dbxe
/
fusionpbx-install.sh
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Updated iptables rules to make dropping known bots easier 

included ssl ports as well
added comments to rules where appropriate
This commit is contained in:
mafoo 2016-05-25 11:45:58 +01:00
parent b6eeed2089
commit 9da2e90728
1 changed files with 13 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
debian/resources/iptables.sh vendored
View File

@ -4,26 +4,20 @@
echo "Configure IPTables"
#run iptables commands
iptables -A INPUT -j DROP -p udp --dport 5060 -m string --string "friendly-scanner" --algo bm
iptables -A INPUT -j DROP -p udp --dport 5060 -m string --string "sipcli/" --algo bm
iptables -A INPUT -j DROP -p tcp --dport 5060 -m string --string "friendly-scanner" --algo bm
iptables -A INPUT -j DROP -p tcp --dport 5060 -m string --string "sipcli/" --algo bm
iptables -A INPUT -j DROP -p udp --dport 5080 -m string --string "friendly-scanner" --algo bm
iptables -A INPUT -j DROP -p udp --dport 5080 -m string --string "sipcli/" --algo bm
iptables -A INPUT -j DROP -p tcp --dport 5080 -m string --string "friendly-scanner" --algo bm
iptables -A INPUT -j DROP -p tcp --dport 5080 -m string --string "sipcli/" --algo bm
iptables -N sip
iptables -A sip -j DROP -m string --string "friendly-scanner" --algo bm
iptables -A sip -j DROP -m string --string "sipcli/" --algo bm
iptables -A sip -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 5060 -j ACCEPT
iptables -A INPUT -p udp --dport 5060 -j ACCEPT
iptables -A INPUT -p tcp --dport 5080 -j ACCEPT
iptables -A INPUT -p udp --dport 5080 -j ACCEPT
iptables -A INPUT -p udp --dport 16384:32768 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -j sip -p tcp -m multiport --dports 5060,5061,5080,5081 -m comment --comment "SIP tcp"
iptables -A INPUT -j sip -p udp -m multiport --dports 5060,5061,5080,5081 -m comment --comment "SIP udp"
iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -A INPUT -j ACCEPT -p tcp --dport 22 -m comment --comment "ssh"
iptables -A INPUT -j ACCEPT -p tcp --dport 80 -m comment --comment "http"
iptables -A INPUT -j ACCEPT -p tcp --dport 443 -m comment --comment "https"
iptables -A INPUT -j ACCEPT -p udp --dport 16384:32768 -m comment --comment "SIP RTP"
iptables -A INPUT -j ACCEPT -p icmp --icmp-type echo-request
iptables -A INPUT -j ACCEPT -p udp --dport 1194 -m comment --comment "OpenVPN"
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT