firewall iptables script

#!/bin/bash
#
# /etc/rc.local: Local multi-user startup script.
#

##on remet a zero le firewall
iptables -F
iptables -t nat -F
iptables -P INPUT DROP
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

###
# Polices par défaut
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

###
# Boucle locale

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT


###
# Création d’une cible local anti xmas et null scan
iptables -N SCANS
iptables -A SCANS -p tcp --tcp-flags FIN,URG,PSH FIN,URG,PSH -j DROP
iptables -A SCANS -p tcp --tcp-flags ALL ALL -j DROP
iptables -A SCANS -p tcp --tcp-flags ALL NONE -j DROP
iptables -A SCANS -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

iptables -A INPUT -j SCANS

###
# Création d’une cible personnalisée pour accepter les connexions établies
iptables -N KEEP_STATE
iptables -A KEEP_STATE -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A KEEP_STATE -m state --state INVALID -j DROP

iptables -A INPUT -j KEEP_STATE
iptables -A OUTPUT -j KEEP_STATE

###
# Services sur la machine locale (FTP, SSH, HTTP)

#iptables -A INPUT -m state --state NEW -p tcp --dport 20-21 -j ACCEPT
#iptables -A INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
#iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT

#CUPS
iptables -A INPUT -p TCP --dport 631 -m state --state NEW -j ACCEPT
#smb
# EPMAP => définit toutes les RPC !
iptables -A INPUT -m state --state NEW -p TCP --dport 135 -j ACCEPT
iptables -A INPUT -m state --state NEW -p UDP --dport 135 -j ACCEPT
# NetBios-NS
iptables -A INPUT -m state --state NEW -p TCP --dport 137 -j ACCEPT
iptables -A INPUT -m state --state NEW -p UDP --dport 137 -j ACCEPT
# NetBios-DGM => exploration du réseau (basé sur SMB browser service)
iptables -A INPUT -m state --state NEW -p UDP --dport 138 -j ACCEPT
# NetBios-SSN => partage fichiers, imprimantes par Microsoft
iptables -A INPUT -m state --state NEW -p TCP --dport 139 -j ACCEPT
# SMB/IP => partage fichiers, imprimantes par SaMBa
iptables -A INPUT -m state --state NEW -p TCP --dport 445 -j ACCEPT
iptables -A INPUT -m state --state NEW -p UDP --dport 445 -j ACCEPT

###
# Connexions vers l’extérieur (FTP, SSH, DNS, HTTP, MSN, POP, IMAP, SMTP)



iptables -A OUTPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -p tcp --dport 1863 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -p tcp --dport 110 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -p tcp --dport 143 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -p tcp --dport 995 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT

iptables -A OUTPUT -m state --state NEW -p udp --dport 6891 -j ACCEPT

#vnccleint
iptables -A OUTPUT -m state --state NEW -p tcp --dport 5900 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -p udp --dport 5900 -j ACCEPT


##jabber
iptables -A OUTPUT --protocol tcp --dport 5222 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT --protocol tcp --sport 5222 -m state --state ESTABLISHED -j ACCEPT