Anonymous

#!/bin/bashIPT=/sbin/iptablesUPLINK="eth2"# start bash script start_firewall() {	chains=`cat /proc/net/ip_tables_names`	for i in $chains; do    	$IPT -t $i -F	$IPT -t $i -X	$IPT -t $i -Z	done                      $IPT -P INPUT DROP       	$IPT -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 	$IPT -P OUTPUT ACCEPT	$IPT -P NAT ACCEPT	$IPT -P FORWARD ACCEPT	$IPT -P POSTROUTING ACCEPT		#share the internet	$IPT -t nat -I POSTROUTING -o ${UPLINK} -j MASQUERADEINTERFACES="lo br0"for x in ${INTERFACES}	do $IPT -I INPUT -i ${x} -j ACCEPTdoneSERVICES="21 22 6667 10000"for x in ${SERVICES}    do $IPT -A INPUT -p tcp --dport ${x} -i ${UPLINK} -j ACCEPTdone# log ssh attempts$IPT -I INPUT -p tcp --dport 22 -m state --state NEW -j LOG --log-prefix "IPT:SSH: "$IPT -I INPUT -p tcp --dport 22 -i eth2 -m state --state NEW -m recent --update --seconds 360 --hitcount 4 -j DROP}stop_firewall() {	  chains=`cat /proc/net/ip_tables_names`  for i in $chains; do    $IPT -t $i -F    $IPT -t $i -X    $IPT -t $i -Z  done  $IPT -P INPUT ACCEPT  $IPT -P OUTPUT ACCEPT  $IPT -P FORWARD ACCEPT  $IPT -I INPUT -i eth2 -j ACCEPT  $IPT -I OUTPUT -o eth2 -j ACCEPT  $IPT -I INPUT -i br0 -j ACCEPT  $IPT -I OUTPUT -o br0 -j ACCEPT  $IPT -t nat -I POSTROUTING -o eth2 -j MASQUERADE  echo -e "\n******************** Firewall stopped *********************\n"	}case "$1" in    start)    start_firewallecho "************************************************************"echo "****************** Starting the firewall *******************"echo "************************************************************"# Turn on IP Spoof protection by using IP Source Address Verificationif [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then   echo -n "Setting up IP spoofing protection..."   for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f   done   echo "done."else   echo PROBLEMS SETTING UP IP SPOOFING PROTECTION.  BE WORRIED.fi# Activate the forwarding!if [ -e /proc/sys/net/ipv4/ip_forward ]; then  echo -n "Turning on forwarding..."  echo 1 >/proc/sys/net/ipv4/ip_forward  echo "done."else  echo "Forwarding not turned on!  Be worried."fi# Enable bad error message protectionif [ -e /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses ] ; then  echo -n "Turning on bad error message protection..."  echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses  echo "done."else  echo "Problem turing on bad error message protection.  Be worried."fi# Don't respond to broadcast pings.if [ -e /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts ]; then  echo -n "Stopping broadcast pings..."  echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts  echo "done."else  echo "Problem stopping broadcast pings.  Be worried."fiecho -e "\n******************************************************************"   ;;     stop)    stop_firewall    ;;       *)    echo "Usage: $0 {start|stop}"    exit 1    ;;esac