diff options
| author | uvok cheetah | 2025-02-09 17:57:14 +0100 |
|---|---|---|
| committer | uvok cheetah | 2025-02-09 17:57:14 +0100 |
| commit | a3ee42d1dde090c5baad512ff8707f7e2c068433 (patch) | |
| tree | a619ef2f51c548a235b188cac19c7cf337686424 /roles/linux_ns/files/iptables/iptables.save | |
| parent | bb989a2148686d1eb4f49b5aa2597c5162436196 (diff) | |
Diffstat (limited to 'roles/linux_ns/files/iptables/iptables.save')
| -rw-r--r-- | roles/linux_ns/files/iptables/iptables.save | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/roles/linux_ns/files/iptables/iptables.save b/roles/linux_ns/files/iptables/iptables.save new file mode 100644 index 0000000..4f72cc5 --- /dev/null +++ b/roles/linux_ns/files/iptables/iptables.save @@ -0,0 +1,24 @@ +*filter +:INPUT DROP [0:0] +:FORWARD DROP [0:0] +:OUTPUT ACCEPT [0:0] + +-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + +-A INPUT -i lo -j ACCEPT +-A INPUT -i tinc_dn42 -j ACCEPT + +-A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT +-A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT +-A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT +-A INPUT -p icmp --icmp-type echo-request -j ACCEPT + +# traceroute +-A INPUT -p udp -m multiport --dports 33434:33534 -j REJECT --reject-with icmp-port-unreachable +# DNS +-A INPUT -p udp --dport 53 -j ACCEPT +-A INPUT -p tcp --dport 53 -j ACCEPT + +-A FORWARD -j REJECT --reject-with icmp-port-unreachable + +COMMIT |