DD-WRT iptables?

[Taxmancometh]

Are these IPtables right for using in the CMD shell of DD-WRT's firewall?





iptables -t mangle -I PREROUTING -i `nvram get wan_iface` -j TTL --ttl-set 10
iptables -t mangle -I POSTROUTING -o `nvram get wan_iface` -j TTL --ttl-inc 1
iptables -I OUTPUT -d 239.255.255.250 -j DROP
#Syn-flood protection
iptables -N syn_flood
iptables -A syn-flood -p tcp --syn -m limit --limit 1/s --limit-burst 4 -j ACEPT
iptables -A syn_flood -j REJECT
# Furtive port scanner:
iptables -N port_scan
iptables -A port_scan -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A port_scan -j REJECT
iptables -t nat -A PREROUTING -p tcp --tcp-flags ALL FIN,URG,PSH -j REJECT
iptables -t nat -A PREROUTING-p tcp --tcp-flags ALL ALL -j REJECT
iptables -t nat -A PREROUTING -p tcp --tcp-flags ALL NONE -j REJECT
iptables -t nat -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j REJECT
#XMAS
iptables -t nat -A PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j REJECT
iptables -t nat -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j REJECT
# FIN packet scans
iptables -t nat -A PREROUTING -p tcp--tcp-flags ALL SYN,RST,ACK,FIN,URG -j REJECT
#SSH Protection
iptables -N rate_limit
iptables -F rate_limit
iptables -A rate_limit -p tcp --dport 22 -m limit --limit 3/min --limit-burst 3 -j ACCEPT
iptables -A rate_limit -p udp --dport 22 -m limit --limit 3/min --limit-burst 3 -j ACCEPT
iptables -A rate_limit -p ICMP --icmp-type echo-request -m limit --limit 3/sec -j ACCEPT
iptables -A rate_limit -p ! ICMP -j LOG --log-prefix " Connection dropped!! "
iptables -A rate_limit -p tcp -j REJECT --reject-with tcp-reset
iptables -A rate_limit -p udp -j REJECT --reject-with icmp-port-unreachable
iptables -A rate_limit -j REJECT


I changed my SSH port to 22. That's not the real port.

[GroundZero3]

I changed my SSH port to 22. That's not the real port.

Ssh default port is 22, so im a little confused by your statement.

[Taxmancometh]

No, I mean my actual SSH port is something other than 22. I just meant that I changed it here for showing so that no one would know what my real SSH port is. So are those IPtables correct for DD-WRT's firewall?

[GroundZero3]

Never really used ip tables but check out this page

Iptables command - DD-WRT Wiki

[Taxmancometh]

After carefully reading those I found a few errors with my SSH protection and the PREROUTING.