#!/sbin/iptables

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

# Loopback
-A INPUT -i lo -j ACCEPT

# États invalides
-A INPUT -m conntrack --ctstate INVALID -j DROP

# Protection basique contre scans TCP
-A INPUT -p tcp --tcp-flags ALL FIN -j DROP
-A INPUT -p tcp --tcp-flags ALL FIN,SYN -j DROP
-A INPUT -p tcp --tcp-flags ALL SYN,RST -j DROP

# Connexions établies
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# ICMPv4 minimal
-A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
-A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
-A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
-A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT

# Anti-flood ICMP echo
-A INPUT -p icmp --icmp-type echo-request -m limit --limit 5/second --limit-burst 5 -j ACCEPT

# SSH avec rate-limit
-A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m limit --limit 10/minute --limit-burst 20 -j ACCEPT
