echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
# We disable packet forwarding
echo "0" > /proc/sys/net/ipv4/ip_forward
# We flush all firewall rules
iptables -F
iptables -X
iptables -Z
# set default policy, drop everythin unless permited
iptables -P FORWARD DROP
# We should accept pings and so on
iptables -A INPUT -i eth0 -p ICMP -j ACCEPT
# FTP server on port 21. Also a range of ports for passive connections
iptables -A INPUT -i eth0 -p tcp -m tcp --dport 21 -m state --state NEW -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m tcp --dport 55210:55410 -m state --state NEW -j ACCEPT
# Web server
iptables -A INPUT -i eth0 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
# IMPORTANT, ssh ;-)
iptables -A INPUT -i eth0 -p tcp -m tcp --dport ssh -m state --state NEW -j ACCEPT
# Port only open to MY_HOME_IP (there's a proxy there)
iptables -A INPUT -s MY_HOME_IP -p tcp -m tcp --dport 8888 -m state --state NEW -j ACCEPT
# Once a connection is stablished, we accept all related traffic
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Everything else should be dropped
iptables -A INPUT -i eth0 -m state --state INVALID,NEW -j DROP