rendered paste body#!/bin/bash
/etc/init.d/iptables stop
export LAN=eth0
export WAN=eth1
# tell the kernel that forwarding is OK
echo 1 > /proc/sys/net/ipv4/ip_forward
for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 1 > $f ; done
# Flush any existing rules and set the default policies
iptables -F
iptables -t nat -F
iptables -P INPUT REJECT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
# Accept anything from myself
iptables -A INPUT -i lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
# Allow existing connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# routing services only work for the LAN
iptables -I INPUT 1 -i ${LAN} -j ACCEPT
iptables -I INPUT 1 -i lo -j ACCEPT
iptables -A INPUT -p UDP --dport bootps -i ! ${LAN} -j REJECT
iptables -A INPUT -p UDP --dport domain -i ! ${LAN} -j REJECT
# Drop packets to priveleged ports
iptables -A INPUT -p TCP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP
iptables -A INPUT -p UDP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP
# rules for NAT
iptables -I FORWARD -i ${LAN} -d 192.168.0.0/255.255.0.0 -j DROP
iptables -A FORWARD -i ${LAN} -s 192.168.0.0/255.255.0.0 -j ACCEPT
iptables -A FORWARD -i ${WAN} -d 192.168.0.0/255.255.0.0 -j ACCEPT
iptables -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE
# Allow myself to be a non-passive FTP client
iptables -A INPUT -p tcp --dport ftp-data -j ACCEPT
# Do not allow a local user to connect to a remote Telnet
# server and thus give away login and password information:
iptables -A OUTPUT -p tcp --dport telnet -j REJECT
# proftp stuff
iptables -A INPUT -p tcp --dport 60000:65535 -j ACCEPT
iptables -A INPUT -p tcp --dport 800 -j ACCEPT
# SSH
iptables -A INPUT -p TCP --dport ssh -i ${WAN} -j ACCEPT
# DC++ Port (custom)
iptables -A INPUT -p tcp --dport 27072 -j ACCEPT
iptables -A INPUT -p udp --dport 27072 -j ACCEPT
# Gnutella Listen Port (custom)
iptables -A INPUT -p tcp --dport 24247 -j ACCEPT
iptables -A INPUT -p udp --dport 24247 -j ACCEPT
# Appolon
iptables -A INPUT -p tcp --dport 1215 -j ACCEPT
iptables -A INPUT -p udp --dport 1215 -j ACCEPT
# Steam Clients
iptables -A INPUT -p tcp --dport 27020:27041 -j ACCEPT
iptables -A INPUT -p udp --dport 27020:27041 -j ACCEPT
iptables -A INPUT -p udp --dport 1200 -j ACCEPT
# Steam Servers
iptables -A INPUT -p tcp --dport 27015 -j ACCEPT
iptables -A INPUT -p udp --dport 27015 -j ACCEPT
# Steam Friends Service
iptables -A INPUT -p udp --dport 1200 -j ACCEPT
# TeamSpeak
#off# iptables -A INPUT -p tcp --dport 14534 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 51234 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 8767 -j ACCEPT
# Unreal
#off# iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 7777 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 7778 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 7779 -j ACCEPT # plus?
#off# iptables -A INPUT -p udp --dport 27900 -j ACCEPT
# UnrealTournament
#off# iptables -A INPUT -p tcp --dport 7777 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 8777 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 9777 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 27900 -j ACCEPT
# UnrealTournament 2003/2004
#off# iptables -A INPUT -p tcp --dport 42292 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 7777 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 7778 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 7787 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 27900 -j ACCEPT
# RTC Wolfenstein
#off# iptables -A INPUT -p udp --dport 27950 -j ACCEPT # 27950:27951?
#off# iptables -A INPUT -p udp --dport 27960 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 27965 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 27952 -j ACCEPT
# RTC Wolfenstein: Enemy Territory
#off# iptables -A INPUT -p udp --dport 27960 -j ACCEPT
# Worms Armageddon
#off# iptables -A INPUT -p tcp --dport 17010:17012 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 6667 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 80 -j ACCEPT
# Tribes 2
#off# iptables -A INPUT -p tcp --dport 15101 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 15104 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 15204 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 15206 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 15800 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 27999 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 28000:29000 -j ACCEPT
# Tribes Aerial Assault
#off# iptables -A INPUT -p tcp --dport 28000:28008 -j ACCEPT
# Tribes Vengence
#off# iptables -A INPUT -p tcp --dport 7777 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 7777 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 7778 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 7778 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 28910 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 6500 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 27900 -j ACCEPT
# Diablo/Diablo 2
#off# iptables -A INPUT -p tcp --dport 4000:6112 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 4000:6112 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 6112-6119 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 6112-6119 -j ACCEPT
# Doom 3
iptables -A INPUT -p tcp --dport 27666 -j ACCEPT
iptables -A INPUT -p udp --dport 27666 -j ACCEPT
iptables -A INPUT -p tcp --dport 27650 -j ACCEPT
iptables -A INPUT -p udp --dport 27650 -j ACCEPT
# FEAR
#off# iptables -A INPUT -p tcp --dport 27888 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 27888 -j ACCEPT
# Hexen 2
#off# iptables -A INPUT -p tcp --dport 26900 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 26900 -j ACCEPT
# Far Cry
#off# iptables -A INPUT -p tcp --dport 49001:49002 -j ACCEPT # tcp:40000-42999 ??
