diff options
Diffstat (limited to 'roles/linux_ns/files/iptables/iptables.save')
| -rw-r--r-- | roles/linux_ns/files/iptables/iptables.save | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/roles/linux_ns/files/iptables/iptables.save b/roles/linux_ns/files/iptables/iptables.save new file mode 100644 index 0000000..4f72cc5 --- /dev/null +++ b/roles/linux_ns/files/iptables/iptables.save @@ -0,0 +1,24 @@ +*filter +:INPUT DROP [0:0] +:FORWARD DROP [0:0] +:OUTPUT ACCEPT [0:0] + +-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + +-A INPUT -i lo -j ACCEPT +-A INPUT -i tinc_dn42 -j ACCEPT + +-A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT +-A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT +-A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT +-A INPUT -p icmp --icmp-type echo-request -j ACCEPT + +# traceroute +-A INPUT -p udp -m multiport --dports 33434:33534 -j REJECT --reject-with icmp-port-unreachable +# DNS +-A INPUT -p udp --dport 53 -j ACCEPT +-A INPUT -p tcp --dport 53 -j ACCEPT + +-A FORWARD -j REJECT --reject-with icmp-port-unreachable + +COMMIT |