ubuntu.serversignature.com

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#Variables
IPT="/sbin/iptables"
LAN="eth0"
INTERNET="ppp0"
NETWORK="192.168.1.0/24"

echo "Starting Firewall"
echo "-------"
echo "Deleting all existing rules and starting firewall"

#delete all existing rules.
$IPT -F
$IPT -t nat -F
$IPT -t mangle -F
$IPT -X

#Always accept loopback traffic
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

#All TCP sessions should begin with SYN
#$IPT -A INPUT -p tcp ! --syn -m state --state NEW -s $NETWORK -j DROP

#Allow input to LAN interface
$IPT -A INPUT -m state --state NEW -i $LAN -j ACCEPT

#INTERNET INTERFACE
#iptables -A INPUT -m state --state NEW -i ppp0 -j ACCEPT
#iptables -A FORWARD -i ppp0 -p tcp --dport 80 -j ACCEPT
#iptables -t nat -A PREROUTING -p tcp -i ppp0 -d 117.254.134.246 --dport 80 -j DNAT --to 192.168.1.2:80

#Allow outgoing connections from the LAN side.
iptables -A FORWARD -i $LAN -o $INTERNET -j ACCEPT
iptables -A FORWARD -i $LAN -o $INTERNET -m state --state ESTABLISHED,RELATED -j ACCEPT

#Masquerade.
iptables -t nat -A POSTROUTING -o $INTERNET -j MASQUERADE

# Accept inbound TCP packets
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#$IPT -A INPUT -p tcp --dport 21 -m state --state NEW -s $NETWORK -j ACCEPT
#$IPT -A INPUT -p tcp --dport 22 -m state --state NEW -s $NETWORK -j ACCEPT
#$IPT -A INPUT -p tcp --dport 25 -m state --state NEW -s $NETWORK -j ACCEPT
#$IPT -A INPUT -p tcp --dport 80 -m state --state NEW -s $NETWORK -j ACCEPT
#$IPT -A INPUT -p tcp --dport 80 -m state --state NEW -s $NETWORK -j ACCEPT
#$IPT -A INPUT -p tcp --dport 110 -m state --state NEW -s $NETWORK -j ACCEPT

# Accept inbound UDP packets
#$IPT -A INPUT -p udp -m udp --dport 123 -s $NETWORK -j ACCEPT
#$IPT -A INPUT -p udp -m udp --dport 67 -s $NETWORK -j ACCEPT
#$IPT -A INPUT -p udp -m udp --dport 53 -s $NETWORK -j ACCEPT

# Allow inbound access to Samba shares
#$IPT -A INPUT -p udp -m udp --dport 137 -s $NETWORK -j ACCEPT
#$IPT -A INPUT -p udp -m udp --dport 138 -s $NETWORK -j ACCEPT
#$IPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -s $NETWORK -j ACCEPT
#$IPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -s $NETWORK -j ACCEPT

# Accept inbound ICMP messages
$IPT -A INPUT -p ICMP --icmp-type 8 -s $NETWORK -j ACCEPT
$IPT -A INPUT -p ICMP --icmp-type 11 -s $NETWORK -j ACCEPT

# Allow established connections, and those not coming from the outside
#$IPT -A INPUT -m state --state NEW -i ! $INTERNET -j ACCEPT

#Pre-routing chain: NATs packets when the destination address of the packet needs to be changed.
#Post-routing chain: NATs packets when the source address of the packet needs to be changed

# Don't forward from the outside to the inside.
#iptables -A FORWARD -i eth1 -o eth1 -j REJECT
#iptables -A FORWARD -i eth0 -o ppp0 -j REJECT

#Forward chain: Filters packets to servers protected by the firewall.
#Input chain: Filters packets destined for the firewall.
#Output chain: Filters packets originating from the firewall.

# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 >/proc/sys/net/ipv4/tcp_syncookies
echo 1 >/proc/sys/net/ipv4/conf/all/rp_filter