2020-01-14 04:00:07 -05:00
|
|
|
########
|
|
|
|
|
*filter
|
|
|
|
|
########
|
|
|
|
|
|
|
|
|
|
:INPUT ACCEPT [0:0]
|
|
|
|
|
:FORWARD DROP [0:0]
|
|
|
|
|
:OUTPUT ACCEPT [0:0]
|
|
|
|
|
|
|
|
|
|
# Remove all rules from all chains,
|
|
|
|
|
# delete all user-defined chains.
|
|
|
|
|
-F
|
|
|
|
|
-X
|
|
|
|
|
|
|
|
|
|
# Allow all loopback (lo) traffic and reject anything
|
|
|
|
|
# to localhost that does not originate from lo.
|
|
|
|
|
-A INPUT -i lo -j ACCEPT
|
|
|
|
|
-A INPUT ! -i lo -s ::/128 -j REJECT
|
|
|
|
|
-A OUTPUT -o lo -j ACCEPT
|
|
|
|
|
|
2020-01-14 04:13:39 -05:00
|
|
|
# Allow all outgoing traffic.
|
|
|
|
|
-A OUTPUT -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
|
|
|
|
|
-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
2020-01-14 04:00:07 -05:00
|
|
|
|
|
|
|
|
# Allow incoming ICMPv6 ping.
|
|
|
|
|
-A INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
|
|
|
|
|
-A OUTPUT -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
|
|
|
|
|
|
|
|
|
|
# Allow outgoing ICMPv6 ping.
|
|
|
|
|
-A OUTPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
|
|
|
|
|
-A INPUT -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
|
|
|
|
|
|
|
|
|
|
# Deny other ICMPv6.
|
|
|
|
|
-A INPUT -p icmpv6 -j DROP
|
|
|
|
|
-A OUTPUT -p icmpv6 -j DROP
|
|
|
|
|
|
|
|
|
|
# Allow incoming SSH.
|
|
|
|
|
-A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
|
|
|
|
|
-A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
|
|
|
|
|
|
|
|
|
COMMIT
|
