rendered paste body#! /bin/sh#set -ePATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/binDESC="iptables"NAME=iptablesSCRIPTNAME=/etc/init.d/fw#IP=193.108.234.183IP=`ifconfig eth0 | grep "inet" | sed -e 's/^.*addr://' -e 's/\ .*//'`EXTIP="192.168.2.1" # NAT# Gracefully exit if the package has been removed.## Function that starts the daemon/service.#d_start(){ for MOD in ip_tables ip_conntrack iptable_filter iptable_mangle iptable_nat ipt_LOG ipt_limit ipt_state; do modprobe $MOD done iptables -P INPUT DROP iptables -P OUTPUT ACCEPT iptables -P FORWARD DROP iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD iptables -F -t nat #accept established connnections iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT #accept conn. from loopback iptables -A INPUT -i lo -s 0/0 -d 0/0 -j ACCEPT #accept conn. from eth1# iptables -A INPUT -i eth1 -j ACCEPT #drop packets who fake the source# iptables -A INPUT -i eth0 -s $IP -j DROP ###open ports iptables -A INPUT -p tcp --dport 22 --syn -j ACCEPT #ssh# iptables -A INPUT -s 217.10.208.254 -p tcp --dport 80 --syn -j ACCEPT #http# iptables -A INPUT -s 217.10.208.254 -p tcp --dport 443 --syn -j ACCEPT #https# iptables -A INPUT -p tcp --dport 80 --syn -j ACCEPT #http# iptables -A INPUT -p tcp --dport 443 --syn -j ACCEPT #https# iptables -A INPUT -p tcp --dport 20 --syn -j ACCEPT #ftp-data# iptables -A INPUT -p tcp --dport 21 --syn -j ACCEPT #ftp #iptables -A INPUT -p tcp --dport 6667 --syn -j ACCEPT #bitlbee #amule iptables -A INPUT -p tcp --dport 4664 --syn -j ACCEPT iptables -A INPUT -p udp --dport 4667 -j ACCEPT iptables -A INPUT -p udp --dport 4674 -j ACCEPT iptables -A INPUT -p tcp --dport 412 --syn -j ACCEPT #donkey# iptables -A INPUT -p tcp --dport 4665 --syn -j ACCEPT #donkey# iptables -A INPUT -p tcp --dport 4672 --syn -j ACCEPT #donkey# iptables -A INPUT -p tcp --dport 6347 --syn -j ACCEPT #G2# iptables -A INPUT -p tcp --dport 6346 --syn -j ACCEPT #gnutella # and UDP ports# iptables -A INPUT -p udp --dport 4662 -j ACCEPT #donkey# iptables -A INPUT -p udp --dport 6347 -j ACCEPT #G2# iptables -A INPUT -p udp --dport 6346 -j ACCEPT #gnutella #samba # iptables -A INPUT -p tcp --dport 137 --syn -j ACCEPT #netbios-ns # iptables -A INPUT -p udp --dport 137 -j ACCEPT #netbios-ns # iptables -A INPUT -p tcp --dport 138 --syn -j ACCEPT #netbios-dgm # iptables -A INPUT -p udp --dport 138 -j ACCEPT #netbios-dgm # iptables -A INPUT -p tcp --dport 139 --syn -j ACCEPT #netbios-ssn #gtk-gnutella iptables -A INPUT -p tcp --dport 11536 --syn -j ACCEPT iptables -A INPUT -p udp --dport 11536 -j ACCEPT #linphone iptables -A INPUT -p tcp --dport 5060 --syn -j ACCEPT iptables -A INPUT -p tcp --dport 7078 --syn -j ACCEPT #dcgui iptables -A INPUT -p tcp --dport 1025 --syn -j ACCEPT iptables -A INPUT -p tcp --dport 19284 --syn -j ACCEPT #valknut iptables -A INPUT -p tcp --dport 9176 --syn -j ACCEPT iptables -A INPUT -p udp --dport 9176 -j ACCEPT #gnunet #iptables -A INPUT -p tcp --dport 2086 --syn -j ACCEPT #iptables -A INPUT -p udp --dport 2086 -j ACCEPT #ntpd #iptables -A INPUT -p udp --dport 123 -j ACCEPT #gift iptables -A INPUT -p tcp --dport 1214 --syn -j ACCEPT iptables -A INPUT -p udp --dport 1214 -j ACCEPT iptables -A INPUT -p tcp --dport 1360 --syn -j ACCEPT iptables -A INPUT -p udp --dport 1360 -j