rendered paste body#!/bin/sh
#########################
# configuration options #
#########################
INET_IP="201.12.35.51"
INET_IFACE="eth0"
LAN_IP="192.168.1.1"
LAN_IP_RANGE="192.168.1.0/24"
LAN_IFACE="eth1"
LO_IFACE="lo"
LO_IP="127.0.0.1"
IPTABLES=`which iptables`
MODPROBE=`which modprobe`
################
# load modules #
################
#$MODPROBE ip_conntrack_ftp
#$MODPROBE ip_conntrack_irc
#######################
# /proc configuration #
#######################
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "30" > /proc/sys/net/ipv4/tcp_fin_timeout
echo "1800" > /proc/sys/net/ipv4/tcp_keepalive_time
echo "60" > /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout
echo "32768 61000" > /proc/sys/net/ipv4/ip_local_port_range
###############
# set policie #
###############
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
#########
# flush #
#########
$IPTABLES -F
$IPTABLES -F -t nat
$IPTABLES -F -t mangle
$IPTABLES -X
$IPTABLES -X -t nat
$IPTABLES -X -t mangle
###############################################################################
# Chains #
###############################################################################
#################
# create chains #
#################
$IPTABLES -N allowed_packets
$IPTABLES -N denied_packets
$IPTABLES -N tcp_packets
$IPTABLES -N udp_packets
$IPTABLES -N icmp_packets
########################
# chain denied_packets #
########################
$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK \
-m state --state NEW -j DROP
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \
--log-prefix "New not SYN:"
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
#########################
# chain allowed_packets #
#########################
$IPTABLES -A allowed -p tcp --syn -j ACCEPT
$IPTABLES -A allowed -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p tcp -j DROP
#####################
# chain tcp_packets #
#####################
# accept ftp.
$IPTABLES -A tcp_packets -p tcp -s 0/0 --dport 21 -j allowed
#####################
# chain udp_packets #
#####################
# accept dns.
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 53 -j ACCEPT
# block fucking microsoft boxes requests.
$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d $INET_BROADCAST \
--destination-port 135:139 -j DROP
# block dhcp broadcast too.
$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d 255.255.255.255 \
--destination-port 67:68 -j DROP
######################
# chain icmp_packets #
######################
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
###############################################################################
# Filter Rules #
###############################################################################
#####################
# Mangle PREROUTING #
#####################
$IPTABLES -t mangle -A PREROUTING -p tcp --dport 20 -j TOS --set-tos Maximize-Throughput
$IPTABLES -t mangle -A PREROUTING -p tcp --dport 21 -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A PREROUTING -p tcp --dport 22 -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A PREROUTING -p tcp --dport 25 -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A PREROUTING -p udp --dport 53 -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A PREROUTING -p tcp --dport 80 -j TOS --set-tos Maximize-Throughput
$IPTABLES -t mangle -A PREROUTING -p tcp --dport 110 -j TOS --set-tos Maximize-Throughput
$IPTABLES -t mangle -A PREROUTING -p tcp --dport 443 -j TOS --set-tos Maximize-Throughput
###############
# INPUT chain #
###############
# we don't want bad packets.
$IPTABLES -A INPUT -p tcp -j bad_tcp_packets
# special rules not for internet.
$IPTABLES -A INPUT -p all -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p all -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPTABLES -A INPUT -p all -i $LO_IFACE -s $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -p all -i $LO_IFACE -s $INET_IP -j ACCEPT
# accept dhcp.
$IPTABLES -A INPUT -p udp -i $LAN_IFACE --dport 67 --sport 68 -j ACCEPT
# accept incoming packets from the internet.
$IPTABLES -A INPUT -p all -d $INET_IP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p tcp -i $INET_IFACE -j tcp_packets
$IPTABLES -A INPUT -p udp -i $INET_IFACE -j udp_packets
$IPTABLES -A INPUT -p icmp -i $INET_IFACE -j icmp_packets
# accept esp/ike protocols for IPSEC.
iptables -A INPUT -p udp -i $INET_IP --sport 500 --dport 500 -j ACCEPT
iptables -A INPUT -p 50 -i $INET_IP -j ACCEPT
# stop multicasts from microsoft.
$IPTABLES -A INPUT -i $INET_IFACE -d 224.0.0.0/8 -j DROP
# log all other packets.
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "INPUT blocked: "
#################
# FORWARD chain #
#################
# we don't want bad packets.
$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets
# accept packets we actually want to forward.
$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# log all other packets.
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "FORWARD blocked: "
#################
# Mangle OUTPUT #
#################
$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p tcp --dport 20 -j TOS --set-tos Maximize-Throughput
$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p tcp --dport 21 -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p tcp --dport 22 -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p tcp --dport 25 -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p udp --dport 53 -j TOS --set-tos Maximize-Throughput
$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p tcp --dport 80 -j TOS --set-tos Maximize-Throughput
$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p tcp --dport 110 -j TOS --set-tos Maximize-Throughput
$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p tcp --dport 443 -j TOS --set-tos Maximize-Throughput
$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p tcp --dport 6000:6063 -j TOS --set-tos Maximize-Throughput
################
# OUTPUT chain #
################
# we don't want bad packets.
$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets
# accept all output packets.
$IPTABLES -A OUTPUT -p all -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p all -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p all -s $INET_IP -j ACCEPT
# log all other packets.
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "OUTPUT blocked: "
###############
# POSTROUTING #
###############
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP