<!DOCTYPE html>
<html>
<head>
<title></title>
</head>
<body><div>I recently set up IPTBLES on my Digital Ocean Centos VPS. The rules I set up are below.<br></div>
<div> </div>
<div>Problem is, after setting and saving these rules, if I then issued a flush command I would lose connectivity. Is this behaviour expected? Here is what I did (note these are my notes, not contact of a script file):<br></div>
<div> </div>
<div> </div>
<div>Flush all current rules:<br></div>
<div> iptables -F<br></div>
<div>Drop TCP reconnisance packets (tcp null packets)<br></div>
<div> iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP<br></div>
<div>Reject syn flood attacks<br></div>
<div> iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP<br></div>
<div>Reject XMAS flood attacks<br></div>
<div> iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP<br></div>
<div>Accept traffing destined to localhost<br></div>
<div> iptables -A INPUT -i lo -j ACCEPT<br></div>
<div>Open expected port for web (http) and secure web (https) traffic<br></div>
<div> iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT<br></div>
<div> iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT<br></div>
<div>Open a port for SSH traffic on port 22 [THIS PORT SHOULD BE CHANGED!!!!!!!!!!!!!!!!!!!!!!!]<br></div>
<div> iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT<br></div>
<div>Open port 8000 for Ajenti<br></div>
<div> iptables -A INPUT -p tcp -m state --state NEW --dport 8000 -j ACCEPT <br></div>
<div> iptables -A INPUT -p udp -m state --state NEW --dport 8000 -j ACCEPT<br></div>
<div>Open ports 4505 and 4506 if the server is going to be a salt-master<br></div>
<div> iptables -A INPUT -m state --state new -m tcp -p tcp --dport 4505 -j ACCEPT<br></div>
<div> iptables -A INPUT -m state --state new -m tcp -p tcp --dport 4506 -j ACCEPT<br></div>
<div>Accept incoming replies from established outgoing connections<br></div>
<div> iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT<br></div>
<div>Allow outgoing traffic<br></div>
<div> iptables -P OUTPUT ACCEPT<br></div>
<div>Drop all incoming traffing which doesn't match a designated rule<br></div>
<div> iptables -P INPUT DROP<br></div>
<div> </div>
<div>Save the rules (This executes the iptables init script, which runs /sbin/iptables-save and writes the current iptables configuration to /etc/sysconfig/iptables .)<br></div>
<div> /sbin/service iptables save<br></div>
<div> </div>
<div>===================result=========================<br></div>
<div>iptables -L -n<br></div>
<div>Chain INPUT (policy DROP)<br></div>
<div>target prot opt source destination<br></div>
<div>ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED<br></div>
<div>ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED<br></div>
<div>DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00<br></div>
<div>DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02 state NEW<br></div>
<div>DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F<br></div>
<div>ACCEPT all -- 0.0.0.0/0 0.0.0.0/0<br></div>
<div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80<br></div>
<div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443<br></div>
<div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22<br></div>
<div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:8000<br></div>
<div>ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:8000<br></div>
<div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:4505<br></div>
<div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:4506<br></div>
<div>DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00<br></div>
<div>DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02 state NEW<br></div>
<div>DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F<br></div>
<div>ACCEPT all -- 0.0.0.0/0 0.0.0.0/0<br></div>
<div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80<br></div>
<div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443<br></div>
<div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22<br></div>
<div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:8000<br></div>
<div>ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:8000<br></div>
<div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:4505<br></div>
<div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:4506<br></div>
<div> </div>
<div>Chain FORWARD (policy ACCEPT)<br></div>
<div>target prot opt source destination<br></div>
<div> </div>
<div>Chain OUTPUT (policy ACCEPT)<br></div>
<div>target prot opt source destination<br></div>
<div> </div>
</body>
</html>