firewall

#!/bin/sh

# to get this activated on a fedora system:
# (1) run the script:
#  sudo ./firewall
# (2) restart iptables
#  sudo systemctl restart iptables.service
#
# after testing to make sure everything still works
# (3) save the configuration so it will be in effect again on reboot:
#  su -c "iptables-save > /etc/sysconfig/iptables"


# copied from http://www.linuxhelp.net/guides/iptables
iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F -t mangle
iptables -F -t nat
iptables -X

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

# output from iptables-save
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

# allow access to web server HTTP and HTTPS
#iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
#iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT

######## jetty setup
# redirect which filters out external packets directed at the redirect target
# taken from http://www.linuxquestions.org/questions/linux-security-4/port-mapping-with-iptables-781036/
# mark packets from :8080 on the outside
iptables -t mangle -A PREROUTING -i p2p1 -p tcp --dport 8080 -j MARK --set-mark 666
# redirect packets from :80 to :8080
iptables -t nat -A PREROUTING -i p2p1 -p tcp --dport 80 -j REDIRECT --to-port 8080
# reject packets with the mark (includes the :8080s from the outside)
iptables -A INPUT -m mark --mark 666 -j REJECT --reject-with icmp-host-prohibited
# accept other packets on :8080
iptables -A INPUT -i p2p1 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT

#iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT


#### mysql replication from prime on the internal network
#iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -s xx.xx.xx.xx -i eth1 -d xx.xx.xx.xx -j ACCEPT

#### postgres
# accept from anywhere, for development purposes (use stricter source and dest in prod)
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 5432 -j ACCEPT

# output from iptables-save
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited