rendered paste body#!/bin/bash#----------------------------------------------------------------------# Description: rc.firewall# Author: Goten Xiao <gotenxiao@gmail.com># Created at: Fri Oct 6 19:57:17 BST 2006# Computer: r2d3# System: Linux 2.6.17.13-gx4 on i686# # Copyright (c) 2006 All rights reserved.##----------------------------------------------------------------------# Configure section:IPTABLES="/usr/sbin/iptables"#----------------------------------------------------------------------## main()function firewall_clear(){ $IPTABLES -F}function firewall_off(){ firewall_clear}function firewall_low(){ firewall_clear $IPTABLES -P INPUT DROP $IPTABLES -P FORWARD DROP $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT $IPTABLES -A INPUT -p icmp -j ACCEPT $IPTABLES -A INPUT -p tcp --dport 21 -j ACCEPT #FTP $IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT #SSH $IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT #HTTP $IPTABLES -A INPUT -p tcp --dport 443 -j ACCEPT #HTTPS $IPTABLES -A INPUT -p tcp --dport 139 -j ACCEPT #NetBIOS $IPTABLES -A INPUT -p tcp --dport 445 -j ACCEPT #Samba $IPTABLES -A INPUT -p tcp --dport 631 -j ACCEPT #CUPS $IPTABLES -A INPUT -p tcp --dport 901 -j ACCEPT #Samba SWAT $IPTABLES -A INPUT -p tcp --dport 5900 -j ACCEPT #VNC $IPTABLES -A INPUT -p tcp -m multiport --dports 6881-6900 -j ACCEPT #BitTorrent}function firewall_medium(){ # Only allow ICMP, SSH, HTTP, HTTPS and BitTorrent firewall_clear $IPTABLES -P INPUT DROP $IPTABLES -P FORWARD DROP $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT $IPTABLES -A INPUT -p icmp -j ACCEPT $IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT #SSH $IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT #HTTP $IPTABLES -A INPUT -p tcp --dport 443 -j ACCEPT #HTTPS $IPTABLES -A INPUT -p tcp --dport 5900 -j ACCEPT #VNC $IPTABLES -A INPUT -p tcp -m multiport --dports 6881-6900 -j ACCEPT #BitTorrent}function firewall_high(){ #Refuse anything incoming except SSH. firewall_clear $IPTABLES -P INPUT DROP $IPTABLES -P FORWARD DROP $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT $IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT #SSH}function firewall_lockdown(){ #NOTHING gets in. Total network lockdown. firewall_clear $IPTABLES -P INPUT DROP $IPTABLES -P FORWARD DROP $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT}case $1 inlockdown) firewall_lockdown ;;high) firewall_high ;;medium) firewall_medium ;;low) firewall_low ;;off) firewall_off ;;*) #Default level firewall_medium ;;esac