#!/bin/sh
#Flush existing tables
/sbin/iptables -F
#Set policies for DROP
/sbin/iptables -A INPUT -P DROP
/sbin/iptables -A OUTPUT -P DROP
#Accept all localhost traffic
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -i lo -j ACCEPT
#Drop dodgy packets
/sbin/iptables -A INPUT -m state --state INVALID -j DROP
#Allow related and ongoing connections to continue
/sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#Allow SSH in on either ethernet interface
/sbin/iptables -A INPUT -p tcp -m state,limit --state NEW -i eth0 --dport 22 -s 192.168.0.* --limit 4/m -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m state,limit --state NEW -i eth1 --dport 22 -s 10.1.1.* --limit 4/m -j ACCEPT
#Allow DNS and WWW out
/sbin/iptables -A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
#For now, allow all ICMP in and out
/sbin/iptables -A INPUT -p icmp -j ACCEPT
/sbin/iptables -A OUTPUT -p icmp -j ACCEPT