcp -m multiport --destination-port ${torrent_port} -m state --state NEW,ESTABLISHED -j ACCEPT
# Team speak
iptables -A INPUT -i ppp0 --protocol tcp -m multiport --source-port 8765,8766,8777 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o ppp0 --protocol tcp -m multiport --destination-port 8765,8766,8777 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i ppp0 --protocol udp -m multiport --source-port 8767,8765,8766,8777 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o ppp0 --protocol udp -m multiport --destination-port 8767,8765,8766,8777 -m state --state NEW,ESTABLISHED -j ACCEPT
# tous rejeter (le reste quoi!)
iptables -A FORWARD -j DROP
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP
|