Construtor de Regras de Firewall Linux iptables e Gerador de Scripts Shell
Construa regras iptables para cadeias INPUT/FORWARD/OUTPUT, inspeção de estado conntrack, proteção contra SYN flood, redirecionamento NAT e exportação de scripts shell.
Adicionar Regra de Firewall
Regras configuradas (5)Marcar/desmarcar para ativar/desativar
#1INPUTTCP :22 // SSH administration (protected by recent anti-bruteforce)
ACCEPT
#2INPUTTCP :80 // Standard HTTP Web traffic
ACCEPT
#3INPUTTCP :443 // Encrypted HTTPS / TLS Web traffic
ACCEPT
#4INPUTTCP :9100 from 10.0.0.0/16// Prometheus node exporter restricted to private VPC
ACCEPT
#5INPUTALL // Log dropped unsolicited incoming packets
LOG
#!/usr/bin/env bash
# ==============================================================================
# Linux iptables Firewall Configuration Script
# Generated by ToolsAA iptables Rule Generator (https://toolsaa.com)
# 100% Client-Side Netfilter Firewall Builder
# ==============================================================================
set -euo pipefail
# Verify root privileges
if [[ $EUID -ne 0 ]]; then
echo "Error: This script must be executed as root (e.g. sudo bash $0)" >&2
exit 1
fi
# Find iptables binaries
IPTABLES="$(command -v iptables || echo '/sbin/iptables')"
SYSCTL="$(command -v sysctl || echo '/sbin/sysctl')"
echo "==> Applying Linux iptables firewall rules..."
# ------------------------------------------------------------------------------
# 1. Kernel Parameter Hardening & Anti-Spoofing (sysctl)
# ------------------------------------------------------------------------------
$SYSCTL -w net.ipv4.tcp_syncookies=1 >/dev/null
$SYSCTL -w net.ipv4.conf.all.rp_filter=1 >/dev/null
$SYSCTL -w net.ipv4.conf.default.rp_filter=1 >/dev/null
$SYSCTL -w net.ipv4.conf.all.accept_source_route=0 >/dev/null
$SYSCTL -w net.ipv4.conf.all.accept_redirects=0 >/dev/null
$SYSCTL -w net.ipv4.icmp_echo_ignore_broadcasts=1 >/dev/null
$SYSCTL -w net.ipv4.icmp_ignore_bogus_error_responses=1 >/dev/null
# ------------------------------------------------------------------------------
# 2. Flush Existing Rules & Reset Counters
# ------------------------------------------------------------------------------
$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z
$IPTABLES -t nat -F || true
$IPTABLES -t nat -X || true
$IPTABLES -t mangle -F || true
$IPTABLES -t mangle -X || true
$IPTABLES -t raw -F || true
$IPTABLES -t raw -X || true
# ------------------------------------------------------------------------------
# 3. Set Default Chain Policies
# ------------------------------------------------------------------------------
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT ACCEPT
# ------------------------------------------------------------------------------
# 4. Core Defensive Rules: Loopback, Conntrack & Invalid Drops
# ------------------------------------------------------------------------------
# Allow unlimited loopback traffic (localhost)
$IPTABLES -A INPUT -i lo -j ACCEPT -m comment --comment "Allow all loopback inbound"
$IPTABLES -A OUTPUT -o lo -j ACCEPT -m comment --comment "Allow all loopback outbound"
# Drop packets in INVALID connection state immediately
$IPTABLES -A INPUT -m conntrack --ctstate INVALID -j DROP -m comment --comment "Drop invalid packets"
# Stateful connection tracking: Allow established and related traffic
$IPTABLES -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Stateful allow established/related"
$IPTABLES -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Stateful allow established/related"
# ------------------------------------------------------------------------------
# 5. Anti-DDoS: TCP SYN Flood Protection Chain
# ------------------------------------------------------------------------------
$IPTABLES -N SYN_FLOOD || true
$IPTABLES -A INPUT -p tcp --syn -j SYN_FLOOD
$IPTABLES -A SYN_FLOOD -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A SYN_FLOOD -j DROP -m comment --comment "Drop excess SYN flood packets"
# ------------------------------------------------------------------------------
# 6. Port Scan & Malicious Flag Mitigation
# ------------------------------------------------------------------------------
# Drop NULL packets (no flags set)
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j DROP -m comment --comment "Drop NULL scan packets"
# Drop XMAS packets (FIN, PSH, URG flags)
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP -m comment --comment "Drop XMAS scan packets"
$IPTABLES -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP -m comment --comment "Drop XMAS variants"
# Drop SYN-FIN scans
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP -m comment --comment "Drop SYN-FIN packets"
# Drop SYN-RST scans
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP -m comment --comment "Drop SYN-RST packets"
# ------------------------------------------------------------------------------
# 7. ICMP / Ping Echo-Request Control
# ------------------------------------------------------------------------------
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 2 -j ACCEPT -m comment --comment "Rate-limited ICMP ping"
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j DROP -m comment --comment "Drop excess ICMP pings"
# ------------------------------------------------------------------------------
# 8. SSH Anti-Bruteforce Rate Limiter (iptables recent module)
# ------------------------------------------------------------------------------
$IPTABLES -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name SSH_ATTEMPTS
$IPTABLES -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j DROP -m comment --comment "Drop SSH bruteforce flood"
# ------------------------------------------------------------------------------
# 9. User-Configured Filter Chain Rules
# ------------------------------------------------------------------------------
# Rule 1: SSH administration (protected by recent anti-bruteforce)
$IPTABLES -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT -m comment --comment "SSH administration (protected by recent anti-bruteforce)"
# Rule 2: Standard HTTP Web traffic
$IPTABLES -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT -m comment --comment "Standard HTTP Web traffic"
# Rule 3: Encrypted HTTPS / TLS Web traffic
$IPTABLES -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT -m comment --comment "Encrypted HTTPS / TLS Web traffic"
# Rule 4: Prometheus node exporter restricted to private VPC
$IPTABLES -A INPUT -i eth0 -p tcp -s 10.0.0.0/16 --dport 9100 -j ACCEPT -m comment --comment "Prometheus node exporter restricted to private VPC"
# Rule 5: Log dropped unsolicited incoming packets
$IPTABLES -A INPUT -m limit --limit 5/min -j LOG --log-prefix "[IPT-DROP-WEB]: " --log-level 4 -m comment --comment "Log dropped unsolicited incoming packets"
echo "==> Linux iptables firewall rules successfully applied!"
echo "==> Active rules summary:"
$IPTABLES -L -v -n --line-numbers | head -n 35Regras de filtro ativas
5 Regras · 0 Portas NAT
Diretivas NAT
SYN Flood · Anti-SSH
Diretivas de segurança
Bash .sh · rules.v4 · systemd
Gerador 100% Privado no Cliente
Sem envios para o servidor nem telemetria. Seus IPs, sub-redes, portas internas e topologia de rede são processados estritamente na memória local do navegador.
Inspeção com Estado e Mitigação DDoS
Inspeção de pacotes com estado (conntrack), mitigação de ataques SYN flood com rate limit, descarte de pacotes inválidos, loopback e proteção anti-spoofing (rp_filter).
Script de Shell para Produção e Exportação Systemd
Exporte scripts Bash para produção com timer seguro de reversão (rollback), compatibilidade com iptables-save e diretivas de persistência no systemd.