Iptables Bad Boys

In this sample iptables_bad_boys_programs.cfg, we defend against hostile hosts--hosts trying to hack us, launch denial-of-services attacks, mirror our website (unauthorized), hog our bandwidth, or otherwise cause us fits.

///////////////////////////////////////////////////////////////////////////////
//
// iptables_bad_boys_programs.cfg
//
///////////////////////////////////////////////////////////////////////////////

        // BAD_IP -- log and drop bad ips

        =iptables -N BAD_IP
        =iptables -A BAD_IP -j LOG --log-prefix "IPT BAD_IP: " =logopt
        =iptables -A BAD_IP -j DROP

        // BAD_BOYS -- check for bad boys, hostile and/or misbehaving hosts

        =iptables -N BAD_BOYS
        for ip in =badboys; do
            =iptables -A BAD_BOYS -s $ip -j BAD_IP
            =iptables -A BAD_BOYS -d $ip -j BAD_IP
        done

///////////////////////////////////////////////////////////////////////////////

The =badboys macro is a list of host and/or network IP addresses specified (in the firewall_macros.cfg file) for example as:

badboys         172.16.3.0/8 10.0.0.5 169.254.99.3 [...]

This iptables_bad_boys_programs.cfg file is #included by the higher-level iptables_programs.cfg file.  In that file, we might have code invoking the BAD_BOYS chain as follows:

        =iptables -A FORWARD            -j BAD_BOYS

For more examples, see Samples.