1

I'm thinking about improvements, but what improvements can I apply?

This is my firewall:

#!/bin/bash
# \e[32m = Verde
# \e[31m = Vermelho
# \e[0m = Reset
clear
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP
iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
iptables -t mangle -A PREROUTING -p icmp -j DROP
iptables -t mangle -A PREROUTING -f -j DROP
iptables -A INPUT -s 51.161.19.224/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.161.99.0/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.161.99.32/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.161.99.64/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.161.38.224/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.178.221.0/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 217.182.27.224/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.77.31.32/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.89.81.0/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.89.81.32/27 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 139.99.240.0/29 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -s 51.79.153.72/29 -p tcp --dport 50000 -m comment --comment "TCPShield V4" -j ACCEPT
iptables -A INPUT -p tcp --dport 50000 -j DROP
iptables -A INPUT -p tcp --dport 58491 -m conntrack --ctstate NEW -m recent --set
iptables -A INPUT -p tcp --dport 58491 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 5 -j DROP
iptables -A INPUT -s 94.62.141.90 -p tcp --dport 58491 -j ACCEPT
iptables -A INPUT -p tcp --dport 58491 -j DROP
iptables -A INPUT -s 94.62.141.90 -p tcp --dport 3306 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP
iptables -A OUTPUT -p tcp --dport 58491 -j ACCEPT
iptables -N scan-portas
iptables -A scan-portas -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j RETURN
iptables -A scan-portas -j DROP
echo -e '\e[32mProteção ativada\e[0m'

Is my firewall okay?

Or need some improvements?

  • I don't think we can give you an answer, because we don't know your requirements. I do not see a need to use the mangle chain at all, just do it in the INPUT chain. No need for the specific OUTPUT ACCEPT rule, because the default policy is already ACCEPT. Your TCP rules seem excessive, but I didn't dig into the detail. – Doug Smythies Jun 25 '20 at 15:37
  • Thanks @DougSmythies So, i will give u some details:

    DDoS Protection Scan Protection Bad Packets Protecion

    – Gabriel Jun 25 '20 at 15:46
  • You can attempt to mitigate DDoS, but in the end it is impossible to prevent network saturation, if they are determined enough. You might need help from your ISP. I did my best trying to help someone here before, suggest you review all that. Review anything from that user. – Doug Smythies Jun 25 '20 at 15:58
  • Im using TCPShield for that. Mitigate 17TBp/s – Gabriel Jun 25 '20 at 16:10

0 Answers0