[보안] iptabls 기본 보안 정책

#!/bin/sh

#

#

#  This NetFilter Ruleset is Default Ruleset in Technical team of clunix

#  This script is Firewall configuration for local host

#                                              

#                                               maker – alang@clunix.com

#

iptables -F

iptables -X

iptables -P INPUT DROP

iptables -P OUTPUT ACCEPT

iptables -P FORWARD DROP

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -i eth0 -p tcp ! –syn -j ACCEPT

iptables -A INPUT -i eth0 -p tcp –sport 53 -j ACCEPT

iptables -A INPUT -i eth0 -p udp –sport 53 -j ACCEPT

#####################################################################

#

#        TCP Rule

#

#####################################################################

iptables -N IN_TCP

iptables -A IN_TCP -p tcp –dport 21 -j ACCEPT

iptables -A IN_TCP -p tcp –dport 22 -j ACCEPT

iptables -A IN_TCP -p tcp –dport 25 -j ACCEPT

iptables -A IN_TCP -p tcp –dport 53 -j ACCEPT

iptables -A IN_TCP -p tcp –dport 80 -j ACCEPT

iptables -A IN_TCP -p tcp –dport 110 -j ACCEPT

iptables -A IN_TCP -p tcp –dport 953 -j ACCEPT

iptables -A IN_TCP -m state –state ESTABLISHED,RELATED -j ACCEPT

iptables -A IN_TCP -j DROP

#####################################################################

#

#        UDP Rule

#

#####################################################################

iptables -N IN_UDP

iptables -A IN_UDP -p udp –dport 53 -j ACCEPT

#iptables -A IN_UDP -p udp –sport 53 -j ACCEPT

iptables -A IN_UDP -p udp –dport 953 -j ACCEPT

#iptables -A IN_UDP -i eth0 -p udp –sport 53 -j ACCEPT

iptables -A IN_UDP -j DROP

#####################################################################

#

#        ICMP Rule

#

#####################################################################

iptables -N IN_ICMP

iptables -A IN_ICMP -i eth0 -p icmp –icmp-type 0 -j ACCEPT

iptables -A IN_ICMP -i eth0 -p icmp –icmp-type 3 -j ACCEPT

iptables -A IN_ICMP -i eth0 -p icmp –icmp-type 5 -j ACCEPT

iptables -A IN_ICMP -i eth0 -p icmp –icmp-type 8 -j ACCEPT

iptables -A IN_ICMP -i eth0 -p icmp –icmp-type 11 -j ACCEPT

#iptables -A IN_ICMP -j ACCEPT

#####################################################################

#

#        Chains Rule

#

#####################################################################

iptables -A INPUT -p tcp -j IN_TCP

iptables -A INPUT -p udp -j IN_UDP

iptables -A INPUT -p icmp -j IN_ICMP