= Iptables on Ubuntu

#> vim /etc/network/if-pre-up.d/iptables
#!/bin/sh
/sbin/iptables-restore < /etc/fwrules

#> iptables-save > /etc/fwrules

#> vim /etc/fwrules 
# Generated by iptables-save v1.4.10 on Tue Dec 27 11:42:11 2011
*filter
:INPUT ACCEPT [3:369]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [11:1418]
:ssh - [0:0]
:ssh_blute - [0:0]
-A INPUT -p tcp -m tcp --dport 22 -j ssh 
-A INPUT -p tcp -m tcp --dport 22 -j ssh 
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT 
-A INPUT -p udp -m udp --dport 53 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT 
-A INPUT -p icmp -j DROP 
-A ssh -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A ssh -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m recent --rcheck --seconds 60 --hitcount 5 --name ssh_conn --rsource -j ssh_blute 
-A ssh -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m recent --set --name ssh_conn --rsource 
-A ssh -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT 
-A ssh -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A ssh -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m recent --update --seconds 86400 --name ssh_block --rsource -j REJECT --reject-with icmp-port-unreachable 
-A ssh -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m recent --rcheck --seconds 60 --hitcount 5 --name ssh_conn --rsource -j ssh_blute 
-A ssh -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m recent --set --name ssh_conn --rsource 
-A ssh -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT 
-A ssh_blute -m recent --set --name ssh_block --rsource -j LOG --log-prefix "ssh_block: " --log-level 7 
-A ssh_blute -j REJECT --reject-with icmp-port-unreachable 
-A ssh_blute -m recent --set --name ssh_block --rsource -j LOG --log-prefix "ssh_block: " --log-level 7 
-A ssh_blute -j REJECT --reject-with icmp-port-unreachable 
COMMIT

# Completed on Tue Dec 27 11:38:36 2011