Forum Debian Users Gang

iptables -F
iptables -X

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#INPUT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# xxx.xxx.xx.xxx <- DNS na CloudFlare
iptables -A INPUT -d xxx.xxx.xx.xxx -p udp --dport 53 -m state --state NEW -j ACCEPT
iptables -A INPUT -d xxx.xxx.xx.xxx -p udp --dport 53 -m state --state NEW -j ACCEPT
iptables -A INPUT -d xxx.xxx.xx.xxx -p tcp --dport 53 -m state --state NEW -j ACCEPT
iptables -A INPUT -d xxx.xxx.xx.xxx -p tcp --dport 53 -m state --state NEW -j ACCEPT

iptables -A INPUT -p tcp --dport 2222 -m state --state NEW  -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -m state --state NEW  -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT

iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -m limit --limit 10/sec --limit-burst 20 -m conntrack --ctstate NEW -j ACCEPT #icmp-type 8
iptables -A INPUT -m limit --limit 1/sec --limit-burst 20 -j LOG --log-prefix "netfilter: "

iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -j LOG --log-prefix "INPUT DROP " --log-tcp-options --log-ip-options --log-tcp-sequence

#OUTPUT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A OUTPUT -d xxx.xxx.xx.xxx -p udp --dport 53 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -d xxx.xxx.xx.xxx -p udp --dport 53 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -d xxx.xxx.xx.xxx -p tcp --dport 53 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -d xxx.xxx.xx.xxx -p tcp --dport 53 -m state --state NEW -j ACCEPT


iptables -A OUTPUT -p tcp --sport 2222 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT

iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT

iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -j LOG --log-prefix "OUTPUT DROP INVALID " --log-tcp-options --log-ip-options --log-tcp-sequence

cat /proc/net/ip_tables_matches
helper
conntrack
conntrack
conntrack
limit
comment
mark
mark
connlimit
owner
string
string
addrtype
addrtype
recent
length
ttl
tcpmss
multiport
multiport
tos
tos
dscp
icmp
state
owner
udplite
udp
tcp

PID   USER      PR  NI  VIRT  RES  SHR S  %CPU %MEM    TIME+  COMMAND       
32151 www-data  20   0  263m  65m  43m S   0,0  6,4   0:17.14 php5-fpm                                                                                                
32152 www-data  20   0  264m  61m  38m S   0,0  6,0   0:16.16 php5-fpm                                                                                                
32395 www-data  20   0  260m  53m  34m S   0,0  5,2   0:10.55 php5-fpm                                                                                                
28251 root      20   0 63808  15m 1484 S   0,0  1,5   1:17.36 psad                                                                                                    
 2170 mysql     20   0 94168  10m 2552 S   0,0  1,0   0:18.09 mysqld                                                                                                  
30539 root      20   0 80720 6788  980 S   0,0  0,6   1:00.82 fail2ban-server                                                                                         
32149 root      20   0  243m 4728 1308 S   0,0  0,5   0:05.95 php5-fpm                                                                                                
  658 root      20   0 71252 3496 2704 S   0,0  0,3   0:00.03 sshd                                                                                                    
32177 www-data  20   0 65088 2972 1164 S   0,0  0,3   0:00.89 nginx

ENABLE_AUTO_IDS Y
AUTO_IDS_DANGEL_LEVEL  3

# wpisałem ip DNS 
ignoreip=

[nginx-auth]
enabled = true
filter = nginx-auth
action = iptables-multiport[name=NoAuthFailures, port="http,https"]
logpath = /var/log/nginx/error.log
bantime = 43200 #Blokujemy dostęp na 12h
maxretry = 3

[Definition]
failregex = no user/password was provided for basic authentication.*client: 
              user .* was not found in.*client: 
              user .* password mismatch.*client: 
ignoreregex =

user www-data;
worker_processes 1;
pid /var/run/nginx.pid;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 5;
        client_body_timeout 60;
        client_header_timeout 60;
        send_timeout 60;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # Logging Settings
        ##

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;


        # Zaawansowana optymalizacja
        open_file_cache max=1000 inactive=20s;
        open_file_cache_valid 30s;
        open_file_cache_min_uses 2;
        open_file_cache_errors on;

        ##
        # Gzip Settings
        ##

        gzip on;
        gzip_disable "msie6";
         gzip_vary on;
         gzip_proxied any;
         gzip_comp_level 4;
         gzip_buffers 16 8k;
         gzip_http_version 1.1;
         gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;

