Kod: Zaznacz cały
uname -a
Linux debian2 5.10.0-18-amd64 #1 SMP Debian 5.10.140-1 (2022-09-02) x86_64 GNU/Linux
Kod: Zaznacz cały
dpkg -l | grep netfilter-persistent
ii netfilter-persistent 1.0.15 all boot-time loader for netfilter configuration
Kod: Zaznacz cały
mark@debian2:~$ update-alternatives --list iptables
/usr/sbin/iptables-legacy
/usr/sbin/iptables-nft
Kod: Zaznacz cały
iptables -F
iptables -F -t nat
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -X
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# Załaduj moduły śledzące połączenia
modprobe ip_conntrack
modprobe iptable_nat
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
conntrack -F
# Błędne pakiety – tablica mangle
iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP
iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
iptables -t mangle -A PREROUTING -f -j DROP
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j DROP
iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i lo -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate INVALID -j DROP
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited
iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state INVALID -j LOG --log-prefix "outinvalid: "
iptables -A OUTPUT -j LOG --log-prefix "outinvalid: "
iptables -A OUTPUT -m conntrack --ctstate INVALID -j DROP
iptables -A OUTPUT -p icmp -m icmp --icmp-type 0 -j DROP
iptables -A OUTPUT -p tcp -m tcp --dport 23 -j REJECT --reject-with icmp-port-unreachable
# Drop everything else
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT DROP
Co zlego jest w tych regolach ?
![Mad :mad:](./images/smilies/mad.png)