Final IPTables script (hopefully)

[Jason Williams <jwilliams@courtesymortgage.com>]

Hello everyone.

Back from a much needed vacation today and started back at IPTables. After 
reading up on a lot of documentation and taking some very good advice from 
this list, here is what i have come up with, in hopes of getting it right, 
to act as a personal firewall for my home network.

Without further a due...

#External interface
INET_IP="xxx.xxx.xxx.xxx"
INET_IFACE="eth0"

#Internal/Private LAN
LAN_IP="192.168.0.2"
LAN_IP_RANGE="192.168.0.0/24"
LAN_IFACE="eth1"

#LOOPback
LO_IFACE="lo"
LO_IP="127.0.0.1"

Variables. As always...

# 1.5 IPTables Configuration.

IPTABLES="/usr/sbin/iptables"

#Default Policy Setting

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP

Not much needs to be said here.

#Custom chains

$IPTABLES -N tcp_packets

# bad_tcp_packets chain

$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state 
--state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG 
--log-prefix "New not syn:"
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP

Like the idea of this rule. Trying to prevent NMAP scans, xmas scans etc.

# Rules for incoming packets from the internet.

$IPTABLES -A INPUT -p ALL -d $INET_IFACE -m state --state 
ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -i $LAN_IFACE -s 172.16.1.2 --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT

Should allow traffic to flow freely from the firewall to the internet and 
accept returning connections. No connections from the internet that are 
intiated will be accepted.
Acceping SSH from 172.16.1.2 on the private LAN.
Accceptin loopback interface.

# Accept the packets we actually want to forward

$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $LAN_IFACE -o $INET_IFACE -s $LAN_IP_RANGE -j ACCEPT

Pass out private LAN traffic and return it. First rule is in line for 
better performance.

# Special OUTPUT rules to decide which IP's to allow.

$IPTABLES -A OUTPUT -j ACCEPT

Simple enough.


#NAT SETUP

$IPTABLES -t nat -A POSTROUTING -s $LAN_IP -o $INET_IFACE -j SNAT 
--to-source $INET_IP

Do SNAT for trafffic on the private LAN.


Feel good about these rules. Just wante to ask one last time before I go 
live, in case i booger it up and need help

Appreciate the feedback.

Jason