#!/bin/sh

# Variables

IPTABLES=/usr/sbin/iptables

WAN_IFACE="ath0 eth0"

if [ "$1" = "start" ]; then
echo "Starting Firewall"

# Flush Current Rules
$IPTABLES -F
$IPTABLES -X      # delete all user-defined chains

echo 1 > /proc/sys/net/ipv4/tcp_syncookies # DoS Protection
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Disable responding to ping broadcasts
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter # disable spoofing on all interfaces


# Set Default Rules for Chains

$IPTABLES -P INPUT DROP  # Drop every packet from the outside
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT  # Allow requested INPUTS

# Accept local requests
$IPTABLES -P OUTPUT ACCEPT

# Drop since NAT protocol is not required 
$IPTABLES -P FORWARD DROP

# Section to open desired ports

# Open Ports for SSH and HTTP
#$IPTABLES -A INPUT -i $WAN_IFACE -p TCP --destination-port 22 -j ACCEPT

#$IPTABLES -A INPUT -i $WAN_IFACE -p TCP --destination-port 80 -j ACCEPT

elif [ "$1" = "stop" ]; then
	echo "Firewall Halted"
	$IPTABLES -F 
	$IPTABLES -X
	$IPTABLES -P INPUT ACCEPT
	$IPTABLES -P FORWARD ACCEPT

elif [ "$1" = "status" ]; then
	$IPTABLES -L -v

else
	echo "usage: $0 start|stop|status"
fi