#!/bin/sh
#
# this allows all output and any input that is related to the output that you generate
#
# prevent SYN floods from consuming memory resources
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
# no ICMP
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all
# no spoofing
if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]
then
for filtre in /proc/sys/net/ipv4/conf/*/rp_filter
do
echo 1 > $filtre
done
fi
# handle FTP statefully
modprobe ip_conntrack_ftp
# policy for default chains
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
# remove all rules from default chains
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
# remove all custom chains
iptables -X
# allow traffic for sessions which are already established
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# open the loopback address for all traffic
iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT