#!/bin/sh
# some sys ctrl settings
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/ip_dynaddr
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 0 > /proc/sys/net/ipv4/tcp_ecn
for FILE in /proc/sys/net/ipv4/conf/*/rp_filter;
do
echo 1 > $FILE
# optional sysctrl - block ICMP ping
# echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
LANINTERFACE="eth1"
LANNETWORK="192.168.101.0/24"
WANINTERFACE="eth0"
/sbin/iptables -F -t filter
/sbin/iptables -F -t nat
/sbin/iptables -F -t mangle
/sbin/iptables -F -t raw
/sbin/iptables -X
/sbin/iptables -P INPUT DROP
/sbin/iptables -F INPUT
/sbin/iptables -P FORWARD DROP
/sbin/iptables -F FORWARD
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -F OUTPUT
/sbin/iptables -A INPUT -m state --state INVALID -j DROP
/sbin/iptables -A OUTPUT -m state --state INVALID -j DROP
/sbin/iptables -A FORWARD -m state --state INVALID -j DROP
# block and ignore IGMP and multicast packets
/sbin/iptables -A INPUT -p igmp -j DROP
/sbin/iptables -A INPUT -d 224.0.0.0/4 -j DROP
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A INPUT -p icmp -m icmp --icmp-type 255 -j ACCEPT
# allow related-established and outgoing new from lan
/sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -m state --state NEW -i $LANINTERFACE -s $LANNETWORK -o $WANINTERFACE -j ACCEPT
# to allow lan dhcp clients to connect to this host
# /sbin/iptables -A INPUT -p udp --source-port 68 --destination-port 67 -i $LANINTERFACE -j ACCEPT
# to allow this host to get an ip by dhcp
# /sbin/iptables -A INPUT -p udp --source-port 67 --destination-port 68 -i $WANINTERFACE -j ACCEPT
# allow all lan icmp
/sbin/iptables -A INPUT -p icmp -i $LANINTERFACE -s $LANNETWORK -j ACCEPT
# connections we allow to this box itself only
# allow ssh but only from lan
/sbin/iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -i $LANINTERFACE -j ACCEPT
# get forwarding
/sbin/iptables -t nat -A POSTROUTING -o $WANINTERFACE -j MASQUERADE
# finally log whats left and reject it
/sbin/iptables -A INPUT -j LOG
/sbin/iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
/sbin/iptables -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
/sbin/iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
#
/sbin/iptables -A FORWARD -j LOG
/sbin/iptables -A FORWARD -p tcp -j REJECT --reject-with tcp-reset
/sbin/iptables -A FORWARD -p udp -j REJECT --reject-with icmp-port-unreachable
/sbin/iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited