# netfilter by donofrio@umich.edu of LSAIT
# 1AUG2006@0620
#
# cp file to /etc/sysconfig/iptables then do the iptables-restore
# 'iptables-restore -c lsait-iptables' to reset index counters
# backup running tables with the 'iptables-save > running-iptables'
#
*filter

#The following are just index counters.
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:BAD_FLAGS - [0:0]
:ICMP_IN - [0:0]
:LO_IN - [0:0]

# assign loopback input name
-A INPUT -j LO_IN

# assign bad-flags
-A INPUT -p tcp -j BAD_FLAGS 

# any interface allow anything if *we* initialized it
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# open up ssh port for interface eth0 
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT  

# the above is all afs related (callbacks and the like)
-A INPUT -p udp -m multiport --sports 7000,7001,7002,7003,7004,7005,7006,7007,7008,7009 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 

# assign incoming icmp to a rule set name
-A INPUT -p icmp -j ICMP_IN 

#tcpip packet header flags (all needed)
-A BAD_FLAGS -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP 
-A BAD_FLAGS -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A BAD_FLAGS -p tcp -m tcp --tcp-flags FIN,SYN,PSH FIN,SYN,PSH -j DROP 
-A BAD_FLAGS -p tcp -m tcp --tcp-flags FIN,SYN,RST FIN,SYN,RST -j DROP 
-A BAD_FLAGS -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH FIN,SYN,RST,PSH -j DROP 
-A BAD_FLAGS -p tcp -m tcp --tcp-flags FIN FIN -j DROP 
-A BAD_FLAGS -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP 
-A BAD_FLAGS -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP 
-A BAD_FLAGS -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP 

#return responses from port queries on interface eth0
-A ICMP_IN -i eth0 -p icmp -m icmp --icmp-type 0 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A ICMP_IN -i eth0 -p icmp -m icmp --icmp-type 3 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A ICMP_IN -i eth0 -s 141.211.0.0/255.255.0.0 -p icmp -m icmp --icmp-type 8 -m state --state NEW -j ACCEPT 
-A ICMP_IN -i eth0 -p icmp -m icmp --icmp-type 11 -m state --state RELATED,ESTABLISHED -j ACCEPT 

# allow all loop-back sessions
-A LO_IN -i lo -j ACCEPT 

COMMIT