#!/bin/sh
#IPFW script by w00dy
ipfwcmd="/sbin/ipfw"
flags="-q"
#int
oif="rl0"
logall="log"
### Flush the rules
$ipfwcmd $flags -f flush
### Allow loopback and deny loopback spoofs
$ipfwcmd $flags add 00100 allow all from any to any via lo0
$ipfwcmd $flags add 00110 deny $logall ip from any to 127.0.0.0/8 via $oif
$ipfwcmd $flags add 00120 deny $logall ip from 127.0.0.0/8 to any via $oif
### Stop PNAs from connecting
$ipfwcmd $flags add 00130 deny $logall ip from 192.168.0.0/16 to any via $oif
$ipfwcmd $flags add 00140 deny $logall ip from 172.16.0.0/12 to any via $oif
$ipfwcmd $flags add 00150 deny $logall ip from 10.0.0.0/8 to any via $oif
$ipfwcmd $flags add 00160 deny $logall ip from any to 192.168.0.0/16 via $oif
$ipfwcmd $flags add 00170 deny $logall ip from any to 172.16.0.0/12 via $oif
$ipfwcmd $flags add 00180 deny $logall ip from any to 10.0.0.0/8 via $oif
### Deny XMAS tree, Null scan, SYN Flood, Stealth FIN, and forced packer routing
$ipfwcmd $flags add 00200 deny log tcp from any to any in tcpflags fin,psh,urg recv $oif
$ipfwcmd $flags add 00210 deny log tcp from any to any in tcpflags !fin,!syn,!rst,!psh,!ack,!urg recv $oif
$ipfwcmd $flags add 00220 deny log tcp from any to any in tcpflags syn,fin recv $oif
$ipfwcmd $flags add 00230 deny log tcp from any to any in tcpflags fin,rst recv $oif
$ipfwcmd $flags add 00240 deny log ip from any to any in ipoptions ssrr,lsrr,rr,ts recv $oif
### Deny late, redirect, and spoofing attacks
$ipfwcmd $flags add 00250 deny $logall all from any to any frag
$ipfwcmd $flags add 00270 deny $logall icmp from any to any icmptype 5
$ipfwcmd $flags add 00280 deny $logall ip from me to me in via $oif
### Deny in pop & smtp
$ipfwcmd $flags add 00290 deny ip from any to any 25 in via $oif
$ipfwcmd $flags add 00295 deny ip from any to any 110 in via $oif
## Reject & Don't log IRC Proxy Scanner's ##
$ipfwcmd $flags add 00300 deny tcp from any to any 3128 in via $oif
$ipfwcmd $flags add 00310 deny tcp from any to any 80 in via $oif
$ipfwcmd $flags add 00320 deny tcp from any to any 1080 in via $oif
$ipfwcmd $flags add 00330 deny tcp from any to any 23 in via $oif
## Get rid of Microsoft bullshit
$ipfwcmd $flags add 00400 deny all from any to any 137 in via $oif
$ipfwcmd $flags add 00405 deny all from any to any 138 in via $oif
$ipfwcmd $flags add 00410 deny all from any to any 139 in via $oif
$ipfwcmd $flags add 00415 deny all from any to any 81 in via $oif
$ipfwcmd $flags add 00419 deny all from any to any 1025 in via $oif
$ipfwcmd $flags add 00420 deny all from any to any 1026 in via $oif
$ipfwcmd $flags add 00425 deny all from any to any 1027 in via $oif
$ipfwcmd $flags add 00430 deny all from any to any 1028 in via $oif
$ipfwcmd $flags add 00431 deny all from any to any 1029 in via $oif
$ipfwcmd $flags add 00432 deny all from any to any 1030 in via $oif
$ipfwcmd $flags add 00435 deny all from any to any 445 in via $oif
$ipfwcmd $flags add 00445 deny all from any to any 135 in via $oif
$ipfwcmd $flags add 00450 deny all from any to any 1434 in via $oif
$ipfwcmd $flags add 00455 deny all from any to any 1433 in via $oif
$ipfwcmd $flags add 00460 deny tcp from any to any 443 in via $oif
###### inbound section #######
### check the traffic's state
$ipfwcmd $flags add 00500 check-state
$ipfwcmd $flags add 00501 allow tcp from any to any established
### Allow in standard http
# $ipfwcmd $flags add 00510 allow tcp from any to any 80 in via $oif setup keep-state
### Allow in secure https
# $ipfwcmd $flags add 00515 allow tcp from any to any 443 in via $oif setup keep-state
### Allow in Webmin
$ipfwcmd $flags add 00670 allow tcp from any to me 9000 in via $oif setup keep-state
$ipfwcmd $flags add 00690 allow udp from any to me 9000 in via $oif keep-state
### Allow in dns
$ipfwcmd $flags add 00520 allow udp from 66.118.128.20 53 to me in via $oif keep-state
$ipfwcmd $flags add 00525 allow udp from 66.118.128.21 53 to me in via $oif keep-state
### Deny in pop & smtp
# $ipfwcmd $flags add 00560 deny tcp from any to me 25 in via $oif setup keep-state
# $ipfwcmd $flags add 00570 deny tcp from any to me 110 in via $oif setup keep-state
### Allow in imap
# $ipfwcmd $flags add 00580 allow tcp from any to me 143 in via $oif setup keep-state
### Allow in ftp
$ipfwcmd $flags add 00590 allow tcp from any to me 21 in via $oif setup keep-state
$ipfwcmd $flags add 00600 allow tcp from any to me 40000-65535 in via $oif setup keep-state
### Allow in ssh
$ipfwcmd $flags add 00620 allow tcp from any to me 22 in via $oif setup keep-state
### Allow in snmp
# $ipfwcmd $flags add 00630 allow udp from any to me 161 in via $oif keep-state
### Allow in irc
$ipfwcmd $flags add 00650 allow tcp from any to me 3000-9999 in via $oif setup keep-state
$ipfwcmd $flags add 00660 allow udp from any to me 49152-65535 in via $oif keep-state
### Allow in GameServer's
# $ipfwcmd $flags add 00661 allow tcp from any to me 20000-30000 in via $oif setup keep-state
### Allow in ping
$ipfwcmd $flags add 00665 allow icmp from any to me icmptype 0,8 in via $oif
### Allow in traceroute
$ipfwcmd $flags add 00670 allow icmp from any to me icmptype 3,11 in via $oif limit src-addr 4
### Allow in ident
$ipfwcmd $flags add 00675 allow tcp from any to me 113 in via $oif setup keep-state
### ACK scan (ACK,RST)
$ipfwcmd $flags add 00680 deny log tcp from any to any in tcpflags ack,rst recv $oif
#################### Deny & Log all incoming that fall through to here #########################
$ipfwcmd $flags add 01000 deny $logall logamount 500 all from any to any in via $oif
#################################################################################################
###### outbound section ######
### Allow out standard http
# $ipfwcmd $flags add 02000 allow tcp from any to any 80 out via $oif setup keep-state
### Allow out secure https
# $ipfwcmd $flags add 02010 allow tcp from any to any 443 out via $oif setup keep-state
### Allow out Webmin
$ipfwcmd $flags add 02020 allow tcp from any 9000 to any out via $oif setup keep-state
$ipfwcmd $flags add 02030 allow udp from any 9000 to any out via $oif keep-state
### Allow out dns
$ipfwcmd $flags add 02040 allow tcp from any to any 53 out via $oif setup keep-state
$ipfwcmd $flags add 02050 allow udp from any to any 53 out via $oif keep-state
$ipfwcmd $flags add 02060 allow tcp from any to any 953 out via $oif setup keep-state
$ipfwcmd $flags add 02070 allow udp from any to any 953 out via $oif keep-state
### Allow out pop & smtp
$ipfwcmd $flags add 02080 allow tcp from any to any 25 out via $oif setup keep-state
$ipfwcmd $flags add 02090 allow tcp from any to any 110 out via $oif setup keep-state
### Allow out imap
$ipfwcmd $flags add 02100 allow tcp from any to any 143 out via $oif setup keep-state
### Give root all
$ipfwcmd $flags add 02110 allow tcp from me to any out via $oif setup keep-state uid root
$ipfwcmd $flags add 02120 allow udp from me to any out via $oif keep-state uid root
### Allow out ftp with passive ports
$ipfwcmd $flags add 02130 allow tcp from me to any 21 out via $oif setup keep-state
# $ipfwcmd $flags add 02140 allow tcp from any 20 to any 49152-65535 setup keep-state
### Allow out ssh
$ipfwcmd $flags add 02150 allow tcp from me 22 to any out via $oif setup keep-state
### Allow out snmp
$ipfwcmd $flags add 02160 allow udp from any to any 161 out via $oif keep-state
### Allow out ident
$ipfwcmd $flags add 02170 allow tcp from any 113 to any out via $oif setup keep-state
### Allow out whois
$ipfwcmd $flags add 02190 allow tcp from any to any 43 out via $oif setup keep-state
### Allow out ping
$ipfwcmd $flags add 02200 allow icmp from any to any out via $oif
### Allow out finger
$ipfwcmd $flags add 02210 allow tcp from any to any 79 out via $oif setup keep-state
$ipfwcmd $flags add 02220 allow udp from any to any 79 out via $oif keep-state
### Allow out traceroute
$ipfwcmd $flags add 02230 allow udp from me to any 33435-33500 out via $oif keep-state
### Allow out ircd
$ipfwcmd $flags add 02240 allow tcp from any to any 3000-9999 out via $oif setup keep-state
$ipfwcmd $flags add 02250 allow tcp from any 49152-65535 to any out via $oif setup keep-state
###### Everything Else #####
### deny and log everything else that is trying to get out.
$ipfwcmd $flags add 03000 deny $logall logamount 500 all from any to any out via $oif
############## deny and log all packets that fell through to see what they are ####################
$ipfwcmd $flags add 04000 deny $logall logamount 500 all from any to any