rendered paste body#!/bin/bashfunction rules(){IPT="/sbin/iptables"INET="eth1"LAN="eth0"INTERNALNET="192.168.1.1/24"INTERNALBCAST="192.168.1.255"# Reset the firewallfor table in nat mangledo $IPT -F $IPT -X $IPT -t $table -F $IPT -t $table -Xdone# Default DROP policies $IPT -P INPUT DROP $IPT -P OUTPUT DROP $IPT -P FORWARD ACCEPT### allow localhost# drop pcks comming from outside claiming to be from localhost$IPT -A INPUT -i $INET -d 127.0.0.0/8 -j DROP$IPT -A INPUT -i lo -j ACCEPT$IPT -A OUTPUT -o lo -j ACCEPT### allow my Lan# drop pcks comming from outside claiming to be from lan$IPT -A INPUT -i $INET -s $INTERNALNET -j DROP$IPT -A INPUT -i $LAN -j ACCEPT$IPT -A OUTPUT -o $LAN -j ACCEPT#$IPT -A INPUT -i $LAN -m state --state RELATED,ESTABLISHED -j ACCEPT#$IPT -A OUTPUT -o $LAN -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT### Ping flood protection$IPT -A INPUT -p icmp --icmp-type echo-request -j DROP# Deny icmp to broadcast address$IPT -A INPUT -p icmp -d $INTERNALBCAST -j DROP###################################################### SET PORTS TO BE OPEN TO THE INTERNET HERE ##$IPT -A INPUT -i $INET -p tcp --dport 80 -j ACCEPT$IPT -A OUTPUT -o $INET -p tcp --dport 80 -j ACCEPT#####################################################$IPT -A INPUT -i $INET -m state --state RELATED,ESTABLISHED -j ACCEPT$IPT -A OUTPUT -o $INET -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT### Drop Invalid packs#$IPT -A INPUT -i eth0 -m state --state INVALID -m limit $LOGOPT -j LOG --log-prefix "INVALID DROP:"$IPT -A INPUT -i $INET -m state --state INVALID -j DROP$IPT -A FORWARD -m state --state INVALID -j DROP### SYN flood protection for the INPUT chain ###SYNOPT="--limit 10/second --limit-burst 10"# tcp$IPT -N SYN_PROT$IPT -A INPUT -i $INET -p tcp --syn -j SYN_PROT$IPT -A SYN_PROT -p tcp --syn -m limit $SYNOPT -j RETURN$IPT -A SYN_PROT -j DROP# Drop packets that are likely to be stealth scans$IPT -A INPUT -i $INET -p tcp --tcp-flags ALL NONE -j DROP$IPT -A INPUT -i $INET -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP$IPT -A INPUT -i $INET -p tcp --tcp-flags SYN,RST SYN,RST -j DROP$IPT -A INPUT -i $INET -p tcp --tcp-flags FIN,RST FIN,RST -j DROP$IPT -A INPUT -i $INET -p tcp --tcp-flags ACK,FIN FIN -j DROP$IPT -A INPUT -i $INET -p tcp --tcp-flags ACK,PSH PSH -j DROP$IPT -A INPUT -i $INET -p tcp --tcp-flags ACK,URG URG -j DROP### Share the internet$IPT -t nat -A POSTROUTING -o eth0 -j MASQUERADE}function pre-setup(){if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then echo -n " * Setting up IP spoofing protection..." for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f done echo " * done."else echo " *** Problems setting uo IP Spoofing Protection! *** "fi# Activate the forwarding!if [ -e /proc/sys/net/ipv4/ip_forward ]; then echo -n " * Turning on forwarding..." echo 1 >/proc/sys/net/ipv4/ip_forward echo " * done."else echo " *** Forwarding not turned on! *** "fi# Enable bad error message protectionif [ -e /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses ] ; then echo -n " * Turning on bad error message protection..." echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses echo " * done."else echo " *** Problem turing on bad error message protection! *** "fi# Don't respond to broadcast pings.if [ -e /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts ]; then echo -n " * Stopping broadcast pings..." echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts echo " * done."else echo " *** Problem stopping broadcast pings! *** "fi}case "$1" in start) pre-setup rules ;; *) echo "usage: $0 { start | stop } " ;;esac