For your consideration: my strict iptables

*filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0]

## Basic ## #Unlimited lo access -A INPUT -i lo -j ACCEPT -A OUTPUT -o lo -j ACCEPT #Drop sync -A INPUT -i eth0 -p tcp ! --syn -m state --state NEW -j DROP #Drop Specific IPS -A INPUT -i eth0 -s 23.22.14.163 -j DROP #Drop Fragments -A INPUT -i eth0 -f -j DROP -A INPUT -i eth0 -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP -A INPUT -i eth0 -p tcp --tcp-flags ALL ALL -j DROP #Drop NULL packets -A INPUT -i eth0 -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix " NULL Packets " -A INPUT -i eth0 -p tcp --tcp-flags ALL NONE -j DROP -A INPUT -i eth0 -p tcp --tcp-flags SYN,RST SYN,RST -j DROP #Drop XMAS -A INPUT -i eth0 -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix " XMAS Packets " -A INPUT -i eth0 -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #Drop FIN packet scans -A INPUT -i eth0 -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix " Fin Packets Scan " -A INPUT -i eth0 -p tcp --tcp-flags FIN,ACK FIN -j DROP -A INPUT -i eth0 -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP #Log and get rid of broadcast / multicast and invalid -A INPUT -i eth0 -m pkttype --pkt-type broadcast -j LOG --log-prefix " Broadcast " -A INPUT -i eth0 -m pkttype --pkt-type broadcast -j DROP -A INPUT -i eth0 -m pkttype --pkt-type multicast -j LOG --log-prefix " Multicast " -A INPUT -i eth0 -m pkttype --pkt-type multicast -j DROP -A INPUT -i eth0 -m state --state INVALID -j LOG --log-prefix " Invalid " -A INPUT -i eth0 -m state --state INVALID -j DROP #allow incoming ICMP ping pong stuff -A INPUT -i eth0 -p icmp --icmp-type 8 -s 0/0 -m state --state NEW,ESTABLISHED,RELATED -m limit --limit 30/sec -j ACCEPT -A OUTPUT -o eth0 -p icmp --icmp-type 0 -d 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT ## Clients ## #SSH -A OUTPUT -o eth0 -p tcp --dport 22 -j ACCEPT -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT #SMTP -A OUTPUT -o eth0 -p tcp --dport 25 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p tcp --sport 25 --dport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT #DNS -A OUTPUT -o eth0 -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT #DHCP -A OUTPUT -o eth0 -p udp --sport 1024:65535 --dport 67 -m state --state NEW,ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p udp --sport 67 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT #HTTP -A OUTPUT -o eth0 -p tcp --dport 80 -d 0/0 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p tcp -s 0/0 --dport 1024:65535 --sport 80 -m state --state ESTABLISHED -j ACCEPT -A OUTPUT -o eth0 -p tcp --dport 443 -d 0/0 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p tcp -s 0/0 --dport 1024:65535 --sport 443 -m state --state ESTABLISHED -j ACCEPT #NTP-A INPUT -i eth0 -p udp --sport 123 -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -o eth0 -p udp --dport 123 -m state --state ESTABLISHED -j ACCEPT #IMAP -A OUTPUT -o eth0 -p tcp --dport 143 -d 0/0 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p tcp -s 0/0 --dport 1024:65535 --sport 143 -m state --state ESTABLISHED -j ACCEPT ## Servers ## #SSH -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT #SMTP -A INPUT -i eth0 -p tcp --dport 25 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -o eth0 -p tcp --sport 25 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p tcp --dport 587 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -o eth0 -p tcp --sport 587 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT #DNS -A INPUT -i eth0 -p udp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -o eth0 -p udp --dport 1024:65535 --sport 53 -m state --state ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p tcp -s 54.184.251.162/32 --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -o eth0 -p tcp -d 54.184.251.162/32 --dport 1024:65535 --sport 53 -m state --state ESTABLISHED -j ACCEPT #HTTP -A INPUT -i eth0 -p tcp -s 0/0 --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -o eth0 -p tcp --sport 80 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p tcp -s 0/0 --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -o eth0 -p tcp --sport 443 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT #IMAP -A INPUT -i eth0 -p tcp -s 0/0 --sport 1024:65535 --dport 143 -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -o eth0 -p tcp --sport 143 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p tcp -s 0/0 --sport 1024:65535 --dport 993 -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -o eth0 -p tcp --sport 993 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT ####################### # drop and log everything else -A INPUT -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix " DEFAULT DROP " -A OUTPUT -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix " DEFAULT DROP " -A INPUT -j DROP -A OUTPUT -j DROP -A FORWARD -j DROP COMMIT