#!/bin/sh # For debugging use iptables -v. IPTABLES="/sbin/iptables" MODPROBE="/sbin/modprobe" RMMOD="/sbin/rmmod" # Logging options. #------------------------------------------------------------------------------ LOG="LOG --log-level debug --log-tcp-sequence --log-tcp-options" LOG="$LOG --log-ip-options" # Defaults for rate limiting #------------------------------------------------------------------------------ RLIMIT="-m limit --limit 3/s --limit-burst 8" # Load required kernel modules #------------------------------------------------------------------------------ $MODPROBE ip_conntrack $MODPROBE ip_conntrack_ftp $MODPROBE ip_tables $MODPROBE iptable_filter $MODPROBE ipt_LOG $MODPROBE ipt_state # Disable IP forwarding. echo 0 > /proc/sys/net/ipv4/ip_forward # Enable IP spoofing protection * for i in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $i; done # Protect against SYN flood attacks * echo 1 > /proc/sys/net/ipv4/tcp_syncookies # Ignore all incoming ICMP echo requests * echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all # Ignore ICMP echo requests to broadcast * echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Log packets with impossible addresses. * for i in /proc/sys/net/ipv4/conf/*/log_martians; do echo 1 > $i; done # Don't log invalid responses to broadcast * echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses # Don't accept or send ICMP redirects. * for i in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo 0 > $i; done for i in /proc/sys/net/ipv4/conf/*/send_redirects; do echo 0 > $i; done # Don't accept source routed packets. * for i in /proc/sys/net/ipv4/conf/*/accept_source_route; do echo 0 > $i; done # Drop everything by default.* $IPTABLES -P INPUT DROP $IPTABLES -P FORWARD DROP $IPTABLES -P OUTPUT DROP # Set the nat/mangle/raw tables' chains to ACCEPT $IPTABLES -t nat -P PREROUTING ACCEPT $IPTABLES -t nat -P OUTPUT ACCEPT $IPTABLES -t nat -P POSTROUTING ACCEPT $IPTABLES -t mangle -P PREROUTING ACCEPT $IPTABLES -t mangle -P INPUT ACCEPT $IPTABLES -t mangle -P FORWARD ACCEPT $IPTABLES -t mangle -P OUTPUT ACCEPT $IPTABLES -t mangle -P POSTROUTING ACCEPT # Delete all * $IPTABLES -F $IPTABLES -t nat -F $IPTABLES -t mangle -F # Delete all * $IPTABLES -X $IPTABLES -t nat -X $IPTABLES -t mangle -X # Zero all packets and counters. * $IPTABLES -Z $IPTABLES -t nat -Z $IPTABLES -t mangle -Z # LOG packets, then ACCEPT. $IPTABLES -N ACCEPTLOG $IPTABLES -A ACCEPTLOG -j $LOG $RLIMIT --log-prefix "ACCEPT " $IPTABLES -A ACCEPTLOG -j ACCEPT # LOG packets, then DROP. $IPTABLES -N DROPLOG $IPTABLES -A DROPLOG -j $LOG $RLIMIT --log-prefix "DROP " $IPTABLES -A DROPLOG -j DROP # LOG packets, then REJECT. # TCP packets are rejected with a TCP reset. $IPTABLES -N REJECTLOG $IPTABLES -A REJECTLOG -j $LOG $RLIMIT --log-prefix "REJECT " $IPTABLES -A REJECTLOG -p tcp -j REJECT --reject-with tcp-reset $IPTABLES -A REJECTLOG -j REJECT # Make It Even Harder To Multi-PING $IPTABLES -A INPUT -p icmp -m limit --limit 1/s --limit-burst 2 -j ACCEPT $IPTABLES -A INPUT -p icmp -m limit --limit 1/s --limit-burst 2 -j LOG --log-prefix PING-DROP: $IPTABLES -A INPUT -p icmp -j DROP $IPTABLES -A OUTPUT -p icmp -j ACCEPT # First, drop all fragmented ICMP packets (almost always malicious). $IPTABLES -A INPUT -p icmp --fragment -j DROPLOG $IPTABLES -A OUTPUT -p icmp --fragment -j DROPLOG $IPTABLES -A FORWARD -p icmp --fragment -j DROPLOG # Allow all ESTABLISHED ICMP traffic. $IPTABLES -A INPUT -p icmp -m state --state ESTABLISHED -j ACCEPT $RLIMIT $IPTABLES -A OUTPUT -p icmp -m state --state ESTABLISHED -j ACCEPT $RLIMIT # Allow some parts of the RELATED ICMP traffic, block the rest. $IPTABLES -A INPUT -p icmp -m state --state RELATED -j RELATED_ICMP $RLIMIT $IPTABLES -A OUTPUT -p icmp -m state --state