######## *filter ######## :INPUT {{ 'DROP' if common__iptables__drop_by_default else 'ACCEPT' }} [0:0] :FORWARD DROP [0:0] :OUTPUT {{ 'DROP' if common__iptables__drop_by_default else 'ACCEPT' }} [0:0] # Remove all rules from all chains, # delete all user-defined chains. -F -X # Allow all loopback (lo) traffic and reject anything # to localhost that does not originate from lo. -A INPUT -i lo -j ACCEPT -A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT -A OUTPUT -o lo -j ACCEPT # Allow all outgoing traffic. -A OUTPUT -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT # Allow some important ICMP. -A INPUT -p icmp --icmp-type echo-request -j ACCEPT -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT -A INPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT -A OUTPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT -A OUTPUT -p icmp --icmp-type time-exceeded -j ACCEPT # Deny other ICMP. -A INPUT -p icmp -j DROP -A OUTPUT -p icmp -j DROP # Allow incoming SSH. -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT {{ common__iptables__v4_filter }} COMMIT