#!/bin/sh
#IPFW script by w00dy

ipfwcmd="/sbin/ipfw"
flags="-q"

#int
oif="rl0"

logall="log"  

### Flush the rules
	$ipfwcmd $flags -f flush

### Allow loopback and deny loopback spoofs
	$ipfwcmd $flags add 00100 allow all from any to any via lo0
	$ipfwcmd $flags add 00110 deny $logall ip from any to 127.0.0.0/8 via $oif
	$ipfwcmd $flags add 00120 deny $logall ip from 127.0.0.0/8 to any via $oif

### Stop PNAs from connecting 
        $ipfwcmd $flags add 00130 deny $logall ip from 192.168.0.0/16 to any via $oif
        $ipfwcmd $flags add 00140 deny $logall ip from 172.16.0.0/12 to any via $oif
        $ipfwcmd $flags add 00150 deny $logall ip from 10.0.0.0/8 to any via $oif
        $ipfwcmd $flags add 00160 deny $logall ip from any to 192.168.0.0/16 via $oif
        $ipfwcmd $flags add 00170 deny $logall ip from any to 172.16.0.0/12 via $oif
        $ipfwcmd $flags add 00180 deny $logall ip from any to 10.0.0.0/8 via $oif

### Deny XMAS tree, Null scan, SYN Flood, Stealth FIN, and forced packer routing

        $ipfwcmd $flags add 00200 deny log tcp from any to any in tcpflags fin,psh,urg recv $oif
        $ipfwcmd $flags add 00210 deny log tcp from any to any in tcpflags !fin,!syn,!rst,!psh,!ack,!urg recv $oif
        $ipfwcmd $flags add 00220 deny log tcp from any to any in tcpflags syn,fin recv $oif
        $ipfwcmd $flags add 00230 deny log tcp from any to any in tcpflags fin,rst recv $oif
        $ipfwcmd $flags add 00240 deny log ip from any to any in ipoptions ssrr,lsrr,rr,ts recv $oif



### Deny late, redirect, and spoofing attacks
	$ipfwcmd $flags add 00250 deny $logall all from any to any frag
        $ipfwcmd $flags add 00270 deny $logall icmp from any to any icmptype 5
        $ipfwcmd $flags add 00280 deny $logall ip from me to me in via $oif

### Deny in pop & smtp
        $ipfwcmd $flags add 00290 deny ip from any to any 25 in via $oif
        $ipfwcmd $flags add 00295 deny ip from any to any 110 in via $oif

## Reject & Don't log IRC Proxy Scanner's ##
        $ipfwcmd $flags add 00300 deny tcp from any to any 3128 in via $oif
        $ipfwcmd $flags add 00310 deny tcp from any to any 80 in via $oif
        $ipfwcmd $flags add 00320 deny tcp from any to any 1080 in via $oif
        $ipfwcmd $flags add 00330 deny tcp from any to any 23 in via $oif

## Get rid of Microsoft bullshit
        $ipfwcmd $flags add 00400 deny all from any to any 137 in via $oif
        $ipfwcmd $flags add 00405 deny all from any to any 138 in via $oif
        $ipfwcmd $flags add 00410 deny all from any to any 139 in via $oif
        $ipfwcmd $flags add 00415 deny all from any to any 81 in via $oif
        $ipfwcmd $flags add 00419 deny all from any to any 1025 in via $oif
        $ipfwcmd $flags add 00420 deny all from any to any 1026 in via $oif
        $ipfwcmd $flags add 00425 deny all from any to any 1027 in via $oif
        $ipfwcmd $flags add 00430 deny all from any to any 1028 in via $oif
        $ipfwcmd $flags add 00431 deny all from any to any 1029 in via $oif
        $ipfwcmd $flags add 00432 deny all from any to any 1030 in via $oif
        $ipfwcmd $flags add 00435 deny all from any to any 445 in via $oif
        $ipfwcmd $flags add 00445 deny all from any to any 135 in via $oif
        $ipfwcmd $flags add 00450 deny all from any to any 1434 in via $oif
        $ipfwcmd $flags add 00455 deny all from any to any 1433 in via $oif
        $ipfwcmd $flags add 00460 deny tcp from any to any 443 in via $oif


###### inbound section #######

### check the traffic's state
        $ipfwcmd $flags add 00500 check-state
        $ipfwcmd $flags add 00501 allow tcp from any to any established

### Allow in standard http
#	$ipfwcmd $flags add 00510 allow tcp from any to any 80 in via $oif setup keep-state

### Allow in secure https
#	$ipfwcmd $flags add 00515 allow tcp from any to any 443 in via $oif setup keep-state

### Allow in Webmin 
        $ipfwcmd $flags add 00670 allow tcp from any to me 9000 in via $oif setup keep-state
        $ipfwcmd $flags add 00690 allow udp from any to me 9000 in via $oif keep-state
### Allow in dns 
	$ipfwcmd $flags add 00520 allow udp from 66.118.128.20 53 to me in via $oif keep-state
        $ipfwcmd $flags add 00525 allow udp from 66.118.128.21 53 to me in via $oif keep-state
     
