Простой скрипт для настройки iptables

Создаем файл /etc/network/if-up.d/iptables и назначаем ему права на выполнение. Скрипт рассчитан на машину, подключаемую к сети по локалке и wi-fi.

#!/bin/sh
echo "Setting iptables rules"

IPTABLES="/sbin/iptables"

# delete rules and chains
$IPTABLES -F
$IPTABLES -X

# enable everything on lo
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT

for iface in eth0 wlan0
do
 # enable all established input connections
 $IPTABLES -A INPUT -i $iface -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
 $IPTABLES -A INPUT -i $iface -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT
 $IPTABLES -A INPUT -i $iface -p icmp -m state --state RELATED,ESTABLISHED -j ACCEPT

 # enable outgoing traffic
 $IPTABLES -A OUTPUT -o $iface -p tcp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
 $IPTABLES -A OUTPUT -o $iface -p udp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
 $IPTABLES -A OUTPUT -o $iface -p icmp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
done

# block all other input connections
$IPTABLES -A INPUT -p tcp -j REJECT --reject-with tcp-reset
$IPTABLES -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
 
# default policies
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP

#protect from spoofing
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter