indio

#!/bin/bash## Simple firewall disallowing all incomming connections# but allowing all traffic on localhost (lo device) and all outgoing## usage: rc.firewall start|stop|status## Author: Tomas M. <http://slax.linux-live.org/>#export LAN=eth0export WAN=eth1SYSCTLW="/sbin/sysctl -q -w"IPTABLES="/usr/sbin/iptables"if [ "$1" = "start" ]; then   # Disable routing triangulation. Respond to queries out   # the same interface, not another. Helps to maintain state   # Also protects against IP spoofing   $SYSCTLW net.ipv4.conf.all.rp_filter=1   # Enable logging of packets with malformed IP addresses,   # Disable redirects,   # Disable source routed packets,   # Disable acceptance of ICMP redirects,   # Turn on protection from Denial of Service (DOS) attacks,   # Disable responding to ping broadcasts,   # Enable IP routing. Required if your firewall is protecting a network, NAT included#   $SYSCTLW net.ipv4.conf.all.log_martians=1   $SYSCTLW net.ipv4.conf.all.send_redirects=0   $SYSCTLW net.ipv4.conf.all.accept_source_route=0   $SYSCTLW net.ipv4.conf.all.accept_redirects=0   $SYSCTLW net.ipv4.tcp_syncookies=1   $SYSCTLW net.ipv4.icmp_echo_ignore_broadcasts=1   $SYSCTLW net.ipv4.ip_forward=1   # Firewall initialization, remove everything, start with clean tables   # Flush current rules   $IPTABLES -F      # remove all rules   $IPTABLES -t nat -F   $IPTABLES -X      # delete all user-defined chains   #Setup default policies to handle unmatched traffic   $IPTABLES -P OUTPUT ACCEPT   $IPTABLES -P INPUT ACCEPT   $IPTABLES -P FORWARD DROP   # Lock our services so they only work from the LAN   $IPTABLES -I INPUT -i ${LAN} -j ACCEPT   $IPTABLES -I INPUT -i lo -j ACCEPT   $IPTABLES -A INPUT -p UDP --dport bootps -i ! ${LAN} -j REJECT   $IPTABLES -A INPUT -p UDP --dport domain -i ! ${LAN} -j REJECT   # (Optional) Allow access to our ssh server from the WAN   $IPTABLES -A INPUT -p TCP --dport ssh -i ${WAN} -j ACCEPT   # Drop TCP / UDP packets to privileged ports   $IPTABLES -A INPUT -p TCP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP   $IPTABLES -A INPUT -p UDP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP   # Rules for NAT   $IPTABLES -I FORWARD -i ${LAN} -d 192.168.0.0/255.255.0.0 -j DROP   $IPTABLES -A FORWARD -i ${LAN} -s 192.168.0.0/255.255.0.0 -j ACCEPT   $IPTABLES -A FORWARD -i ${WAN} -d 192.168.0.0/255.255.0.0 -j ACCEPT   $IPTABLES -t nat -A POSTROUTING -o ${WAN} -j MASQUERADEelif [ "$1" = "stop" ]; then   # Flush current rules   $IPTABLES -F   $IPTABLES -t nat -F   $IPTABLES -X # delete all user-defined chains   #Setup default policies to handle unmatched traffic   $IPTABLES -P OUTPUT ACCEPT   $IPTABLES -P INPUT ACCEPT   $IPTABLES -P FORWARD ACCEPTelif [ "$1" = "status" ]; then   $IPTABLES -L -velse   echo "usage: $0 start|stop|status"fi