# SMB / Windows filesharing, don't let it outside this LAN
iptables -A FORWARD -p tcp --sport 137 -j DROP
iptables -A FORWARD -p udp --sport 137 -j DROP
iptables -A FORWARD -p tcp --sport 138 -j DROP
iptables -A FORWARD -p udp --sport 138 -j DROP
iptables -A FORWARD -p tcp --sport 139 -j DROP
iptables -A FORWARD -p udp --sport 139 -j DROP
# IN the filter table (the default) Append a rule to the INPUT chain that says
# accept incoming packets which are part of an already established connection
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# IN the filter table (the default) Append a rule to the INPUT chain that says
# accept incoming packets that are starting new connections from any interface EXCEPT eth0.
iptables -A INPUT -m state --state NEW -i ! eth0 -j ACCEPT