#!/bin/sh
IPTABLES="/sbin/iptables"
#Clear out any existing firewall rules, and any chains that might have
#been created
$IPTABLES -F
$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -F -t mangle
$IPTABLES -F -t nat
$IPTABLES -X
#Setup our policies
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP
#setup stateful inspection of forwarded traffic
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#this, or instead of -s...., substitute "-i eth0", assuming of course
#that your internal i/f is eth0
#this assumes you're using 10.0.0.0/24 as your internal net.
$IPTABLES -A FORWARD -p all -m state --state NEW -s 10.0.0.0/24 -j ACCEPT
#always allow loopback traffic
$IPTABLES -A INPUT -i lo -j ACCEPT
#permit your local LAN to talk to the firewall
#this assumes that eth0 is your internal i/f
$IPTABLES -A INPUT -i eth0 -j ACCEPT
#setup bad tcp flags chain
$IPTABLES -N badflags
$IPTABLES -A badflags -m limit --limit 15/minute -j LOG --log-prefix Badflags:
$IPTABLES -A badflags -j DROP
#setup firewall drop chain
$IPTABLES -N firewall
$IPTABLES -A firewall -m limit --limit 15/minute -j LOG --log-prefix Firewall:
$IPTABLES -A firewall -j DROP
#a silent drop chain
$IPTABLES -N silent
$IPTABLES -A silent -j DROP
#bad flag combinations
$IPTABLES -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j badflags
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j badflags
$IPTABLES -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j badflags
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j badflags
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j badflags
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j badflags
#assumes 192.168.1.0/24 is your internal network. If not you could change
#allow certain types of ICMP, drop all else
$IPTABLES -A INPUT -p icmp --icmp-type 0 -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type 3 -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type 11 -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT
$IPTABLES -A INPUT -p icmp -j firewall
#need to ssh to your firewall from the outside?
$IPTABLES -A INPUT -p tcp -m state --state NEW -s 0/0 --dport 22 -j ACCEPT
#do some stateful inspecting so that we don't have to do silly
#things like open up all high ports, like ipchains would have us do.
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#setup masq & policy for outbound traffic (assumes eth1 is outside i/f)
$IPTABLES -t nat -A POSTROUTING -o eth1 -j MASQUERADE
#netbios never shuts up. let's silence it.
$IPTABLES -A INPUT -p udp --sport 137 --dport 137 -j silent
#"Cleanup" rule - drop what was not permitted.
$IPTABLES -A INPUT -j firewall
$IPTABLES -A FORWARD -j firewall