Catatan IPTALBES

Di bawah ini catatan /etc/sysconfig/iptables yang pernah saya gunakan.
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#==========================================================================================================
#RFC 1918
-A INPUT -i eth0 -s 10.0.0.0/24        -j DROP
-A INPUT -i eth0 -s 172.16.0.0/12      -j DROP
-A INPUT -i eth0 -s 192.168.0.0/16     -j DROP
-A INPUT -i eth0 -s 224.0.0.0/4        -j DROP
-A INPUT -i eth0 -s 240.0.0.0/5        -j DROP
#Multicast
-A INPUT -i eth0 -d 127.0.0.0/8        -j DROP
-A INPUT -i eth0 -s 169.254.0.0/16     -j DROP
-A INPUT -i eth0 -s 0.0.0.0/8          -j DROP
-A INPUT -i eth0 -s 240.0.0.0/4        -j DROP
-A INPUT -i eth0 -s 255.255.255.255/32 -j DROP
-A INPUT -i eth0 -s 168.254.0.0/16     -j DROP
-A INPUT -i eth0 -s 248.0.0.0/5        -j DROP
# Drop invalid packets.
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN              -j DROP
-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST              -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,RST FIN,RST              -j DROP
-A INPUT -p tcp -m tcp --tcp-flags ACK,FIN FIN                  -j DROP
-A INPUT -p tcp -m tcp --tcp-flags ACK,URG URG                  -j DROP
# ICMP
#-A RH-Firewall-1-INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
#-A RH-Firewall-1-INPUT -p icmp --icmp-type time-exceeded           -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type echo-reply              -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type echo-request            -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any                     -j DROP
# LOG
# <0>KERN_EMERG:system is unusable               |<3>KERN_ERR:error conditions        |<6>KERN_INFO:informational
# <1>KERN_ALERT:action must be taken immediately |<4>KERN_WARNING:warning conditions  |<7>KERN_DEBUG:debug-level messages
# <2>KERN_CRIT:critical conditions               |<5>KERN_NOTICE:normal but significant condition
#-A RH-Firewall-1-INPUT  -m limit --limit 15/minute -j LOG --log-level 6 --log-prefix "FW_INPUT_DROPPED: "
#-A OUTPUT -m limit --limit 15/minute -j LOG --log-level 7 --log-prefix "FW_OUTPUT_DROPPED: "
#-A INPUT  -m limit --limit 10/second --limit-burst 20 -j LOG --log-level 7 --log-prefix "FW_INPUT_DROPPED: "
#==========================================================================================================
# Open Port : 25(SMTP), 80(HTTP), 443(HTTPS)
#==========================================================================================================
-A RH-Firewall-1-INPUT -m state --state NEW                             -m tcp -p tcp --dport 80  -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW                             -m tcp -p tcp --dport 443 -j ACCEPT
#==========================================================================================================
# Open Port 22(SSH) for Internal IP Only
#==========================================================================================================
-A RH-Firewall-1-INPUT -m state --state NEW -s 10.10.10.0/255.255.255.0 -m tcp -p tcp --dport 22  -j ACCEPT
#==========================================================================================================
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
-A RH-Firewall-1-INPUT -j REJECT -p tcp --reject-with tcp-reset
-A RH-Firewall-1-INPUT -j LOG
-A RH-Firewall-1-INPUT -j DROP
COMMIT