1

I'm thinking about improvements, but what improvements can I apply?

This is my firewall:

#!/bin/bash
# \e[32m = Verde
# \e[31m = Vermelho
# \e[0m = Reset
clear
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP
iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
iptables -t mangle -A PREROUTING -p icmp -j DROP
iptables -t mangle -A PREROUTING -f -j DROP
iptables -A INPUT -s 51.161.19.224/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.161.99.0/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.161.99.32/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.161.99.64/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.161.38.224/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.178.221.0/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 217.182.27.224/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.77.31.32/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.89.81.0/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.89.81.32/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 139.99.240.0/29 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.79.153.72/29 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -p tcp --dport 50000 -j DROP
iptables -A INPUT -p tcp --dport 58491 -m conntrack --ctstate NEW -m recent --set
iptables -A INPUT -p tcp --dport 58491 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 5 -j DROP
iptables -A INPUT -s 94.62.141.90 -p tcp --dport 58491 -j ACCEPT
iptables -A INPUT -p tcp --dport 58491 -j DROP
iptables -A INPUT -s 94.62.141.90 -p tcp --dport 3306 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP
iptables -A OUTPUT -p tcp --dport 58491 -j ACCEPT
iptables -N scan-portas
iptables -A scan-portas -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j RETURN
iptables -A scan-portas -j DROP
echo -e '\e[32mProteção ativada\e[0m'

Is my firewall okay?

Or need some improvements?

4
  • I don't think we can give you an answer, because we don't know your requirements. I do not see a need to use the mangle chain at all, just do it in the INPUT chain. No need for the specific OUTPUT ACCEPT rule, because the default policy is already ACCEPT. Your TCP rules seem excessive, but I didn't dig into the detail. Jun 25, 2020 at 15:37
  • Thanks @DougSmythies So, i will give u some details: DDoS Protection Scan Protection Bad Packets Protecion
    – Gabriel
    Jun 25, 2020 at 15:46
  • You can attempt to mitigate DDoS, but in the end it is impossible to prevent network saturation, if they are determined enough. You might need help from your ISP. I did my best trying to help someone here before, suggest you review all that. Review anything from that user. Jun 25, 2020 at 15:58
  • Im using TCPShield for that. Mitigate 17TBp/s
    – Gabriel
    Jun 25, 2020 at 16:10

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.