Cacher is the code snippet organizer for pro developers

resource http://www.thegeekstuff.com/2011/06/iptables-rules-examples/

// clean talbes
iptables --flush

// Default policy
iptables -A OUTPUT DROP
iptables -A INPUT DROP


// allow Loopback 
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

// allow outbound dns 
iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT

// allow all outgoing ssh
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
// allow ssh for specifik IP
iptables -A INPUT -i eth0 -p tcp -s 31.193.197.136 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 79.161.243.110 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 91.207.159.231 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

// preventing ddos atack
iptables -A INPUT -p tcp --dport 80 -m limit --limit 70/minute --limit-burst 100 -j ACCEPT

// http
iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d 172.17.100.0/24 -m state --state ESTABLISHED -j ACCEPT

// isolating internal network for http 
iptables -I OUTPUT 4 -o eth0 -s 172.17.100.0/24 -d 172.17.100.0/24 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
// allow to answer for http only to destined ip 
iptables -I OUTPUT 4 -o eth0 -s 172.17.100.0/24 -d 31.193.197.136 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT