Menu
NullMind's Lair
  • Home
  • Statue Collection
  • Jacket Collection
  • Contact
  • Archives
  • About
NullMind's Lair

Iptables for Cpanel (Linux)

Posted on October 26, 2004 by NullMind

I rarely Use Cpanel server anymore, but we do have a few on the NOC, and they constantly the target of hackers .. so ..

With the Help of Vladimir (Unicorn) .. here is a nice Iptables ruleset for Cpanel based servers.


iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A INPUT -p tcp ! --syn --sport 20 --destination-port 1024:65535 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 20 -j ACCEPT
iptables -t filter -A INPUT -p tcp --sport 21 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -t filter -A INPUT -p tcp --sport 22 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -t filter -A INPUT -p tcp --sport 25 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -t filter -A INPUT -p tcp --sport 37 -j ACCEPT
iptables -t filter -A INPUT -p tcp --sport 43 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p tcp --sport 53 -j ACCEPT
iptables -t filter -A INPUT -p udp --sport 53 -j ACCEPT
iptables -t filter -A INPUT -p tcp --sport 80 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 110 -j ACCEPT
iptables -t filter -A INPUT -p tcp --sport 113 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 143 -j ACCEPT
iptables -t filter -A INPUT -p tcp --sport 443 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -t filter -A INPUT -p udp --dport 161 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 465 -j ACCEPT
iptables -t filter -A INPUT -p tcp --sport 873 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 993 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 995 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 2082 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 2083 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 2086 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 2087 -j ACCEPT
iptables -t filter -A INPUT -p tcp --sport 2089 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 2095 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 2096 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 3306 -j ACCEPT
iptables -t filter -A INPUT -p tcp --sport 3306 -j ACCEPT
iptables -t filter -A INPUT -p tcp -j REJECT
iptables -t filter -A INPUT -p udp -j REJECT
iptables -t filter -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

iptables -t filter -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -t filter -A INPUT -p icmp -j REJECT
iptables -t mangle -A INPUT -p tcp --dport ftp -j TOS --set-tos 0x10
iptables -t mangle -A INPUT -p tcp --dport ftp-data -j TOS --set-tos 0x08
iptables -t mangle -A OUTPUT -p tcp --sport ftp -j TOS --set-tos 0x10
iptables -t mangle -A OUTPUT -p tcp --sport ftp-data -j TOS --set-tos 0x08
iptables -t mangle -A INPUT -p tcp --sport ssh -j TOS --set-tos 0x08
iptables -t mangle -A INPUT -p tcp --dport ssh -j TOS --set-tos 0x08
iptables -t mangle -A OUTPUT -p tcp --sport ssh -j TOS --set-tos 0x08
iptables -t mangle -A OUTPUT -p tcp --dport ssh -j TOS --set-tos 0x08
iptables -t mangle -A INPUT -p tcp --dport http -j TOS --set-tos 0x10
iptables -t mangle -A INPUT -p tcp --dport https -j TOS --set-tos 0x10
iptables -t mangle -A OUTPUT -p tcp --sport http -j TOS --set-tos 0x10
iptables -t mangle -A OUTPUT -p tcp --sport https -j TOS --set-tos 0x10

Null

Related

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Carlos Rego – OnApp CVO & Co-Founder

Recent Comments

  • Carlos on French corvette ‘La Légère’
  • NullMind on My Magrette ‘Bronze’ … sort of
  • NullMind on Finally got the work desk fully setup, took forever for some things to arrive due to the delays on the postal system, but it’s finally all here !!
  • Fintan on Finally got the work desk fully setup, took forever for some things to arrive due to the delays on the postal system, but it’s finally all here !!
  • wm. spencer on My Magrette ‘Bronze’ … sort of

Null's Flickr Photos

Відпочинковий комплекс ШепільськаSete CidadesIslamic MuseumBoat in DohaVM-E with 50mm/0.95Double Rainbow
More Photos

Categories

  • Books / Movies (8)
  • Camping (1)
  • Cars (14)
  • Check Ins (69)
  • Computers / Internet (146)
  • Cooking Recipes (2)
  • Family (53)
  • Featured (4)
  • Flights (176)
  • General (107)
  • Models & Statues (42)
  • Photography (276)
  • RC (66)
  • Short Rants (14)
  • Stuff (6)
  • Toonz (24)
  • Trips / Places (36)
  • Uncategorized (26)
  • Vape (3)
  • Voicemails (1)
  • Watches (6)
  • Work (48)

Tag Cloug

1/4 scale 8IGHT-T 8T Azores BSL canon50mmf095 Car Check Ins Copenhagen CPH england Flickr IFTTT Instagram LCY LGW LHR LIS Lisbon london Lviv LWO Marvel PDL Plymouth Prowler Ponta Delgada (Azores) Prowler RC RC NUT sonya7r Statues STN Tattoo Trip Tripit UK2 unitedkingdom VIE Vienna VPS VPS.NET Warsaw WAW Work ¼ Scale

Next Azores Trip

Quick TripFebruary 29, 2020
Going Home to Visit
©2021 NullMind's Lair | Powered by WordPress & Superb Themes