#!/bin/bash
set -x
# Load needed kernel modules
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# Clear any existing firewall stuff before we start
iptables --flush
iptables -t nat --flush
iptables -t mangle --flush
# As the default policies, drop all incoming traffic but allow all
# outgoing traffic. This will allow us to make outgoing connections
# from any port, but will only allow incoming connections on the ports
# specified below.
#changed from drop
iptables --policy INPUT ACCEPT
iptables --policy OUTPUT ACCEPT
# Allow all incoming traffic if it is coming from the local loopback device
iptables -A INPUT -i lo -j ACCEPT
# Related and established connections: see
# http://www.sns.ias.edu/~jns/security/iptables/iptables_conntrack.html
#
# Accept all incoming traffic associated with an established
# connection, or a "related" connection
#
# This will automatically handle incoming UDP traffic associated with
# DNS queries, as well as PASSIVE mode FTP (provided the
# ip_conntrack_ftp module is loaded)
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow connections on selected ports to the firewalled computer:
# 22 ssh
# 80 web
# 25 smtp (mail)
# Block all MySQL connection just to be sure
#iptables -A INPUT -p tcp -i eth0 --dport 22 -m state --state NEW -j ACCEPT
#iptables -A INPUT -p tcp -i eth0 --dport 80 -m state --state NEW -j ACCEPT
#iptables -A INPUT -p tcp -i eth0 --dport 25 -m state --state NEW -j ACCEPT
#iptables -A FORWARD -p tcp -s 0/0 -d 62.3.3.0/24 --dport 3306 -j DROP
#####################################################################3
#portmap TCP *:sunrpc (LISTEN)
#rpc.statd TCP *:50176 (LISTEN)
#named TCP *:domain (LISTEN)
#named TCP xena.amphipolis.thrace.local:domain (LISTEN)
#named TCP localhost:953 (LISTEN)
#named TCP ip6-localhost:953 (LISTEN)
#sshd TCP *:ssh (LISTEN)
#ALLOW sshd TCP *:48004 (LISTEN) ----SETUP -p for port
#mysqld TCP xena.amphipolis.thrace.local:mysql (LISTEN)
#slapd TCP *:ldap (LISTEN)
#approx TCP *:9999 (LISTEN)
#cupsd TCP localhost:ipp (LISTEN)
#exim4 TCP localhost:smtp (LISTEN)
#rpc.mount TCP *:48217 (LISTEN)
#inetd TCP *:auth (LISTEN)
#inetd TCP *:swat (LISTEN)
#smbd TCP *:microsoft-ds (LISTEN)
#smbd TCP *:netbios-ssn (LISTEN)
#VBoxHeadl TCP *:3389 (LISTEN)
#sshd TCP localhost:6010 (LISTEN)
#sshd TCP ip6-localhost:6010 (LISTEN)
#sshd TCP localhost:6011 (LISTEN)
#sshd TCP ip6-localhost:6011 (LISTEN)
#sshd TCP localhost:6012 (LISTEN)
#sshd TCP ip6-localhost:6012 (LISTEN)
#transmiss TCP *:51413 (LISTEN)
#transmiss TCP *:9091 (LISTEN)
iptables -A INPUT -p tcp --dport 530 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp -dport 50176 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 953 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -s 0.0.0.0/0 -m state --state NEW -j REJECT
iptables -A INPUT -p tcp --dport 48004 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 389 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 9999 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 631 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
#MAIL Server why is it on?
#iptables -A INPUT -p tcp --dport 10024 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 48217 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 113 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 901 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 445 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 137 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 3389 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 6010 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 6012 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport -51413 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 9091 -s 192.168.1.0/24 -m state --state NEW -j ACCEPT
#-s 0.0.0.0/0
#-s 192.168.1.0/24
####################################################################
# Allow icmp input so that people can ping us
iptables -A INPUT -p icmp -j ACCEPT
# Logging: first, eliminate any packets that are going to broadcast
# addresses, since they will overwhelm the log files if there are any
# windows computers on our network. Also, don't log pesky multicast
# packets that we block.
iptables -A INPUT -d 255.255.255.255/0.0.0.255 -j DROP
iptables -A INPUT -d 224.0.0.1 -j DROP
# Log all other blocked packets, and change DROP to REJECT to be
# polite and allow people connecting to a blocked port to receive a
# "connection refused" message instead of timing out after 30 seconds.
iptables -A INPUT -j LOG
iptables -A INPUT -j REJECT