#off# iptables -A INPUT -p udp --dport 49001:49002 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 49124 -j ACCEPT # udp:41005,41006,44000,49001 ??
# Gamespy
#off# iptables -A INPUT -p tcp --dport 6667 -j ACCEPT #irc
#off# iptables -A INPUT -p tcp --dport 3783 -j ACCEPT #voice
#off# iptables -A INPUT -p tcp --dport 27900 -j ACCEPT #master server udp heart beat
#off# iptables -A INPUT -p tcp --dport 28900 -j ACCEPT #master server list request
#off# iptables -A INPUT -p tcp --dport 29900 -j ACCEPT #gp connection manager
#off# iptables -A INPUT -p tcp --dport 29901 -j ACCEPT #gp search manager
#off# iptables -A INPUT -p tcp --dport 13139 -j ACCEPT #custom udp pings
#off# iptables -A INPUT -p tcp --dport 6515 -j ACCEPT #dplay udp
#off# iptables -A INPUT -p tcp --dport 6500 -j ACCEPT #query
#off# iptables -A INPUT -p tcp --dport 6700 -j ACCEPT
# Red Faction
#off# iptables -A INPUT -p udp --dport 7755 -j ACCEPT
# Quake 4
iptables -A INPUT -p udp --dport 28004 -j ACCEPT
iptables -A INPUT -p udp --dport 27950 -j ACCEPT
# Quake 3
iptables -A INPUT -p tcp --dport 27960 -j ACCEPT
iptables -A INPUT -p udp --dport 27960 -j ACCEPT
# Quake 2
#off# iptables -A INPUT -p tcp --dport 27910 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 27910 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 27901 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 27901 -j ACCEPT
# Quake 1
#off# iptables -A INPUT -p tcp --dport 26000 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 26000 -j ACCEPT
# Serious Sam: The Second Encounter
#off# iptables -A INPUT -p tcp --dport 25600:25616 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 25600:25616 -j ACCEPT
# Soldier of Fortune
#off# iptables -A INPUT -p udp --dport 28910:28915 -j ACCEPT
# Soldier of Fortune 2
#off# iptables -A INPUT -p udp --dport 20100 -j ACCEPT # 20100:10120 ?
# StarCraft
#off# iptables -A INPUT -p udp --dport 6112 -j ACCEPT
# Starseige Tribes
#what# iptables -A INPUT -p tcp --dport 28001 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 27999 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 28000 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 28008 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 28020 -j ACCEPT
# Arcanum
#off# iptables -A INPUT -p tcp --dport 11501 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 15204 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 15300 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 15800 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 20851 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 31435 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 31435 -j ACCEPT
# Aliens vs Predator
#off# iptables -A INPUT -p udp --dport 80 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 2300:2400 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 8000:8999 -j ACCEPT
# Aliens vs Predator 2
#off# iptables -A INPUT -p tcp --dport 2300:2400 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 7000:10000 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 27888:27900 -j ACCEPT
# Baldurs Gate 1 and 2
#off# iptables -A INPUT -p tcp --dport 2300 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 2300 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 2400:6073 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 2400:6073 -j ACCEPT
# MySQL Server
#off# iptables -A INPUT -p tcp --dport 3306 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 3306 -j ACCEPT
# VNC
#off# iptables -A INPUT -p tcp --dport 5500 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 5500 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 5800 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 5800 -j ACCEPT
#off# iptables -A INPUT -p tcp --dport 5900 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 5900 -j ACCEPT
# POP3
#off# iptables -A INPUT -p tcp --dport 110 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 110 -j ACCEPT
# SSH
#off# iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 22 -j ACCEPT
# ICQ
#off# iptables -A INPUT -p tcp --dport 5190 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 5190 -j ACCEPT
# Yahoo P2P Instant Message
#off# iptables -A INPUT -p tcp --dport 5101 -j ACCEPT
# Yahoo file Transfer
#off# iptables -A INPUT -p tcp --dport 80 -j ACCEPT
# Yahoo webcam
#off# iptables -A INPUT -p tcp --dport 5100 -j ACCEPT
# Yahoo voice chat
#off# iptables -A INPUT -p udp --dport 5000:5010 -j ACCEPT
# IRC DCC
iptables -A INPUT -p tcp --dport 10051:10070 -j ACCEPT
iptables -A INPUT -p udp --dport 10051:10070 -j ACCEPT
# Windows SMB
iptables -A INPUT -p tcp --dport 135:139 -j ACCEPT
iptables -A INPUT -p udp --dport 135:139 -j ACCEPT
iptables -A INPUT -p tcp --dport 445 -j ACCEPT
iptables -A INPUT -p udp --dport 445 -j ACCEPT
# AIM DCC
#off# iptables -A INPUT -p tcp --dport 5190:5200 -j ACCEPT
# AIM Video IM
#off# iptables -A INPUT -p tcp --dport 1024:5000 -j ACCEPT
#off# iptables -A INPUT -p udp --dport 1024:5000-j ACCEPT
# Report what happened
echo 'Firewall rules installed:'
iptables -L
/etc/init.d/iptables save
/etc/init.d/iptables start
exit