Generador de Reglas de Cortafuegos Linux iptables y Scripts Shell

#!/usr/bin/env bash
# ==============================================================================
# Linux iptables Firewall Configuration Script
# Generated by ToolsAA iptables Rule Generator (https://toolsaa.com)
# 100% Client-Side Netfilter Firewall Builder
# ==============================================================================
set -euo pipefail

# Verify root privileges
if [[ $EUID -ne 0 ]]; then
   echo "Error: This script must be executed as root (e.g. sudo bash $0)" >&2
   exit 1
fi

# Find iptables binaries
IPTABLES="$(command -v iptables || echo '/sbin/iptables')"
SYSCTL="$(command -v sysctl || echo '/sbin/sysctl')"

echo "==> Applying Linux iptables firewall rules..."

# ------------------------------------------------------------------------------
# 1. Kernel Parameter Hardening & Anti-Spoofing (sysctl)
# ------------------------------------------------------------------------------
$SYSCTL -w net.ipv4.tcp_syncookies=1 >/dev/null
$SYSCTL -w net.ipv4.conf.all.rp_filter=1 >/dev/null
$SYSCTL -w net.ipv4.conf.default.rp_filter=1 >/dev/null
$SYSCTL -w net.ipv4.conf.all.accept_source_route=0 >/dev/null
$SYSCTL -w net.ipv4.conf.all.accept_redirects=0 >/dev/null
$SYSCTL -w net.ipv4.icmp_echo_ignore_broadcasts=1 >/dev/null
$SYSCTL -w net.ipv4.icmp_ignore_bogus_error_responses=1 >/dev/null

# ------------------------------------------------------------------------------
# 2. Flush Existing Rules & Reset Counters
# ------------------------------------------------------------------------------
$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z
$IPTABLES -t nat -F || true
$IPTABLES -t nat -X || true
$IPTABLES -t mangle -F || true
$IPTABLES -t mangle -X || true
$IPTABLES -t raw -F || true
$IPTABLES -t raw -X || true

# ------------------------------------------------------------------------------
# 3. Set Default Chain Policies
# ------------------------------------------------------------------------------
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT ACCEPT

# ------------------------------------------------------------------------------
# 4. Core Defensive Rules: Loopback, Conntrack & Invalid Drops
# ------------------------------------------------------------------------------
# Allow unlimited loopback traffic (localhost)
$IPTABLES -A INPUT -i lo -j ACCEPT -m comment --comment "Allow all loopback inbound"
$IPTABLES -A OUTPUT -o lo -j ACCEPT -m comment --comment "Allow all loopback outbound"
# Drop packets in INVALID connection state immediately
$IPTABLES -A INPUT -m conntrack --ctstate INVALID -j DROP -m comment --comment "Drop invalid packets"
# Stateful connection tracking: Allow established and related traffic
$IPTABLES -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Stateful allow established/related"
$IPTABLES -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Stateful allow established/related"

# ------------------------------------------------------------------------------
# 5. Anti-DDoS: TCP SYN Flood Protection Chain
# ------------------------------------------------------------------------------
$IPTABLES -N SYN_FLOOD || true
$IPTABLES -A INPUT -p tcp --syn -j SYN_FLOOD
$IPTABLES -A SYN_FLOOD -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A SYN_FLOOD -j DROP -m comment --comment "Drop excess SYN flood packets"

# ------------------------------------------------------------------------------
# 6. Port Scan & Malicious Flag Mitigation
# ------------------------------------------------------------------------------
# Drop NULL packets (no flags set)
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j DROP -m comment --comment "Drop NULL scan packets"
# Drop XMAS packets (FIN, PSH, URG flags)
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP -m comment --comment "Drop XMAS scan packets"
$IPTABLES -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP -m comment --comment "Drop XMAS variants"
# Drop SYN-FIN scans
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP -m comment --comment "Drop SYN-FIN packets"
# Drop SYN-RST scans
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP -m comment --comment "Drop SYN-RST packets"

# ------------------------------------------------------------------------------
# 7. ICMP / Ping Echo-Request Control
# ------------------------------------------------------------------------------
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 2 -j ACCEPT -m comment --comment "Rate-limited ICMP ping"
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j DROP -m comment --comment "Drop excess ICMP pings"

# ------------------------------------------------------------------------------
# 8. SSH Anti-Bruteforce Rate Limiter (iptables recent module)
# ------------------------------------------------------------------------------
$IPTABLES -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name SSH_ATTEMPTS
$IPTABLES -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j DROP -m comment --comment "Drop SSH bruteforce flood"

# ------------------------------------------------------------------------------
# 9. User-Configured Filter Chain Rules
# ------------------------------------------------------------------------------
# Rule 1: SSH administration (protected by recent anti-bruteforce)
$IPTABLES -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT -m comment --comment "SSH administration (protected by recent anti-bruteforce)"
# Rule 2: Standard HTTP Web traffic
$IPTABLES -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT -m comment --comment "Standard HTTP Web traffic"
# Rule 3: Encrypted HTTPS / TLS Web traffic
$IPTABLES -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT -m comment --comment "Encrypted HTTPS / TLS Web traffic"
# Rule 4: Prometheus node exporter restricted to private VPC
$IPTABLES -A INPUT -i eth0 -p tcp -s 10.0.0.0/16 --dport 9100 -j ACCEPT -m comment --comment "Prometheus node exporter restricted to private VPC"
# Rule 5: Log dropped unsolicited incoming packets
$IPTABLES -A INPUT -m limit --limit 5/min -j LOG --log-prefix "[IPT-DROP-WEB]: " --log-level 4 -m comment --comment "Log dropped unsolicited incoming packets"

echo "==> Linux iptables firewall rules successfully applied!"
echo "==> Active rules summary:"
$IPTABLES -L -v -n --line-numbers | head -n 35