Right, so this is is a Hard Questiontm. Since all environments are different, it is very tricksome to provide a "One Size Fits All" ruleset that one can expect to just drop in. Any such configs, config snippets, recommendations, etc, must be fully grokked and tweaked to work in your environment. That being said, as discussed in the security.blogoverflow.com post (and in much greater detail), Base Rulesets in IPTables, this is a pretty basic set of sanity checks that I've built out over the years and have been recommending to people.
## Section 1
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp --icmp-type any -j ACCEPT
## Section 2
# Force SYN checks
-A INPUT -p tcp ! --syn -m state --state NEW -j DROP
# Drop all fragments
-A INPUT -f -j DROP
# Drop XMAS packets
-A INPUT -p tcp --tcp-flags ALL ALL -j DROP
# Drop NULL packets
-A INPUT -p tcp --tcp-flags ALL NONE -j DROP
## Section 3
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
###
# Insert your system specific rules here
###
## Section 4
-A INPUT -j LOG --log-level 7 --log-prefix "IPTABLES Dropped: "
-A INPUT -j DROP
Section 1
This is you pretty basic accepts. In general, you just want to allow ping and any localhost traffic or else things may not necessarily work as expected.
Section 2
This is a series of quick and dirty checks for known wonky packets that can cause problems. The only reason we put this second is for performance reasons.
Section 3
Here we allow all packets that are part of an existing session to come in. Most firewall admins would say to put this at the beginning of the config, performance reasons and all that. However, I would rather wonky packets be blocked even when part of an on-going session.
Section 4
Here is our log and default deny. The downside of putting the log message all the way down here, is that we won't get notified if any the wonky drops are triggered. We could move it up to the top, but that would either:
- Make our config really messy
- Overwhelm the logging engine
Really, it's your choice. As a generic recommendation, I opted for cleaner so that it would be easier to understand.