add my internet-client iptables rules

config_example/archlinux_iptables.rules

@@ -0,0 +1,46 @@
+# usage
+## Load iptables at run time 
+# source ./archlinux_iptables.rules
+## save running-config in startup-config
+# iptables-save > /etc/iptables/iptables.rules
+
+
+# Ensure following INPUT/OUTPUT rules will be the only applied
+iptables --flush INPUT
+iptables --flush OUTPUT
+
+# Policy set to DROP for secured default behaviour
+iptables -t filter -P OUTPUT ACCEPT
+iptables -t filter -P INPUT DROP
+iptables -t filter -P FORWARD DROP
+
+# DHCP input (due to listening daemon)
+iptables -t filter -A OUTPUT -p udp -m udp --sport 68 --dport 67 -j ACCEPT
+iptables -t filter -A INPUT -p udp -m udp --sport 67 --dport 68 -j ACCEPT
+
+# DNS
+iptables -t filter -A OUTPUT -p udp -m udp --dport 53 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT 
+iptables -t filter -A INPUT -p udp -m udp --sport 53 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+
+# PING on all local networks (RFC 1918)
+iptables -t filter -A INPUT -s 10.0.0.0/8 -p icmp -j ACCEPT
+iptables -t filter -A INPUT -s 172.16.0.0/12 -p icmp -j ACCEPT
+iptables -t filter -A INPUT -s 192.168.0.0/16 -p icmp -j ACCEPT
+iptables -t filter -A OUTPUT -p icmp -j ACCEPT
+
+# SSH
+iptables -t filter -A OUTPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT
+
+# HTTP, HTTPS, STREAMING
+iptables -t filter -A OUTPUT -p tcp -m multiport --dports 80,443,8000 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT  
+
+# Local process (127.0.0.1)
+iptables -t filter -A OUTPUT -o lo -j ACCEPT
+iptables -t filter -A INPUT -i lo -j ACCEPT
+
+# All return packets
+iptables -t filter -A INPUT -p tcp -m tcp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+
+# Log dropped packets
+iptables -t filter -A INPUT -j LOG --log-prefix "INPUT:DROP:" --log-level 6
+iptables -t filter -A OUTPUT -j LOG --log-prefix "OUTPUT:DROP:" --log-level 6