source: lab.git/TipAndDoc/iptables/ufw/before.rules

Last change on this file was 8333ea0, checked in by mitty <mitty@…>, 13 years ago

git-svn-id: https://lab.mitty.jp/svn/lab/trunk@92 7d2118f6-f56c-43e7-95a2-4bb3031d96e7

  • Property mode set to 100644
File size: 3.4 KB
Line 
1#
2# rules.before
3#
4# Rules that should be run before the ufw command line added rules. Custom
5# rules should be added to one of these chains:
6#   ufw-before-input
7#   ufw-before-output
8#   ufw-before-forward
9#
10
11# Don't delete these required lines, otherwise there will be errors
12*filter
13:ufw-before-input - [0:0]
14:ufw-before-output - [0:0]
15:ufw-before-forward - [0:0]
16:ufw-not-local - [0:0]
17# End required lines
18
19
20# allow all on loopback
21-A ufw-before-input -i lo -j ACCEPT
22-A ufw-before-output -i lo -j ACCEPT
23
24# connection tracking rules
25-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
26-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
27
28# drop INVALID packets
29# uncomment to log INVALID packets
30-A ufw-before-input -m conntrack --ctstate INVALID -j LOG --log-prefix "[UFW BLOCK INVALID]: " --log-level err -m limit --limit 3/min --limit-burst 10
31-A ufw-before-input -m conntrack --ctstate INVALID -j DROP
32
33## Ingress filter (see RFC 2827) (eth0:LAN<192.168.100.0/24>)
34-A ufw-before-forward -i eth0 -s ! 192.168.100.0/24 -j LOG --log-tcp-options --log-ip-options --log-prefix "[UFW BLOCK LOG_INGRESS]: " --log-level err -m limit --limit 3/min --limit-burst 10
35-A ufw-before-forward -i eth0 -s ! 192.168.100.0/24 -j DROP
36
37## DROP CIFS(Samba) access from/to WAN(eth1)
38-A ufw-before-input   -i eth1 -p tcp -m multiport --dports 135,137:139,445 -j DROP
39-A ufw-before-input   -i eth1 -p udp -m multiport --dports 135,137:139,445 -j DROP
40-A ufw-before-forward -i eth1 -p tcp -m multiport --dports 135,137:139,445 -j DROP
41-A ufw-before-forward -i eth1 -p udp -m multiport --dports 135,137:139,445 -j DROP
42-A ufw-before-forward -o eth1 -p tcp -m multiport --dports 135,137:139,445 -j DROP
43-A ufw-before-forward -o eth1 -p udp -m multiport --dports 135,137:139,445 -j DROP
44-A ufw-before-output  -o eth1 -p tcp -m multiport --dports 135,137:139,445 -j DROP
45-A ufw-before-output  -o eth1 -p udp -m multiport --dports 135,137:139,445 -j DROP
46
47## Access from LAN
48-A ufw-before-input -i eth0 -j ACCEPT
49-A ufw-before-forward -i eth0 -j ACCEPT
50
51# connection tracking for outbound
52-A ufw-before-output -p tcp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
53-A ufw-before-output -p udp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
54
55# ok icmp codes
56-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
57-A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT
58-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
59-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
60-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT
61
62# allow dhcp client to work
63-A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT
64
65#
66# ufw-not-local
67#
68-A ufw-before-input -j ufw-not-local
69
70# if LOCAL, RETURN
71-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
72
73# if MULTICAST, RETURN
74-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
75
76# if BROADCAST, RETURN
77-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
78
79-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK NOT-TO-ME]: " --log-level err
80
81# all other non-local packets are dropped
82-A ufw-not-local -j DROP
83
84# allow MULTICAST, be sure the MULTICAST line above is uncommented
85-A ufw-before-input -s 224.0.0.0/4 -j ACCEPT
86-A ufw-before-input -d 224.0.0.0/4 -j ACCEPT
87
88
89# don't delete the 'COMMIT' line or these rules won't be processed
90COMMIT
Note: See TracBrowser for help on using the repository browser.