Code:
#iptables-Script
#Module laden
modprobe ip_tables
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe iptable_nat
#Routing aktivieren
echo "1" > /proc/sys/net/ipv4/ip_forward
#TCP Syncookies aktivieren
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
#RST bei vollem Buffer senden
echo "1" > /proc/sys/net/ipv4/tcp_abort_on_overflow
#TCP FIN,ACK Timeout
echo "30" > /proc/sys/net/ipv4/tcp_fin_timeout
#Verbindungsaufbau nach 3 SYN-Anfragen unterbrechen
echo "3" > /proc/sys/net/ipv4/tcp_syn_retries
#Keine Redirection
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
#Kein Source-Routing
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
#ICMP Broadcasts ignorieren
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
#Killt Pakete aus dem Adressraum 0.X.X.X
echo "0" > /proc/sys/net/ipv4/conf/all/bootp_relay
#Killt gespoofte Pakete
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
#Alle Regeln löschen
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F DROPKETTE
iptables -X DROPKETTE
#Policies setzen
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
#Loopback-Kommunikation immer erlauben
iptables -A INPUT -i lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -o lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
#Lokale Kommunikation immer erlauben
iptables -A INPUT -s 192.168.1.0/24 -d 192.168.1.0/24 -j ACCEPT
iptables -A OUTPUT -s 192.168.1.0/24 -d 192.168.1.0/24 -j ACCEPT
#Logging-Kette
iptables -N DROPKETTE
iptables -A DROPKETTE -j LOG -m limit --limit 5/s --log-prefix "Blockiert:"
iptables -A DROPKETTE -j DROP
#ICMP eingehend
iptables -A INPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
iptables -A INPUT -p icmp --icmp-type timestamp-reply -j ACCEPT
iptables -A INPUT -p icmp --icmp-type timestamp-request -j ACCEPT
#ICMP ausgehend
iptables -A OUTPUT -p icmp -j ACCEPT
#Server-Ports freigeben
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#Ausgehende Services zulassen
iptables -A OUTPUT -p tcp --dport 20:21 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 23 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 110 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
#Antworten hergestellter Verbindungen
iptables -A INPUT -p tcp --sport 20:21 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --sport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --sport 23 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --sport 25 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --sport 80 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --sport 110 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --sport 443 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p udp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
#ICQ
iptables -A OUTPUT -p tcp --dport 5190 -j ACCEPT
iptables -A INPUT -p tcp --sport 5190 -j ACCEPT
#Passives FTP mit folgenden Servern zulassen
iptables -A OUTPUT -p tcp -d 83.133.51.34 --dport 1024:65535 -j ACCEPT
iptables -A INPUT -p tcp -s 83.133.51.34 --sport 1024:65535 -j ACCEPT
#Unzulässige Pakete loggen
iptables -A INPUT -j DROPKETTE
iptables -A FORWARD -j DROPKETTE
iptables -A OUTPUT -j DROPKETTE