        ##
        # nginx-naxsi config
        ##
        # Uncomment it if you installed nginx-naxsi
        ##

        #include /etc/nginx/naxsi_core.rules;

        ##
        # nginx-passenger config
        ##
        # Uncomment it if you installed nginx-passenger
        ##

        #passenger_root /usr;
        #passenger_ruby /usr/bin/ruby;

        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;

        include /etc/nginx/sites-enabled/*;
}

server {
        listen   80; ## listen for ipv4; this line is default and implied
        #listen   [::]:80 default_server ipv6only=on; ## listen for ipv6

        root /home/user/public_html;
        index index.php index.html index.htm;

        # Make site accessible from http://localhost/
        server_name domena.pl www.domena.pl;

        set $cache_uri $request_uri;

        # Make sure files with the following extensions do not get loaded by nginx because nginx would display the source code, and these files can contain PASSWORDS!
        location ~* \.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|\.php_
        {
                return 444;
        }
        #passwd
        location  /wp-admin/  {
        auth_basic            "Admin area password";
        auth_basic_user_file  /etc/nginx/htpasswd;
        }
        location  /wp-login.php  {
          auth_basic            "Admin area password";
          auth_basic_user_file  /etc/nginx/htpasswd;
         }

#nocgi
location ~* \.(pl|cgi|py|sh|lua)\$ {
       return 444;
}

location ~ /(\.|wp-config.php|readme.html|license.txt) { deny all; }

location ~* /(?:uploads|files)/.*(\.|php|js|html|tpl|sh)$ {
       deny all;
}
location ~ ^/wp-content/cache/minify/[^/]+/(.*)$ {
                try_files $uri /wp-content/plugins/w3-total-cache/pub/minify.php?file=$1;
        }
location / {
                try_files /wp-content/cache/page_enhanced/${host}${cache_uri}_index.html $uri $uri/ /index.php?$args ;
        }
# POST requests and urls with a query string should always go to PHP
        if ($request_method = POST) {
                set $cache_uri 'null cache';
        }
        if ($query_string != "") {
                set $cache_uri 'null cache';
        }
# Don't cache uris containing the following segments
        if ($request_uri ~* "(/wp-admin/|/xmlrpc.php|/wp-(app|cron|login|register|mail).php|wp-.*.php|/feed/|index.php|wp-comments-popup.php|wp-links-opml.php|wp-locations.php|sitemap(_index)?.xml|[a-z0-9_-]+-sitemap([0-9]+)?.xml)") {
                set $cache_uri 'null cache';
        }
# Don't use the cache for logged in users or recent commenters

     if ($request_uri ~* "(/wp-admin/|/xmlrpc.php|/wp-(app|cron|login|register|mail).php|wp-.*.php|/feed/|index.php|wp-comments-popup.php|wp-links-opml.php|wp-locations.php|sitemap(_index)?.xml|[a-z0-9_-]+-sitemap([0-9]+)?.xml)") {
                set $cache_uri 'null cache';
        }
# Don't use the cache for logged in users or recent commenters
        if ($http_cookie ~* "comment_author|wordpress_[a-f0-9]+|wp-postpass|wordpress_logged_in") {
                set $cache_uri 'null cache';
        }
        rewrite ^(.*)?/?files/(.*) /wp-content/blogs.php?file=$2;
if (!-e $request_filename) {
              rewrite ^([_0-9a-zA-Z-]+)?(/wp-.*) $2  break;
              rewrite ^([_0-9a-zA-Z-]+)?(/.*\.php)$ $2 last;
              rewrite ^ /index.php last;
          }
rewrite ^/sitemap_index\.xml$ /index.php?sitemap=1 last;
rewrite ^/([^/]+?)-sitemap([0-9]+)?\.xml$ /index.php?sitemap=$1&sitemap_n=$2 last;
        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        location ~ \.php$ {
                fastcgi_split_path_info ^(.+\.php)(/.+)$;
        #       # NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
        #
        #       # With php5-cgi alone:
        #       fastcgi_pass 127.0.0.1:9000;
        #       # With php5-fpm:
                fastcgi_pass unix:/var/run/php5-fpm.sock;
                fastcgi_index index.php;
                include fastcgi_params;
        }
}