38 lines
1.2 KiB
Plaintext
38 lines
1.2 KiB
Plaintext
|
*filter
|
||
|
|
|
||
|
|
# Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
|
||
|
|
-A INPUT -i lo -j ACCEPT
|
||
|
|
-A INPUT ! -i lo -d ::1/128 -j REJECT
|
||
|
|
|
||
|
|
# Accept all established inbound connections
|
||
|
|
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||
|
|
|
||
|
|
# Allow all outbound traffic - you can modify this to only allow certain traffic
|
||
|
|
-A OUTPUT -j ACCEPT
|
||
|
|
|
||
|
|
# Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
|
||
|
|
-A INPUT -p tcp --dport 80 -j ACCEPT
|
||
|
|
-A INPUT -p tcp --dport 443 -j ACCEPT
|
||
|
|
# (optional) Allow HTTP/3 connections from anywhere.
|
||
|
|
-A INPUT -p udp --dport 443 -j ACCEPT
|
||
|
|
|
||
|
|
# Allow SSH connections
|
||
|
|
# The -dport number should be the same port number you set in sshd_config
|
||
|
|
-A INPUT -p tcp -m state --state NEW --dport 23230 -j ACCEPT
|
||
|
|
|
||
|
|
# Allow ping
|
||
|
|
-A INPUT -p icmpv6 -j ACCEPT
|
||
|
|
|
||
|
|
# Log iptables denied calls
|
||
|
|
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
|
||
|
|
|
||
|
|
# Reject all other inbound - default deny unless explicitly allowed policy
|
||
|
|
-A INPUT -j REJECT
|
||
|
|
-A FORWARD -j REJECT
|
||
|
|
|
||
|
|
COMMIT
|
||
|
|
|
||
|
|
|
||
|
|
/etc/letsencrypt/live/mastadon.waynehayesdevelopment.com/fullchain.pem
|
||
|
|
/etc/letsencrypt/live/mastadon.waynehayesdevelopment.com/privkey.pem
|