### Deny in pop & smtp 
#	$ipfwcmd $flags add 00560 deny tcp from any to me 25 in via $oif setup keep-state
#	$ipfwcmd $flags add 00570 deny tcp from any to me 110 in via $oif setup keep-state

### Allow in imap
#	$ipfwcmd $flags add 00580 allow tcp from any to me 143 in via $oif setup keep-state

### Allow in ftp
	$ipfwcmd $flags add 00590 allow tcp from any to me 21 in via $oif setup keep-state
        $ipfwcmd $flags add 00600 allow tcp from any to me 40000-65535 in via $oif setup keep-state

### Allow in ssh 
	$ipfwcmd $flags add 00620 allow tcp from any to me 22 in via $oif setup keep-state  

### Allow in snmp
#	$ipfwcmd $flags add 00630 allow udp from any to me 161 in via $oif keep-state

### Allow in irc
	$ipfwcmd $flags add 00650 allow tcp from any to me 3000-9999 in via $oif setup keep-state
        $ipfwcmd $flags add 00660 allow udp from any to me 49152-65535 in via $oif keep-state

### Allow in GameServer's
#        $ipfwcmd $flags add 00661 allow tcp from any to me 20000-30000 in via $oif setup keep-state

###  Allow in ping
        $ipfwcmd $flags add 00665 allow icmp from any to me icmptype 0,8 in via $oif

### Allow in traceroute
        $ipfwcmd $flags add 00670 allow icmp from any to me icmptype 3,11 in via $oif limit src-addr 4

### Allow in ident
        $ipfwcmd $flags add 00675 allow tcp from any to me 113 in via $oif setup keep-state

### ACK scan (ACK,RST)
        $ipfwcmd $flags add 00680 deny log tcp from any to any in tcpflags ack,rst recv $oif


#################### Deny & Log all incoming that fall through to here  #########################

	$ipfwcmd $flags add 01000 deny $logall logamount 500 all from any to any in via $oif

#################################################################################################



###### outbound section ######


### Allow out standard http
#	$ipfwcmd $flags add 02000 allow tcp from any to any 80 out via $oif setup keep-state

### Allow out secure https
#	$ipfwcmd $flags add 02010 allow tcp from any to any 443 out via $oif setup keep-state

### Allow out Webmin
        $ipfwcmd $flags add 02020 allow tcp from any 9000 to any out via $oif setup keep-state
        $ipfwcmd $flags add 02030 allow udp from any 9000 to any out via $oif keep-state

### Allow out dns
	$ipfwcmd $flags add 02040 allow tcp from any to any 53 out via $oif setup keep-state
	$ipfwcmd $flags add 02050 allow udp from any to any 53 out via $oif keep-state
	$ipfwcmd $flags add 02060 allow tcp from any to any 953 out via $oif setup keep-state
	$ipfwcmd $flags add 02070 allow udp from any to any 953 out via $oif keep-state

### Allow out pop & smtp
	$ipfwcmd $flags add 02080 allow tcp from any to any 25 out via $oif setup keep-state
	$ipfwcmd $flags add 02090 allow tcp from any to any 110 out via $oif setup keep-state

### Allow out imap
	$ipfwcmd $flags add 02100 allow tcp from any to any 143 out via $oif setup keep-state

### Give root all
        $ipfwcmd $flags add 02110 allow tcp from me to any out via $oif setup keep-state uid root
        $ipfwcmd $flags add 02120 allow udp from me to any out via $oif keep-state uid root

### Allow out ftp with passive ports
	$ipfwcmd $flags add 02130 allow tcp from me to any 21 out via $oif setup keep-state
#	$ipfwcmd $flags add 02140 allow tcp from any 20 to any 49152-65535 setup keep-state

### Allow out ssh
        $ipfwcmd $flags add 02150 allow tcp from me 22 to any out via $oif setup keep-state

### Allow out snmp
	$ipfwcmd $flags add 02160 allow udp from any to any 161 out via $oif keep-state

### Allow out ident
	$ipfwcmd $flags add 02170 allow tcp from any 113 to any out via $oif setup keep-state

### Allow out whois
	$ipfwcmd $flags add 02190 allow tcp from any to any 43 out via $oif setup keep-state

### Allow out ping
        $ipfwcmd $flags add 02200 allow icmp from any to any out via $oif

### Allow out finger
	$ipfwcmd $flags add 02210 allow tcp from any to any 79 out via $oif setup keep-state
	$ipfwcmd $flags add 02220 allow udp from any to any 79 out via $oif keep-state

### Allow out traceroute
        $ipfwcmd $flags add 02230 allow udp from me to any 33435-33500 out via $oif keep-state

### Allow out ircd
	$ipfwcmd $flags add 02240 allow tcp from any to any 3000-9999 out via $oif setup keep-state
        $ipfwcmd $flags add 02250 allow tcp from any 49152-65535 to any out via $oif setup keep-state



###### Everything Else #####

### deny and log everything else that is trying to get out.
	$ipfwcmd $flags add 03000 deny $logall logamount 500 all from any to any out via $oif




############## deny and log all packets that fell through to see what they are ####################
        
	$ipfwcmd $flags add 04000 deny $logall logamount 500 all from any to any