rendered paste body#!/bin/bash
echo "Firewalling..."
iptables -F # Clear the tables
iptables -F -t nat # Clear the tables
iptables -X # Clear the tables
iptables -P INPUT DROP # Default policies
iptables -P OUTPUT ACCEPT # Default policies
iptables -P FORWARD DROP # Default policies
iptables -A INPUT -p icmp --icmp-type 0 -j ACCEPT # Accept ping replies
iptables -A INPUT -p icmp -i tap+ --icmp-type 8 -j ACCEPT # Accept ping requests on AnoNet
iptables -A INPUT -p icmp --icmp-type 3 -j ACCEPT # Accept Dest-Unreachable (Traceroute)
iptables -A INPUT -p icmp --icmp-type 11 -j ACCEPT # Accept Time-Exceeded (Sometimes traceroute)
iptables -A INPUT -i lo -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT # Accept all loopback stuff
iptables -A INPUT -i + -m state --state ESTABLISHED,RELATED -j ACCEPT # Accept reply packets
##################################
################## This section is for NATing boxes on your home lan. Feel free
# ANONET GATEWAY # to remove it.
##################
#iptables -A FORWARD -i eth0 -s <IP-TO-PERMIT-NAT--EX:192.168.0.9> -j ACCEPT
#iptables -t nat -A POSTROUTING -s <IP-TO-PERMIT-NAT--EX:192.168.0.9> -j MASQUERADE
#iptables -A FORWARD -i tap+ -s 1.0.0.0/8 -d 1.0.0.0/8 -j ACCEPT
#iptables -A FORWARD -i tap+ -d 10.0.0.0/8 -j ACCEPT
#iptables -A FORWARD -i tap+ -d 192.168.0.0/24 -m state --state NEW,INVALID -j DROP
#iptables -A FORWARD -i tap+ -d 192.168.0.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT
#################
# ANONET SERVER #
#################
iptables -A INPUT -i ppp-e.r.srn-0 --protocol tcp --dport 179 -d 1.9.8.4 -j ACCEPT # Opens port 80 on Ano
iptables -A INPUT -i ppp-e.r.srn-0 --protocol tcp --dport 53 -d 1.9.8.4 -j ACCEPT
iptables -A INPUT -i ppp-e.r.srn-0 --protocol udp --dport 53 -d 1.9.8.4 -j ACCEPT
iptables -A INPUT -i ppp-e.r.srn-0 --protocol tcp --dport 80 -d 1.9.8.4 -j ACCEPT
iptables -A INPUT -i ppp-e.r.srn-0 --protocol udp --dport 2998 -d 1.9.8.4 -j ACCEPT
iptables -t nat -A POSTROUTING ! -s 1.0.0.0/8 -d 1.0.0.0/8 -j SNAT --to-source 1.9.8.4
#iptables -A INPUT -i tap+ -d 224.0.0.5 -j ACCEPT # You need this for OSPF to work
#iptables -A INPUT -i tap+ -d 224.0.0.6 -j ACCEPT # You need this for OSPF to work
##################################
iptables -A INPUT -i + -m state --state NEW -j DROP
iptables -A INPUT -i + -m state --state INVALID -j DROP
echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all # Ignore Pings
echo "1" > /proc/sys/net/ipv4/ip_forward # Forward Traffic
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Ignore broadcast pings (good)
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route # You may want to turn this on if you're a router
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
echo "0" > /proc/sys/net/ipv4/conf/all/secure_redirects
echo "0" > /proc/sys/net/ipv4/conf/all/rp_filter # if you are a router; not to be used
# in general (has security implications).
# See rfc1812, 5.3.8
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
echo "1" > /proc/sys/net/ipv4/tcp_syncookies # Nice new anti-DoS feature
echo "Firewalled"