Skip to content

Instantly share code, notes, and snippets.

@taidos

taidos/iptables-web-allow_only_cloudflare_and_quic.sh

Forked from cybersecslayertech/iptables-web-allow_only_cloudflare_and_quic.sh
Created February 25, 2022 15:51
Show Gist options
  • Save taidos/b2f6c56a0daff3c674a0d634cece30a6 to your computer and use it in GitHub Desktop.
Save taidos/b2f6c56a0daff3c674a0d634cece30a6 to your computer and use it in GitHub Desktop.
Download ZIP
Iptables - Allow only CloudFlare and QUIC.cloud IPs
Raw
iptables-web-allow_only_cloudflare_and_quic.sh
# Source:
# https://www.cloudflare.com/ips
# https://quic.cloud/docs/cdn/adding-quic-cloud-ips-to-allowlist/
# CloudFlare
for i in `curl https://www.cloudflare.com/ips-v4`; do iptables -I INPUT -p tcp -m multiport --dports http,https -s $i -j ACCEPT; done
for i in `curl https://www.cloudflare.com/ips-v6`; do ip6tables -I INPUT -p tcp -m multiport --dports http,https -s $i -j ACCEPT; done
# QUIC.cloud
for i in `curl https://quic.cloud/ips?ln`; do iptables -I INPUT -p tcp -m multiport --dports http,https -s $i -j ACCEPT; done
# for i in `curl ?`; do ip6tables -I INPUT -p tcp -m multiport --dports http,https -s $i -j ACCEPT; done
# DROP all others connection to indicate filtered port on scanners
iptables -A INPUT -p tcp -m multiport --dports http,https -j DROP
ip6tables -A INPUT -p tcp -m multiport --dports http,https -j DROP
# or REJECT with TCP Reset to indicate closed port on scanners
#iptables -A INPUT -p tcp -m multiport --dports http,https -j REJECT --reject-with tcp-reset
#ip6tables -A INPUT -p tcp -m multiport --dports http,https -j REJECT --reject-with tcp-reset
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment