ມາເບິ່ງກັນດີກວ່າວ່າ iptables rule ທີ່ໜ້າໃຊ້ມັນມີຫຍັງແດ່
Allow Loopback interface
-A INPUT -i lo -j ACCEPT -A OUTPUT -o lo -j ACCEPT
Allow Ping
-A INPUT -i eth0 -p icmp -m state --state NEW --icmp-type 8 -j ACCEPT -A INPUT -i eth0 -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT -A OUTPUT -o eth0 -p icmp -j ACCEPT
Allow web usage
-A INPUT -i eth0 -p tcp -m state --state ESTABLISHED,RELATED --sport 80 -j ACCEPT -A INPUT -i eth0 -p tcp -m state --state ESTABLISHED,RELATED --sport 443 -j ACCEPT -A OUTPUT -o eth0 -p tcp -m tcp --dport 80 -j ACCEPT -A OUTPUT -o eth0 -p tcp -m tcp --dport 443 -j ACCEPT
Allow DNS Usage
-A INPUT -i ens3 -s 192.168.1.1 -p udp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT -A OUTPUT -o ens3 -d 192.168.1.1 -p udp --dport 53 -m udp -j ACCEPT
Allow NTP
-A INPUT -i eth0 -p udp -m state --state ESTABLISHED,RELATED --dport 123 -j ACCEPT -A OUTPUT -o eth0 -p udp -m udp --sport 123 -j ACCEPT
Allow Printing
-A INPUT -p udp -m udp --dport 631 -j ACCEPT -A INPUT -p tcp -m tcp --dport 631 -j ACCEPT -A OUTPUT -p udp -m udp --sport 631 -j ACCEPT -A OUTPUT -p tcp -m tcp --sport 631 -j ACCEPT
Allow Email Usage
# IMAP -A INPUT -i eth0 -p tcp -m state --state ESTABLISHED,RELATED --sport 993 -j ACCEPT -A OUTPUT -o eth0 -p tcp -m tcp --dport 993 -j ACCEPT # POP3 -A INPUT -i eth0 -p tcp -m state --state ESTABLISHED,RELATED --sport 995 -j ACCEPT -A OUTPUT -o eth0 -p tcp -m tcp --dport 995 -j ACCEPT # SMTP -A INPUT -i eth0 -p tcp -m state --state ESTABLISHED,RELATED --sport 465 -j ACCEPT -A OUTPUT -o eth0 -p tcp -m tcp --dport 465 -j ACCEPT
Allow SSH
# Input -A INPUT -i ens3 -p tcp -m state --state NEW,ESTABLISHED --dport 22 -j ACCEPT -A OUTPUT -o ens3 -p tcp -m state --state ESTABLISHED --sport 22 -j ACCEPT # Output -A OUTPUT -o ens3 -p tcp -m state --state NEW,ESTABLISHED --dport 22 -j ACCEPT -A INPUT -i ens3 -p tcp -m state --state ESTABLISHED --sport 22 -j ACCEPT
Allow DHCP
-A INPUT -i eth0 -p udp -m state --state ESTABLISHED,RELATED --sport 67:68 -j ACCEPT -A OUTPUT -o eth0 -p udp -m udp --dport 67:68 -j ACCEPT
ຈາກນັ້ນກໍ REJECT ທັງໝົດ
-A INPUT -j REJECT -A FORWARD -j REJECT -A OUTPUT -j REJECT
ຂໍ້ມູນຈາກ techsuii.com
