#!/bin/sh
# rules for johns base

# iptables path
iptables="/sbin/iptables"

# ethernet card variables
lo="127.0.0.1"
eth0="192.168.1.100"
# remote machines 
winbox="192.168.1.101

case "$1" in

start)

# basic rules to get started
$iptables -P INPUT DROP
$iptables -F INPUT
$iptables -P OUTPUT ACCEPT
$iptables -F OUTPUT
$iptables -P FORWARD ACCEPT
$iptables -F FORWARD

$iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT

# eth0 - 192.168.1.100
# sshd - allow winbox to connect, block everyone else
$iptables -A INPUT -p tcp -s $winbox -d $eth0 --dport 87 -m state --state NEW -j ACCEPT
$iptables -A INPUT -p tcp -s 0/0 -d $eth0 --dport 87 -j DROP

# ftp - allow linux boxen to connect to debian archives
$iptables -A OUTPUT -p tcp -s $eth0 -d ftp.us.debian.org --dport 20:21 -j ACCEPT
$iptables -A OUTPUT -p tcp -s $eth0 -d non-us.debian.org --dport 20:21 -j ACCEPT
$iptables -A OUTPUT -p tcp -s $eth0 -d security.debian.org --dport 20:21 -j ACCEPT
$iptables -A OUTPUT -p tcp -s $eth0 -d ftp.kernel.org --dport 20:21 -j ACCEPT
# ftp - anywhere 
$iptables -A OUTPUT -p tcp -s $eth0 -d 0/0 --dport 20:21 -j ACCEPT

# udp ports (accepted) - dig/whois
$iptables -A INPUT -p udp --dport 53 -m state --state NEW -j ACCEPT

# Logging and Dropping everything else (fuck em)
$iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j LOG --log-prefix "icmpecho"
$iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j LOG --log-prefix "portscan"
$iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j DROP
$iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j DROP


;;    

stop)
# flush all rules and stop
echo " Stopping firewall "
$iptables -F
$iptables -P INPUT ACCEPT
echo " Stopped firewall all rules are flushed "
echo ""
    ;;

block)
# block all traffic - dammit they are attacking!!
echo "DROPPING ALL PACKETS"
echo ""
$iptables -F
$iptables -P INPUT DROP
$iptables -A INPUT -s 0/0 -d 0/0 -j DROP

    ;;


*)
    # write help
    echo "Usage firewall start|stop|block" >&2
    exit 1

    ;;

esac

# show current ruleset
$iptables -nL