#!/bin/bash
# Firewall taken from Linux Administration: A Beginner's Guide
# This version is for a host that will be doing NAT
echo -n "Loading firewall rules..."
# Internet gateway device
GW=eth0
# Flush any existing rules
iptables -F
# load modules
modprobe iptable_nat
modprobe ip_nat_ftp
# define default policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
# iptables -t nat -p PREROUTING ACCEPT
# Let users on the inside network (eth0) make connections to the Internet
# but don't let the Internet make connections back. We define a new chain
# called 'block' that we use for grouping our state tracking rules together.
# The first rule states that any packet that is part of an established
# connection or is related to an established connection is allowed through.
# The second rule states that in order for a packet to create a new connection,
# it cannot originate from the $GW (Internet-facing) interface. If a packet
# does not match either of these two rules, the third rule forces it to be dropped.
iptables -N block
iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A block -m state --state NEW -i ! $GW -j ACCEPT
iptables -A block -j DROP
# We need to call on the blocking chain from the INPUT and FORWARD chains.
# We aren'nt worried about the OUTPUT chain since only packets originating
# from the firewall itself come from there. When doing NAT, the INPUT chain
# will not be hit so we need to have FORWARD do the check. If a packet is
# destined to the firewall itself, we need the checks done from the INPUT chain.
iptables -A INPUT -j block
iptables -A FORWARD -j block
# Finally, as the packet leaves the system, we perform the MASQUERADE function
# from the POSTROUTING chain in the NAT table. All packets that leave from the
# $GW interface go through this chain.
iptables -t nat -A POSTROUTING -o $GW -j MASQUERADE
# Enable IP forwarding, SYN cookie protection, protection from Smurf attacks
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "Done"
exit 0