iptables
Firewall rules intended for but not limited to single hosts. (router/firewall)
Function:
Mangle table:
Drop (quick) before conntrack, bogus tcp pkts and portscanners
Raw table:
Allow (quick) before conntrack, tcp pkts that set syn flag and jump to notrack
Filter table:
Allow (quick) loopback iface traffic <br>
Allow (quick) ESTABLISHED and RELATED traffic <br>
Stateful Packet Inspection filters to drop bogus traffic to ensure only legitimate traffic reaches the host/network. <br>
Opened ports/services <br>
SAFEZONE for whitelisted IP's (requires changing rules in IN_CUSTOMRULES chain to be more meaningful) <br>
NAT table:
NAT connections destined for VPN clients
Misc:
Logging functionality:
one of the INPUT chain rules logs packets before the default drop rule so in order to filter out the fluff we'll copy the records to a seperate logfile.
Process:
Create the following file > /etc/rsyslog.d/iptables.conf
and use the following to log dropped packets in a seperate file from the syslog file.
:msg, contains, "[IPTABLES-BLOCKED]" - /var/log/iptables.log
& ~
then restart syslog process (assuming you're on ubuntu/debian) with the following command (as root):
/etc/init.d/rsyslog restart
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent