# Network Security Firewall Reference
## Default Deny Template
```
# Allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
# Allow SSH (rate-limited)
iptables -A INPUT -p tcp --dport 22 -m limit --limit 3/min -j ACCEPT
# Drop everything else
iptables -P INPUT DROP
iptables -P FORWARD DROP
```

## Suricata IDS Rule Format
```
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB SQL Injection"; flow:to_server,established; content:"UNION"; nocase; content:"SELECT"; nocase; sid:2001; rev:1;)
```
