Hi,
I'm new to iptables, and i've been trying to put together a firewall which purpose is to protect a web server. The below rules are the ones i've put together so far, and i would like to hear if the rules makes sense - and wether i've left out anything essential?
In addition to port 80, i also need to have port 3306 (mysql) and 22 (ssh) open for external connections.
Any feedback is highly appreciated!
#!/bin/sh
# Clear all existing rules.
iptables -F
# ACCEPT connections for loopback network connection, 127.0.0.1.
iptables -A INPUT -i lo -j ACCEPT
# ALLOW established traffic
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# DROP packets that are NEW but does not have the SYN but set.
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
# DROP fragmented packets, as there is no way to tell the source and destination ports of such a packet.
iptables -A INPUT -f -j DROP
# DROP packets with all tcp flags set (XMAS packets).
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
# DROP packets with no tcp flags set (NULL packets).
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
# ALLOW ssh traffic (and prevent against DoS attacks)
iptables -A INPUT -p tcp --dport ssh -m limit --limit 1/s -j ACCEPT
# ALLOW http traffic (and prevent against DoS attacks)
iptables -A INPUT -p tcp --dport http -m limit --limit 5/s -j ACCEPT
# ALLOW mysql traffic (and prevent against DoS attacks)
iptables -A INPUT -p tcp --dport mysql -m limit --limit 25/s -j ACCEPT
# DROP any other traffic.
iptables -A INPUT -j DROP
