Générateur de règles de pare-feu Linux iptables et de scripts Shell
Générez des règles iptables pour les chaînes INPUT/FORWARD/OUTPUT, l'inspection avec état conntrack, la protection SYN flood, la redirection NAT et l'exportation shell.
Ajouter une règle de pare-feu
Règles configurées (5)Cocher pour activer/désactiver
#1INPUTTCP :22 // SSH administration (protected by recent anti-bruteforce)
ACCEPT
#2INPUTTCP :80 // Standard HTTP Web traffic
ACCEPT
#3INPUTTCP :443 // Encrypted HTTPS / TLS Web traffic
ACCEPT
#4INPUTTCP :9100 from 10.0.0.0/16// Prometheus node exporter restricted to private VPC
ACCEPT
#5INPUTALL // Log dropped unsolicited incoming packets
LOG
#!/usr/bin/env bash
# ==============================================================================
# Linux iptables Firewall Configuration Script
# Generated by ToolsAA iptables Rule Generator (https://toolsaa.com)
# 100% Client-Side Netfilter Firewall Builder
# ==============================================================================
set -euo pipefail
# Verify root privileges
if [[ $EUID -ne 0 ]]; then
echo "Error: This script must be executed as root (e.g. sudo bash $0)" >&2
exit 1
fi
# Find iptables binaries
IPTABLES="$(command -v iptables || echo '/sbin/iptables')"
SYSCTL="$(command -v sysctl || echo '/sbin/sysctl')"
echo "==> Applying Linux iptables firewall rules..."
# ------------------------------------------------------------------------------
# 1. Kernel Parameter Hardening & Anti-Spoofing (sysctl)
# ------------------------------------------------------------------------------
$SYSCTL -w net.ipv4.tcp_syncookies=1 >/dev/null
$SYSCTL -w net.ipv4.conf.all.rp_filter=1 >/dev/null
$SYSCTL -w net.ipv4.conf.default.rp_filter=1 >/dev/null
$SYSCTL -w net.ipv4.conf.all.accept_source_route=0 >/dev/null
$SYSCTL -w net.ipv4.conf.all.accept_redirects=0 >/dev/null
$SYSCTL -w net.ipv4.icmp_echo_ignore_broadcasts=1 >/dev/null
$SYSCTL -w net.ipv4.icmp_ignore_bogus_error_responses=1 >/dev/null
# ------------------------------------------------------------------------------
# 2. Flush Existing Rules & Reset Counters
# ------------------------------------------------------------------------------
$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z
$IPTABLES -t nat -F || true
$IPTABLES -t nat -X || true
$IPTABLES -t mangle -F || true
$IPTABLES -t mangle -X || true
$IPTABLES -t raw -F || true
$IPTABLES -t raw -X || true
# ------------------------------------------------------------------------------
# 3. Set Default Chain Policies
# ------------------------------------------------------------------------------
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT ACCEPT
# ------------------------------------------------------------------------------
# 4. Core Defensive Rules: Loopback, Conntrack & Invalid Drops
# ------------------------------------------------------------------------------
# Allow unlimited loopback traffic (localhost)
$IPTABLES -A INPUT -i lo -j ACCEPT -m comment --comment "Allow all loopback inbound"
$IPTABLES -A OUTPUT -o lo -j ACCEPT -m comment --comment "Allow all loopback outbound"
# Drop packets in INVALID connection state immediately
$IPTABLES -A INPUT -m conntrack --ctstate INVALID -j DROP -m comment --comment "Drop invalid packets"
# Stateful connection tracking: Allow established and related traffic
$IPTABLES -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Stateful allow established/related"
$IPTABLES -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Stateful allow established/related"
# ------------------------------------------------------------------------------
# 5. Anti-DDoS: TCP SYN Flood Protection Chain
# ------------------------------------------------------------------------------
$IPTABLES -N SYN_FLOOD || true
$IPTABLES -A INPUT -p tcp --syn -j SYN_FLOOD
$IPTABLES -A SYN_FLOOD -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A SYN_FLOOD -j DROP -m comment --comment "Drop excess SYN flood packets"
# ------------------------------------------------------------------------------
# 6. Port Scan & Malicious Flag Mitigation
# ------------------------------------------------------------------------------
# Drop NULL packets (no flags set)
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j DROP -m comment --comment "Drop NULL scan packets"
# Drop XMAS packets (FIN, PSH, URG flags)
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP -m comment --comment "Drop XMAS scan packets"
$IPTABLES -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP -m comment --comment "Drop XMAS variants"
# Drop SYN-FIN scans
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP -m comment --comment "Drop SYN-FIN packets"
# Drop SYN-RST scans
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP -m comment --comment "Drop SYN-RST packets"
# ------------------------------------------------------------------------------
# 7. ICMP / Ping Echo-Request Control
# ------------------------------------------------------------------------------
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 2 -j ACCEPT -m comment --comment "Rate-limited ICMP ping"
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j DROP -m comment --comment "Drop excess ICMP pings"
# ------------------------------------------------------------------------------
# 8. SSH Anti-Bruteforce Rate Limiter (iptables recent module)
# ------------------------------------------------------------------------------
$IPTABLES -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name SSH_ATTEMPTS
$IPTABLES -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j DROP -m comment --comment "Drop SSH bruteforce flood"
# ------------------------------------------------------------------------------
# 9. User-Configured Filter Chain Rules
# ------------------------------------------------------------------------------
# Rule 1: SSH administration (protected by recent anti-bruteforce)
$IPTABLES -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT -m comment --comment "SSH administration (protected by recent anti-bruteforce)"
# Rule 2: Standard HTTP Web traffic
$IPTABLES -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT -m comment --comment "Standard HTTP Web traffic"
# Rule 3: Encrypted HTTPS / TLS Web traffic
$IPTABLES -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT -m comment --comment "Encrypted HTTPS / TLS Web traffic"
# Rule 4: Prometheus node exporter restricted to private VPC
$IPTABLES -A INPUT -i eth0 -p tcp -s 10.0.0.0/16 --dport 9100 -j ACCEPT -m comment --comment "Prometheus node exporter restricted to private VPC"
# Rule 5: Log dropped unsolicited incoming packets
$IPTABLES -A INPUT -m limit --limit 5/min -j LOG --log-prefix "[IPT-DROP-WEB]: " --log-level 4 -m comment --comment "Log dropped unsolicited incoming packets"
echo "==> Linux iptables firewall rules successfully applied!"
echo "==> Active rules summary:"
$IPTABLES -L -v -n --line-numbers | head -n 35Règles de filtrage actives
5 Règles · 0 Ports NAT
Directives NAT
SYN Flood · Anti-SSH
Directives de renforcement
Bash .sh · rules.v4 · systemd
Générateur 100% privé côté client
Aucun envoi vers un serveur ni télémétrie. Vos adresses IP, sous-réseaux, ports internes et topologies sont traités exclusivement dans la mémoire locale de votre navigateur.
Inspection avec état et atténuation DDoS
Inspection avec état (conntrack), limitation du débit SYN flood, rejet des paquets invalides, boucle locale et protection contre l'usurpation (rp_filter).
Script Shell de production et export Systemd
Exportez des scripts Bash prêts pour la production avec temporisateur de rollback sécurisé, compatibilité iptables-save et persistance systemd.