├── etc
    ├── iptables
    │   ├── flush-iptables.sh
    │   ├── flush-ip6tables.sh
    │   ├── iptables.rules
    │   └── ip6tables.rules
    └── systemd
    │   └── system
    │       ├── iptables.service
    │       └── ip6tables.service
├── README.md
└── LICENSE


/etc/iptables/flush-iptables.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | iptables -F
 3 | iptables -X
 4 | iptables -t nat -F
 5 | iptables -t nat -X
 6 | iptables -t mangle -F
 7 | iptables -t mangle -X
 8 | iptables -P INPUT ACCEPT
 9 | iptables -P FORWARD ACCEPT
10 | iptables -P OUTPUT ACCEPT
11 | 


--------------------------------------------------------------------------------
/etc/iptables/flush-ip6tables.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | ip6tables -F
 3 | ip6tables -X
 4 | ip6tables -Z
 5 | for table in $(</proc/net/ip6_tables_names)
 6 | do
 7 |         ip6tables -t $table -F
 8 |         ip6tables -t $table -X
 9 |         ip6tables -t $table -Z
10 | done
11 | ip6tables -P INPUT ACCEPT
12 | ip6tables -P OUTPUT ACCEPT
13 | ip6tables -P FORWARD ACCEPT
14 | 


--------------------------------------------------------------------------------
/etc/systemd/system/iptables.service:
--------------------------------------------------------------------------------
 1 | [Unit]
 2 | Description=Packet Filtering Framework
 3 | DefaultDependencies=no
 4 | After=systemd-sysctl.service
 5 | Before=sysinit.target
 6 | [Service]
 7 | Type=oneshot
 8 | ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules
 9 | ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules
10 | ExecStop=/etc/iptables/flush-iptables.sh
11 | RemainAfterExit=yes
12 | [Install]
13 | WantedBy=multi-user.target
14 | 


--------------------------------------------------------------------------------
/etc/systemd/system/ip6tables.service:
--------------------------------------------------------------------------------
 1 | [Unit]
 2 | Description=Packet Filtering Framework
 3 | DefaultDependencies=no
 4 | After=systemd-sysctl.service
 5 | Before=sysinit.target
 6 | [Service]
 7 | Type=oneshot
 8 | ExecStart=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules
 9 | ExecReload=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules
10 | ExecStop=/etc/iptables/flush-ip6tables.sh
11 | RemainAfterExit=yes
12 | [Install]
13 | WantedBy=multi-user.target
14 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # iptables/ip6tables systemd configuration
 2 | 
 3 | Example of a persistent firewall based on systemd for Debian Jessie.
 4 | 
 5 | ### Install Steps
 6 | ```sh
 7 | cp -r etc/iptables /etc/iptables
 8 | cp -r etc/systemd/system/iptables.service /etc/systemd/system/
 9 | cp -r etc/systemd/system/ip6tables.service /etc/systemd/system/
10 | 
11 | systemctl daemon-reload
12 | 
13 | systemctl enable iptables.service
14 | systemctl enable ip6tables.service
15 | 
16 | systemctl start iptables.service
17 | systemctl start ip6tables.service
18 | ```
19 | 
20 | 


--------------------------------------------------------------------------------
/etc/iptables/iptables.rules:
--------------------------------------------------------------------------------
 1 | *filter
 2 | :INPUT DROP [0:0]
 3 | :FORWARD DROP [0:0]
 4 | :OUTPUT DROP [0:0]
 5 | 
 6 | # loopback
 7 | -A INPUT -i lo -j ACCEPT
 8 | -A OUTPUT -o lo -j ACCEPT
 9 | -A INPUT -d 127.0.0.1 -j ACCEPT
10 | -A OUTPUT -s 127.0.0.1 -j ACCEPT
11 | 
12 | # ACCEPT already ESTABLISHED connections
13 | -A INPUT -p ALL -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
14 | 
15 | # ACCEPT all OUTPUT
16 | -A OUTPUT -p ALL -o eth0 -j ACCEPT
17 | 
18 | # SSH
19 | -A INPUT -p tcp -i eth0 --dport 22 -m state --state NEW -j ACCEPT
20 | 
21 | COMMIT
22 | 


--------------------------------------------------------------------------------
/etc/iptables/ip6tables.rules:
--------------------------------------------------------------------------------
 1 | *filter
 2 | :INPUT DROP [0:0]
 3 | :FORWARD DROP [0:0]
 4 | :OUTPUT DROP [0:0]
 5 | 
 6 | # loopback
 7 | -A INPUT -i lo -j ACCEPT
 8 | -A OUTPUT -o lo -j ACCEPT
 9 | -A INPUT -s ::1 -d ::1 -j ACCEPT
10 | -A OUTPUT -s ::1 -d ::1 -j ACCEPT
11 | 
12 | # ACCEPT already ESTABLISHED connections
13 | -A INPUT -p ALL -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
14 | 
15 | # DROP --rt-type 0
16 | -A INPUT -m rt --rt-type 0 -j DROP
17 | -A OUTPUT -m rt --rt-type 0 -j DROP
18 | -A FORWARD -m rt --rt-type 0 -j DROP
19 | 
20 | # ACCEPT all OUTPUT
21 | -A OUTPUT -p ALL -o eth0 -j ACCEPT
22 | 
23 | # SSH
24 | -A INPUT -p tcp -i eth0 --dport 22 -m state --state NEW -j ACCEPT
25 | 
26 | # ICMP
27 | -A INPUT -p ipv6-icmp -j ACCEPT
28 | -A OUTPUT -p ipv6-icmp -j ACCEPT
29 | 
30 | COMMIT
31 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | The MIT License (MIT)
 2 | 
 3 | Copyright (c) 2015 Stefan Grönke
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.


--------------------------------------------------------------------------------