rc.firewall

#!/bin/sh

# IPTables Location - adjust if needed

IPT="/usr/sbin/iptables"

# Internet Interface
INET_IFACE="wlan0"

###
# Flush all rules
###
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -F
$IPT -X

if [ "$1" = "stop" ]
then
	echo "Firewall completely flushed!  Now running with no firewall."
	exit 0
fi
###
# Defaults
###
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP

###
# Create chains
###
$IPT -N allow_connections
$IPT -N dns_outbound
$IPT -N ssh_inbound
$IPT -N file_outbound
$IPT -N web_outbound
$IPT -N email_outbound
$IPT -N chat_outbound
$IPT -N vpn_outbound
$IPT -N netbios_outbound

###
# Populate chains
###

# Allow connections
$IPT -A allow_connections -m state --state ESTABLISHED,RELATED -j ACCEPT

# DNS
$IPT -A dns_outbound -p udp --dport 53 -j ACCEPT

# SSH into the firewall
$IPT -A ssh_inbound -p tcp --dport 40022 -j ACCEPT

# SSH to other servers
$IPT -A file_outbound -p tcp --dport 21 -j ACCEPT
$IPT -A file_outbound -p tcp --dport 22 -j ACCEPT

# Web traffic
$IPT -A web_outbound -p tcp --dport 80 -j ACCEPT
$IPT -A web_outbound -p tcp --dport 81 -j ACCEPT
$IPT -A web_outbound -p tcp --dport 82 -j ACCEPT
$IPT -A web_outbound -p tcp --dport 443 -j ACCEPT
$IPT -A web_outbound -p tcp --dport 8080 -j ACCEPT
$IPT -A web_outbound -p tcp --dport 8090 -j ACCEPT

# P2P web servers
$IPT -A web_outbound -p tcp --dport 40002 -j ACCEPT
$IPT -A web_outbound -p tcp --dport 40005 -j ACCEPT

# Email traffic
$IPT -A email_outbound -p tcp --dport 110 -j ACCEPT
$IPT -A email_outbound -p tcp --dport 143 -j ACCEPT
$IPT -A email_outbound -p tcp --dport 25 -j ACCEPT
$IPT -A email_outbound -p tcp --dport 465 -j ACCEPT
$IPT -A email_outbound -p tcp --dport 993 -j ACCEPT
$IPT -A email_outbound -p tcp --dport 995 -j ACCEPT

# IRC traffic
$IPT -A chat_outbound -p tcp --dport 113 -j ACCEPT
$IPT -A chat_outbound -p tcp --dport 6660:6669 -j ACCEPT

# MSN traffic
$IPT -A chat_outbound -p tcp --dport 1863 -j ACCEPT

# VPN traffic
$IPT -A vpn_outbound -p udp --dport 1194 -j ACCEPT

# NETBIOS
$IPT -A netbios_outbound -p tcp --dport 137:139 -j ACCEPT
$IPT -A netbios_outbound -p tcp --dport 445 -j ACCEPT

###
# Append rules
###
#$IPT -A INPUT -i lo -s 127.0.0.1 -j ACCEPT
$IPT -A INPUT -j allow_connections
$IPT -A OUTPUT -j dns_outbound
$IPT -A INPUT -j ssh_inbound
#$IPT -A OUTPUT -o lo -d 127.0.0.1 -j ACCEPT
$IPT -A OUTPUT  -j file_outbound
$IPT -A OUTPUT -j web_outbound
$IPT -A OUTPUT -j email_outbound
$IPT -A OUTPUT -j chat_outbound
$IPT -A OUTPUT -j vpn_outbound
$IPT -A OUTPUT -j netbios_outbound