Anonymous

# Clean old iptables 
iptables -F 
iptables -X 
iptables -Z

# Default forward policy to DROP


iptables -P OUTPUT  ACCEPT
iptables -P INPUT   DROP
iptables -P FORWARD DROP


# Loopback - Allow unlimited traffic
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Fragments : Don't trust the little buggers. Send 'em to hell.
iptables -A INPUT -f -j LOG --log-level debug --log-prefix "IPTABLES FRAGMENTS: "

# Refuse spoofed packets claiming to be the loopback
#iptables -A INPUT -d 127.0.0.0/8 -j DROP

# Allow BootP/DHCP UDP requests
iptables -A INPUT -p udp -d 0/0 --dport 67:68 -j ACCEPT
# DNS Allow UDP packets in for DNS client from nameservers
iptables -A INPUT -p udp -s 0/0 --sport 53 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp -d 0/0 --dport 53 -j ACCEPT

#### TCP, log & drop
###iptables -A INPUT -i eth0 -p tcp -j LOG --log-level debug --log-prefix "IPTABLES TCP-IN: "
###iptables -A INPUT -i eth0 -p tcp -j DROP

# SSH 
# allow all sshd incoming connections (including the port fw)
iptables -A INPUT -p tcp -d 0/0 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -d 0/0 --dport 2222 -j ACCEPT
# FTP
# allow all ftpd incoming connections
iptables -A INPUT -p tcp -d 0/0 --dport 21 -j ACCEPT
# Enable active ftp transfers 
iptables -A INPUT -p tcp -s 0/0 --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Enable passive ftp transfers
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Enable ident probes (IRC)
iptables -t filter -A INPUT -p tcp -d 0/0 --dport 113 -j ACCEPT

# Allow ICMP in if it is related to other connections
iptables -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT

# LOGGING:

#### UDP, log & drop
###iptables -A INPUT -i eth0 -p udp -j LOG --log-level debug --log-prefix "IPTABLES UDP-IN: "
###iptables -A INPUT -i eth0 -p udp -j DROP

#### ICMP, log & drop
###iptables -A INPUT -i eth0 -p icmp -j LOG --log-level debug --log-prefix "IPTABLES ICMP-IN: "
###iptables -A INPUT -i eth0 -p icmp -j DROP

# Windows NetBIOS noise, log & drop
iptables -A INPUT -i eth0 -p tcp -s 0/0 --sport 137:139 -j LOG --log-level debug --log-prefix "IPTABLES NETBIOS-IN: "
iptables -A INPUT -i eth0 -p tcp -s 0/0 --sport 137:139 -j DROP

#### VLC
iptables -A INPUT -p igmp -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 1234 -m state --state NEW -j ACCEPT
iptables -A INPUT -d 224.2.127.254/32 -p udp -m udp --dport 9875 -j ACCEPT

# HTTP
# allow all http/https incoming/return connections
iptables -A INPUT -p tcp -s 0/0 --sport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -s 0/0 --sport 443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -d 0/0 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -d 0/0 --dport 443 -j ACCEPT

#Allow outgoing
iptables -A OUTPUT -p tcp -s 0/0 --sport 1024:65535 --dport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Anything else not allowed, log & drop
iptables -A INPUT -j LOG --log-level debug --log-prefix "IPTABLES UNKNOWN-IN: "
###iptables -A INPUT -i eth0 -j DROP
  echo "Firewall rules applied!"
  trap - 2 3