dbxe
/
fusionpbx-install.sh
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Updated iptables rules to make dropping known bots easier 

included ssl ports as well
added comments to rules where appropriate
This commit is contained in:
mafoo 2016-05-25 11:45:58 +01:00
parent b6eeed2089
commit 9da2e90728
1 changed files with 13 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
debian/resources/iptables.sh vendored
View File

@ -4,26 +4,20 @@
echo "Configure IPTables" echo "Configure IPTables"
#run iptables commands #run iptables commands
iptables -A INPUT -j DROP -p udp --dport 5060 -m string --string "friendly-scanner" --algo bm iptables -N sip
iptables -A INPUT -j DROP -p udp --dport 5060 -m string --string "sipcli/" --algo bm iptables -A sip -j DROP -m string --string "friendly-scanner" --algo bm
iptables -A INPUT -j DROP -p tcp --dport 5060 -m string --string "friendly-scanner" --algo bm iptables -A sip -j DROP -m string --string "sipcli/" --algo bm
iptables -A INPUT -j DROP -p tcp --dport 5060 -m string --string "sipcli/" --algo bm iptables -A sip -j ACCEPT
iptables -A INPUT -j DROP -p udp --dport 5080 -m string --string "friendly-scanner" --algo bm
iptables -A INPUT -j DROP -p udp --dport 5080 -m string --string "sipcli/" --algo bm
iptables -A INPUT -j DROP -p tcp --dport 5080 -m string --string "friendly-scanner" --algo bm
iptables -A INPUT -j DROP -p tcp --dport 5080 -m string --string "sipcli/" --algo bm
iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -j sip -p tcp -m multiport --dports 5060,5061,5080,5081 -m comment --comment "SIP tcp"
iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -j sip -p udp -m multiport --dports 5060,5061,5080,5081 -m comment --comment "SIP udp"
iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -A INPUT -p tcp --dport 443 -j ACCEPT iptables -A INPUT -j ACCEPT -p tcp --dport 22 -m comment --comment "ssh"
iptables -A INPUT -p tcp --dport 5060 -j ACCEPT iptables -A INPUT -j ACCEPT -p tcp --dport 80 -m comment --comment "http"
iptables -A INPUT -p udp --dport 5060 -j ACCEPT iptables -A INPUT -j ACCEPT -p tcp --dport 443 -m comment --comment "https"
iptables -A INPUT -p tcp --dport 5080 -j ACCEPT iptables -A INPUT -j ACCEPT -p udp --dport 16384:32768 -m comment --comment "SIP RTP"
iptables -A INPUT -p udp --dport 5080 -j ACCEPT iptables -A INPUT -j ACCEPT -p icmp --icmp-type echo-request
iptables -A INPUT -p udp --dport 16384:32768 -j ACCEPT iptables -A INPUT -j ACCEPT -p udp --dport 1194 -m comment --comment "OpenVPN"
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -P INPUT DROP iptables -P INPUT DROP
iptables -P FORWARD DROP iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT iptables -P OUTPUT ACCEPT