NetFilter - Ohhh... Packets - Filter 'Em Up!

#Firewall IP Address is 10.0.0.1
#Private Network 192.168.0.0 and the Ethernet connection name is eth0
#Website IP Address is 10.0.0.2

#First Turn Off IP Forwarding

echo 0 > /proc/sys/net/ipv4/ip_forward

#Flush IP Table rules

iptables -F INPUT
iptables -F OUTPUT
iptables _F FORWARD

#Set Default Policy Rules

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT


# - - - Check IP Spoofing - - -

#Drop Internal Network Packets with ANY External Source Address
iptables -A INPUT -j LOG -i eth1 \! -s 192.168.0.1/24
iptables -A INPUT -j DROP -i eth1 \! -s 192.168.0.1/24
iptables -A FORWARD -j DROP -i eth1 \! -s 192.168.0.1/24

#Drop External Network Packets with Internal Source Address
iptables -A INPUT -j DROP \! -i eth1 -s 192.168.0.1/24
iptables -A FORWARD -j DROP \! -i eth1 -s 192.168.0.1/24


#Drop External Network Packets not on the Local Interface with Local Host Address
iptables -A INPUT -j DROP -i \! lo -s 127.0.0.0/255.0.0.0
iptables -A FORWARD -j DROP -i \! lo -s 127.0.0.0/255.0.0.0

# - - - Check IP Spoofing - - -


#Allow Incoming Messages for Users on the Firewall

iptables -A INPUT -j ACCEPT -i lo

# Allow Communication to the Web Server on port www i.e. port 80

iptables -A INPUT -j ACCEPT -p tcp -i eth0 --dport www -s 10.0.0.2

#Allow Established Connections from the Web Server to Internal Network

iptables -A INPUT -m state --state ESTABLISHED,RELATED -i eth0 -p tcp /
--sport www -s 10.0.0.2 -d 192.168.0.0/24 -j ACCEPT

#Prevent New Connections from the Web Server to Internal Network

iptables -A INPUT -m state --state NEW -o eth0 -p tcp /
--sport www -s 10.0.0.2 -d 192.168.0.0/24 -j DROP


# - - - Allow Established Outside Communication to Your System - - -

#Allow Communications to the Firewall, except for ICMP Packets
iptables -A INPUT -m state --state ESTABLISHED,RELATED -i eth0 -p \! icmp -j ACCEPT

#Prevent NEWLY INITIATING Connections

iptables -A INPUT -m state --state NEW -i eth0 -j DROP
iptables -A FORWARD -m state --state NEW -i eth0 -j DROP

#Allow all Local Communication To and From the Firewall on eth1 to the Internal Network

iptables -A INPUT -j ACCEPT -p all -i eth1 -s 192.168.0.0/24

# - - - Allow Established Outside Communication to Your System - - -


#Setup Masqueraing to allow Internal Machines to Saftely Acces the Outside Network

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE


# - - - Accept ICMP Ping and Destination Unreachable Messages - - -

#Others will be Rejected by the INPUT and OUTPUT DROP policy

iptables -A INPUT -j ACCEPT -p icmp -i eth0 --icmp-type echo-reply -d 10.0.0.1

iptables -A INPUT -j ACCEPT -p icmp -i eth0 --icmp-type echo-request -d 10.0.0.1

iptables -A INPUT -j ACCEPT -p icmp -i eth0 --icmp-type destination-unreachable -d 10.0.0.1

# - - - Accept ICMP Ping and Destination Unreachable Messages - - -