1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
| -
!
-
!
-
!
-
|
!
-
!
-
!
-
|
|
|
!
-
!
-
!
-
!
-
!
-
|
|
|
!
-
!
-
!
-
!
-
!
-
!
-
|
!
-
!
-
|
|
|
|
|
|
!
-
|
|
!
-
!
-
!
-
|
|
|
!
-
!
-
!
-
!
-
|
|
|
|
!
|
LOCAL_IF="eth0"
LOCAL_IP="<グローバルIP>"
modprobe ipt_state
modprobe ipt_LOG
modprobe ipt_REJECT
modprobe ipt_limit
iptables -F
iptables -X
iptables -Z
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -N drop_fragment
iptables -A drop_fragment -f -j LOG --log-prefix "FRAGMENT: " -m limit --limit 1/s --limit-burst 10
iptables -A drop_fragment -f -j DROP
iptables -N drop_invalid_packet
iptables -A drop_invalid_packet -j LOG --log-prefix "INVALID_PACKET: " -m limit --limit 1/s --limit-burst 10
iptables -A drop_invalid_packet -j DROP
iptables -N drop_synflood
iptables -A drop_synflood -m limit --limit 10/s --limit-burst 20 -j RETURN
iptables -A drop_synflood -j LOG --log-prefix "SYNFLOOD: " -m limit --limit 1/s --limit-burst 10
iptables -A drop_synflood -j DROP
iptables -N drop_invalid_flag
iptables -A drop_invalid_flag -j LOG --log-prefix "INVALID_FLAS: " -m limit --limit 1/s --limit-burst 10
iptables -A drop_invalid_flag -j DROP
iptables -N drop_flag
iptables -A drop_flag -p tcp --tcp-flags ACK,FIN FIN -j drop_invalid_flag
iptables -A drop_flag -p tcp --tcp-flags ACK,PSH PSH -j drop_invalid_flag
iptables -A drop_flag -p tcp --tcp-flags ACK,URG URG -j drop_invalid_flag
iptables -A drop_flag -p tcp --tcp-flags FIN,RST FIN,RST -j drop_invalid_flag
iptables -A drop_flag -p tcp --tcp-flags SYN,FIN SYN,FIN -j drop_invalid_flag
iptables -A drop_flag -p tcp --tcp-flags SYN,RST SYN,RST -j drop_invalid_flag
iptables -A drop_flag -p tcp --tcp-flags ALL ALL -j drop_invalid_flag
iptables -A drop_flag -p tcp --tcp-flags ALL NONE -j drop_invalid_flag
iptables -A drop_flag -p tcp --tcp-flags ALL FIN,PSH,URG -j drop_invalid_flag
iptables -A drop_flag -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j drop_invalid_flag
iptables -A drop_flag -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j drop_invalid_flag
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp --syn -j drop_synflood
iptables -A INPUT -p tcp -j drop_flag
iptables -A INPUT -j drop_fragment
iptables -A INPUT -m state --state INVALID -j drop_invalid_packet
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport <変更後ポート番号> -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 53 -m state --state NEW -j ACCEPT iptables -A INPUT -p udp --dport 53 -m state --state NEW -j ACCEPT iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset
iptables -A INPUT -d 255.255.255.255 -j DROP
iptables -A INPUT -p udp --dport 17500 -j DROP
iptables -A INPUT -j LOG --log-prefix "UNDEFIND_INPUT: " -m limit --limit 1/s --limit-burst 10
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p tcp -j drop_flag
iptables -A OUTPUT -m state --state NEW -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -j LOG --log-prefix "UNDEFIND_OUTPUT: " -m limit --limit 1/s --limit-burst 10
|