ACCEPT iptables -A INPUT -p tcp --dport 2496 --syn -j ACCEPT iptables -A INPUT -p udp --dport 2496 -j ACCEPT iptables -A INPUT -p tcp --dport 3579 --syn -j ACCEPT iptables -A INPUT -p udp --dport 3579 -j ACCEPT iptables -A INPUT -p tcp --dport 59049 --syn -j ACCEPT iptables -A INPUT -p udp --dport 59049 -j ACCEPT #BT for P in `seq 6881 6889`; do iptables -A INPUT -p tcp --dport $P --syn -j ACCEPT iptables -A INPUT -p udp --dport $P -j ACCEPT done for P in `seq 9881 9889`; do iptables -A INPUT -p tcp --dport $P --syn -j ACCEPT iptables -A INPUT -p udp --dport $P -j ACCEPT done # ktorrent UDP tracker iptables -A INPUT -p udp --dport 4444 -j ACCEPT #skype iptables -A INPUT -p tcp --dport 2005 --syn -j ACCEPT iptables -A INPUT -p udp --dport 2005 -j ACCEPT #nicotine iptables -A INPUT -p tcp --dport 2234 --syn -j ACCEPT iptables -A INPUT -p tcp --dport 2239 --syn -j ACCEPT #Circle# iptables -A INPUT -p tcp --dport 29610 --syn -j ACCEPT #peercast iptables -A INPUT -p tcp --dport 7144 --syn -j ACCEPT# iptables -A INPUT -p tcp --dport 7145 --syn -j ACCEPT #mark for QOS iptables -t mangle -A INPUT -p tcp --sport 7144 -j MARK --set-mark 1 iptables -t mangle -A INPUT -p tcp --dport 7144 -j MARK --set-mark 1 iptables -t mangle -A OUTPUT -p tcp --sport 7144 -j MARK --set-mark 1 iptables -t mangle -A OUTPUT -p tcp --dport 7144 -j MARK --set-mark 1 #ICMP iptables -A INPUT -p icmp -j ACCEPT #da.le.nu# iptables -A OUTPUT -d 86.105.131.55 -j DROP # opera bittorrent iptables -A INPUT -p tcp --dport 18768 --syn -j ACCEPT iptables -A INPUT -p udp --dport 18768 -j ACCEPT # uTorrent iptables -A INPUT -p tcp --dport 22132 --syn -j ACCEPT iptables -A INPUT -p udp --dport 22132 -j ACCEPT iptables -A INPUT -p udp --dport 8888 -j ACCEPT # eMule iptables -A INPUT -p tcp --dport 17748 --syn -j ACCEPT iptables -A INPUT -p udp --dport 50144 -j ACCEPT #MTU #iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu # # NAT # iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT # iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT # iptables -A INPUT -i eth1 -j ACCEPT # iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE # iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu # # port forwarding # iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 60000:65000 -j DNAT --to $EXTIP # iptables -t nat -A PREROUTING -i eth0 -p udp --dport 60000:65000 -j DNAT --to $EXTIP # iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 60000:65000 -j ACCEPT # iptables -A FORWARD -i eth0 -o eth1 -p udp --dport 60000:65000 -j ACCEPT #the end iptables -A INPUT -p udp -j DROP iptables -A INPUT -p tcp --syn -j DROP }## Function that stops the daemon/service.#d_stop(){ iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD iptables -F -t nat}case "$1" in start) echo -n "Setting up firewall: iptables" d_start echo "." ;; stop) echo -n "Stopping firewall: $DESC" d_stop echo "." ;; restart|force-reload) # # If the "reload" option is implemented, move the "force-reload" # option to the "reload" entry above. If not, "force-reload" is # just the same as "restart". # echo -n "Restarting firewall: $DESC" d_stop sleep 1 d_start echo "." ;; *) # echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2 echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload}" >&2 exit 1 ;;esacexit 0