#!/bin/bash
 
# on vide en priorité le listing
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
 
#on interdit les connexions entrantes
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
 
#on interdit les connexions sortantes
iptables -t filter -P OUTPUT DROP
 
# on se protège des scan de port
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
 
# on autorise SSH
iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT
 
# on autorise les requetes DNS, FTP, HTTP, NTP et le loopback
iptables -t filter -A OUTPUT -p tcp --dport 21 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT
 
# on autorise ping
iptables -t filter -A INPUT -p icmp -j ACCEPT
iptables -t filter -A OUTPUT -p icmp -j ACCEPT
 
# on bloque le ping si on a pas de monitoring... on évite le flood a la con au moins (virer les #et rajouter au dessus pour les autorisations
#iptables -t filter -A INPUT -p icmp -j DROP
#iptables -t filter -A OUTPUT -p icmp -j DROP
 
# HTTP
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 8443 -j ACCEPT
 
# FTP
modprobe ip_conntrack_ftp
iptables -t filter -A INPUT -p tcp --dport 20 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 
# Mail
iptables -t filter -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 110 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 143 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 25 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 110 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 143 -j ACCEPT
 
# Syn-Flood
iptables -A FORWARD -p tcp --syn -m limit --limit 1/second -j ACCEPT
iptables -A FORWARD -p udp -m limit --limit 1/second -j ACCEPT
 
# Spoofing
iptables -N SPOOFED
iptables -A SPOOFED -s 127.0.0.0/8 -j DROP
iptables -A SPOOFED -s 169.254.0.0/12 -j DROP
iptables -A SPOOFED -s 172.16.0.0/12 -j DROP
iptables -A SPOOFED -s 192.168.0.0/16 -j DROP
iptables -A SPOOFED -s 10.0.0.0/8 -j DROP
 
# Allemagne (82.207.128.0 to 82.207.255.255) / Ukraine (82.207.0.0 to 82.207.127.255)
iptables -A INPUT -s    82.207.0.0/16    -j DROP
 
# Bulgarie
iptables -A INPUT -s 87.126.0.0/16 -j DROP
 
# Chine
iptables -A INPUT -m iprange --src-range 59.32.0.0-59.63.255.255 -j DROP
iptables -A INPUT -m iprange --src-range 124.224.0.0-124.231.255.255 -j DROP
iptables -A INPUT -m iprange --src-range 210.76.0.0-210.77.255.255 -j DROP
iptables -A INPUT -m iprange --src-range 218.64.0.0-218.95.255.255 -j DROP
iptables -A INPUT -m iprange --src-range 218.104.0.0-218.107.255.255 -j DROP
iptables -A INPUT -s 218.234.0.0/16 -j DROP
iptables -A INPUT -m iprange --src-range 218.241.0.0-218.247.255.255 -j DROP
iptables -A INPUT -m iprange --src-range 219.224.0.0-219.239.255.255 -j DROP
iptables -A INPUT -m iprange --src-range 220.160.0.0-220.191.255.255 -j DROP
iptables -A INPUT -m iprange --src-range 222.32.0.0-222.95.255.255 -j DROP
 
# Corée
iptables -A INPUT -m iprange --src-range 58.140.0.0-58.143.255.255 -j DROP
iptables -A INPUT -m iprange --src-range 61.96.0.0-61.111.255.255 -j DROP
iptables -A INPUT -m iprange --src-range 122.252.64.0-122.252.127.255 -j DROP
iptables -A INPUT -m iprange --src-range 124.0.0.0-124.3.255.255 -j DROP
iptables -A INPUT -m iprange --src-range 124.48.0.0-124.63.255.255 -j DROP
iptables -A INPUT -m iprange --src-range 203.224.0.0-203.255.255.255 -j DROP
iptables -A INPUT -m iprange --src-range 210.90.0.0-210.91.255.255 -j DROP
iptables -A INPUT -m iprange --src-range 211.192.0.0-211.255.255.255 -j DROP
iptables -A INPUT -m iprange --src-range 221.140.0.0-221.143.255.255 -j DROP
iptables -A INPUT -s 222.122.0.0/16 -j DROP
iptables -A INPUT -m iprange --src-range 222.232.0.0-222.239.255.255 -j DROP
 
# Russie
iptables -A INPUT -m iprange --src-range 89.112.0.0-89.113.255.255 -j DROP
iptables -A INPUT -s 195.151.0.0/16 -j DROP
iptables -A INPUT -m iprange --src-range 80.240.208.0-80.240.223.255 -j DROP
 
# Taiwan
iptables -A INPUT -m iprange --src-range 122.120.0.0-122.127.255.255 -j DROP
iptables -A INPUT -m iprange --src-range 125.224.0.0-125.231.255.255 -j DROP