🎯 Real-World Configurations

Web Server Firewall Template

#!/bin/bash
# Web server iptables rules script

# Flush all rules
iptables -F
iptables -t nat -F

# Set default policy: deny everything, only open what's needed
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow loopback interface
iptables -A INPUT -i lo -j ACCEPT

# Allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH (restrict source IP for better security)
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

# Allow HTTP and HTTPS
iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT

# Allow ICMP (ping)
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Log and drop everything else
iptables -A INPUT -j LOG --log-prefix "Dropped: " --log-level 4
iptables -A INPUT -j DROP

echo "Firewall rules loaded"

Anti-Brute-Force (SSH Rate Limiting)

# Create custom chain
iptables -N SSH_BRUTE

# Maximum 4 SSH connection attempts per IP per minute
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update \
  --seconds 60 --hitcount 4 --name SSH -j SSH_BRUTE

# Drop if limit exceeded
iptables -A SSH_BRUTE -j DROP

# Block specific malicious IP
iptables -I INPUT -s 10.0.0.66 -j DROP

# Block entire IP range
iptables -I INPUT -s 10.0.0.0/16 -j DROP

SYN Flood Protection

# Limit SYN packet rate (max 1 new connection per second)
iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT

# Use connlimit to restrict concurrent connections per IP
iptables -A INPUT -p tcp --dport 80 -m connlimit --connlimit-above 50 -j DROP

# Drop invalid packets
iptables -A INPUT -m state --state INVALID -j DROP

# Drop XMAS and NULL packets (port scanning probes)
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP