iptables/templates/rules.v4

#####
*nat
#####

:PREROUTING  ACCEPT [0:0]
:INPUT       ACCEPT [0:0]
:OUTPUT      ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

# Remove all rules from all chains,
# delete all user-defined chains.
-F
-X

{{ iptables__v4_nat }}

COMMIT

########
*filter
########

:INPUT   {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
:FORWARD DROP [0:0]
:OUTPUT  {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]

# Remove all rules from all chains,
# delete all user-defined chains.
-F
-X

{{ iptables__v4_filter_init }}
{{ iptables__all_filter_init }}

{{ iptables__v4_filter_prepend }}
{{ iptables__all_filter_prepend }}

# Allow all loopback (lo) traffic and reject anything
# to localhost that does not originate from lo.
-A INPUT   -i lo                -j ACCEPT
-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT
-A OUTPUT  -o lo                -j ACCEPT

# Allow all outgoing traffic.
{% if iptables__allow_output_ifaces %}
{% for iface in iptables__allow_output_ifaces %}
-A OUTPUT -o {{ iface }} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A INPUT  -i {{ iface }} -m conntrack --ctstate ESTABLISHED     -j ACCEPT
{% endfor %}
{% else %}
-A OUTPUT -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A INPUT  -m conntrack --ctstate ESTABLISHED     -j ACCEPT
{% endif %}

# Allow some important ICMP.
-A INPUT  -p icmp --icmp-type echo-request         -j ACCEPT
-A OUTPUT -p icmp --icmp-type echo-request         -j ACCEPT
-A INPUT  -p icmp --icmp-type echo-reply           -j ACCEPT
-A OUTPUT -p icmp --icmp-type echo-reply           -j ACCEPT
-A INPUT  -p icmp --icmp-type fragmentation-needed -j ACCEPT
-A OUTPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT
-A INPUT  -p icmp --icmp-type time-exceeded        -j ACCEPT
-A OUTPUT -p icmp --icmp-type time-exceeded        -j ACCEPT

# Deny other ICMP.
-A INPUT  -p icmp -j DROP
-A OUTPUT -p icmp -j DROP

# Allow incoming SSH.
-A INPUT  -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED     -j ACCEPT

{{ iptables__v4_filter_append }}

COMMIT