# iptables pro IPv4

*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

# chainy pro fail2ban
:fail2ban-ssh - [0:0]
:fail2ban-ssh-ddos - [0:0]

# chain pro whitelist
:whitelist - [0:0]

# lokalni smycka
-A INPUT -i lo -j ACCEPT
# fyzicka LAN
-A INPUT -s 10.10.10.0/24 -j ACCEPT

# primarni VPN
-A INPUT -s 10.8.8.0/24 -j ACCEPT
# herni VPN, nesmi na server
-A INPUT -s 10.100.100.0/24 -j DROP

# pripojeni na VPN zvenku
-A INPUT -p udp -m udp --dport 9874 -j ACCEPT
-A INPUT -p udp -m udp --dport 8765 -j ACCEPT

# 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# jako kontrola pres whitelist
-A INPUT -j whitelist

# pravidla fail2ban
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh-ddos
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh

# povoleni verejnych sluzeb zde (ssh, http(s))
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

# navazana spojeni se preposilaji automaticky
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# z primarni VPN je povoleno pristupovat do fyzicke LAN
-A FORWARD -s 10.8.8.0/24 -d 10.10.10.0/24 -o eth0 -m conntrack --ctstate NEW -j ACCEPT

# fail2ban
-A fail2ban-ssh -j RETURN
-A fail2ban-ssh-ddos -j RETURN
COMMIT

# NAT pro VPN
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
# primarni VPN se v LAN maskuje adresou serveru
-A POSTROUTING -s 10.8.8.0/24 -o eth0 -j MASQUERADE
COMMIT