Production-Grade iptables Firewall Configuration

Enterprise core filtering matrix optimized for stateful inspection, anti-DDoS traffic shaping, and persistent port defense vectors.

#!/bin/bash 
# ========================================================================= 
# CITADEL ENTERPRISE INFRASTRUCTURE — MAIN FIREWALL BLUEPRINT 
# FILE PATH: /etc/iptables.firewall.rules 
# ========================================================================= 
 
# 1. FLUSHING EXISTING CHAINS & SETTING DEFAULT POLICIES 
iptables -F 
iptables -X 
iptables -P INPUT DROP 
iptables -P FORWARD DROP 
iptables -P OUTPUT ACCEPT 
 
# 2. ALLOWING LOOPBACK AND ESTABLISHED CONNECTIONS 
iptables -A INPUT -i lo -j ACCEPT 
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 
 
# 3. OPENING PRODUCTION WEB & INFRASTRUCTURE PORTS 
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT # SSH 
iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW -j ACCEPT # HTTP/HTTPS 
iptables -A INPUT -p tcp --dport 21 -m conntrack --ctstate NEW -j ACCEPT # ProFTPD Control 
iptables -A INPUT -p tcp --dport 49152:49300 -m conntrack --ctstate NEW -j ACCEPT # ProFTPD Passive Pool 
 
# 4. ANTI-DDOS & FLOOD PROTECTION (STRICT RATE LIMITING) 
# Syn-Flood Mitigating Matrix 
iptables -N SYN_FLOOD 
iptables -A INPUT -p tcp --syn -j SYN_FLOOD 
iptables -A SYN_FLOOD -m limit --limit 1/s --limit-burst 4 -j RETURN 
iptables -A SYN_FLOOD -j DROP 
 
# Port Scanning Block Vector 
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP 
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP 
 
# 5. SAVE AND PERSIST RULES 
# Execute 'iptables-save > /etc/iptables.rules' to freeze state