Manual init.d IPTables configuration

Another possibility is to manually configure your firewall rules through an init.d script that will run all the iptables commands. Take the following steps:

• Review the script below and adapt it to your needs.

• Test the script and review the syslog messages to see which traffic is being dropped. If you are testing from the network you will want to either run the sample shell snippet to remove the firewall (if you don't type anything in 20 seconds) or you might want to comment out the default deny policy definitions (-P INPUT DROP and -P OUTPUT DROP) and check that the system will not drop any legitimate traffic.

• Move the script to /etc/init.d/myfirewall

• Configure the system to run the script before any network is configured:
  

       #update-rc.d myfirewall start 40 S . stop 89 0 6 .
  

This is the sample firewall script:

     #!/bin/sh
     # Simple example firewall configuration.
     #
     # Caveats:
     # - This configuration applies to all network interfaces
     #   if you want to restrict this to only a given interface use
     #   '-i INTERFACE' in the iptables calls.
     # - Remote access for TCP/UDP services is granted to any host, 
     #   you probably will want to restrict this using '--source'.
     #
     # chkconfig: 2345 9 91
     # description: Activates/Deactivates the firewall at boot time
     #
     # You can test this script before applying with the following shell
     # snippet, if you do not type anything in 10 seconds the firewall
     # rules will be cleared.
     #---------------------------------------------------------------
     #  while true; do test=""; read  -t 20 -p "OK? " test ; \
     #  [ -z "$test" ] && /etc/init.d/myfirewall clear ; done
     #---------------------------------------------------------------
     
     PATH=/bin:/sbin:/usr/bin:/usr/sbin
     
     # Services that the system will offer to the network
     TCP_SERVICES="22" # SSH only
     UDP_SERVICES=""
     # Services the system will use from the network
     REMOTE_TCP_SERVICES="80" # web browsing
     REMOTE_UDP_SERVICES="53" # DNS
     # Network that will be used for remote mgmt
     # (if undefined, no rules will be setup)
     # NETWORK_MGMT=192.168.0.0/24
     # Port used for the SSH service, define this is you have setup a
     # management network but remove it from TCP_SERVICES
     # SSH_PORT="22"
     
     if ! [ -x /sbin/iptables ]; then  
         exit 0
     fi
     
     fw_start () {
     
       # Input traffic:
       /sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
       # Services
       if [ -n "$TCP_SERVICES" ] ; then
       for PORT in $TCP_SERVICES; do
         /sbin/iptables -A INPUT -p tcp --dport ${PORT} -j ACCEPT
       done
       fi
       if [ -n "$UDP_SERVICES" ] ; then
       for PORT in $UDP_SERVICES; do
         /sbin/iptables -A INPUT -p udp --dport ${PORT} -j ACCEPT
       done
       fi
       # Remote management
       if [ -n "$NETWORK_MGMT" ] ; then
         /sbin/iptables -A INPUT -p tcp --src ${NETWORK_MGMT} --dport ${SSH_PORT} -j ACCEPT
       else 
         /sbin/iptables -A INPUT -p tcp --dport ${SSH_PORT}  -j ACCEPT
       fi
       # Remote testing
       /sbin/iptables -A INPUT -p icmp -j ACCEPT
       /sbin/iptables -A INPUT -i lo -j ACCEPT
       /sbin/iptables -P INPUT DROP
       /sbin/iptables -A INPUT -j LOG
     
       # Output:
       /sbin/iptables -A OUTPUT -j ACCEPT -o lo 
       /sbin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
       # ICMP is permitted:
       /sbin/iptables -A OUTPUT -p icmp -j ACCEPT
       # So are security package updates:
       # Note: You can hardcode the IP address here to prevent DNS spoofing
       # and to setup the rules even if DNS does not work but then you 
       # will not "see" IP changes for this service:
       /sbin/iptables -A OUTPUT -p tcp -d security.debian.org --dport 80 -j ACCEPT 
       # As well as the services we have defined:
       if [ -n "$REMOTE_TCP_SERVICES" ] ; then
       for PORT in $REMOTE_TCP_SERVICES; do
         /sbin/iptables -A OUTPUT -p tcp --dport ${PORT} -j ACCEPT
       done
       fi
       if [ -n "$REMOTE_UDP_SERVICES" ] ; then
       for PORT in $REMOTE_UDP_SERVICES; do
         /sbin/iptables -A OUTPUT -p udp --dport ${PORT} -j ACCEPT
       done
       fi
       # All other connections are registered in syslog
       /sbin/iptables -A OUTPUT -j LOG
       /sbin/iptables -A OUTPUT -j REJECT 
       /sbin/iptables -P OUTPUT DROP
       # Other network protections
       # (some will only work with some kernel versions)
       echo 1 > /proc/sys/net/ipv4/tcp_syncookies
       echo 0 > /proc/sys/net/ipv4/ip_forward 
       echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts 
       echo 1 > /proc/sys/net/ipv4/conf/all/log_martians 
       echo 1 > /proc/sys/net/ipv4/ip_always_defrag
       echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
       echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
       echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
       echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
     
     }
     
     fw_stop () {
       /sbin/iptables -F
       /sbin/iptables -t nat -F
       /sbin/iptables -t mangle -F
       /sbin/iptables -P INPUT DROP
       /sbin/iptables -P FORWARD DROP
       /sbin/iptables -P OUTPUT ACCEPT
     }
     
     fw_clear () {
       /sbin/iptables -F
       /sbin/iptables -t nat -F
       /sbin/iptables -t mangle -F
       /sbin/iptables -P INPUT ACCEPT
       /sbin/iptables -P FORWARD ACCEPT
       /sbin/iptables -P OUTPUT ACCEPT
     }
     
     
     case "$1" in
       start|restart)
         echo -n "Starting firewall.."
         fw_stop 
         fw_start
         echo "done."
         ;;
       stop)
         echo -n "Stopping firewall.."
         fw_stop
         echo "done."
         ;;
       clear)
         echo -n "Clearing firewall rules.."
         fw_clear
         echo "done."
         ;;
       *)
         echo "Usage: $0 {start|stop|restart|clear}"
         exit 1
         ;;
       esac
     exit 0

Instead of including all of the iptables rules in the init.d script you can use the iptables-restore program to restore the rules saved using iptables-save. In order to do this you need to setup your rules, save the ruleset under a static location (such as /etc/default/firewall).

Reference : https://www.debian.org/doc/manuals/securing-debian-howto/