RELATED -j RELATED_ICMP $RLIMIT # Allow incoming ICMP echo requests (ping), but only rate-limited. $IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT $RLIMIT # Allow outgoing ICMP echo requests (ping), but only rate-limited. $IPTABLES -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT $RLIMIT # Drop any other ICMP traffic. $IPTABLES -A INPUT -p icmp -j DROPLOG $IPTABLES -A OUTPUT -p icmp -j DROPLOG $IPTABLES -A FORWARD -p icmp -j DROPLOG # Allow loopback interface to do anything. * $IPTABLES -A INPUT -i lo -j ACCEPT $IPTABLES -A OUTPUT -o lo -j ACCEPT # Allow incoming connections related to existing allowed connections. * $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Allow outgoing connections EXCEPT invalid * $IPTABLES -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT # We don't care about Milkosoft, Drop SMB/CIFS/etc.. $IPTABLES -A INPUT -p tcp -m multiport --dports 135,137,138,139,445,1433,1434 -j DROP $IPTABLES -A INPUT -p udp -m multiport --dports 135,137,138,139,445,1433,1434 -j DROP # Explicitly drop invalid incoming traffic $IPTABLES -A INPUT -m state --state INVALID -j DROP # Drop invalid outgoing traffic, too. $IPTABLES -A OUTPUT -m state --state INVALID -j DROP # If we would use NAT, INVALID packets would pass - BLOCK them anyways $IPTABLES -A FORWARD -m state --state INVALID -j DROP # PORT Scanners (stealth also) $IPTABLES -A INPUT -m state --state NEW -p tcp --tcp-flags ALL ALL -j DROP $IPTABLES -A INPUT -m state --state NEW -p tcp --tcp-flags ALL NONE -j DROP # Some anti-spoofing rules $IPTABLES -N SYN_FLOOD $IPTABLES -A INPUT -p tcp --syn -j SYN_FLOOD $IPTABLES -A SYN_FLOOD -m limit --limit 2/s --limit-burst 6 -j RETURN $IPTABLES -A SYN_FLOOD -j DROP # Allow outgoing DNS requests. Few things will work without this. $IPTABLES -A OUTPUT -m state --state NEW -p udp --dport 53 -j ACCEPT $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT # Allow outgoing HTTP requests. Unencrypted, use with care. $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT # Allow outgoing HTTPS requests. $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT # Allow outgoing SMTPS requests. Do NOT allow unencrypted SMTP! # $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 465 -j ACCEPT # Allow outgoing "submission" (RFC 2476) requests. $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 587 -j ACCEPT # Allow outgoing SSH requests. $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT # Allow outgoing FTP requests. Unencrypted, use with care. $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT # Allow outgoing MySQL requests. Unencrypted, use with care. $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 3306 -j ACCEPT # Allow incoming DNS requests. $IPTABLES -A INPUT -m state --state NEW -p udp --dport 53 -j ACCEPT $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT # Allow incoming HTTP requests. $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT # Allow incoming HTTPS requests. $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT # Allow incoming SMTP requests. $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT # Allow incoming SSH requests. $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT # Allow incoming FTP requests. $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT # Allow incoming MySQL requests. $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 3306 -j ACCEPT # Explicitly log and reject everything else. #------------------------------------------------------------------------------ # Use REJECT instead of REJECTLOG if you don't need/want logging. $IPTABLES -A INPUT -j REJECTLOG $IPTABLES -A OUTPUT -j REJECTLOG $IPTABLES -A FORWARD -j REJECTLOG exit 0
By: https://forums.digitalpoint.com/threads/how-to-avoid-syn_recv.2181633/