#!/bin/bash

IPTABLES="/sbin/iptables"

INPUT="$IPTABLES --table filter --append INPUT"
FORWARD="$IPTABLES --table filter --append FORWARD"

LAN_INT="lan"
INTERNET_INT="internet"

INPUT_INT="$INPUT --in-interface $INTERNET_INT"

LAN_ADDR="192.168.0.0/24"

#allow loopback
$INPUT_INT --protocol all --source 127.0.0.1 --jump ACCEPT

#allow local traffic
$INPUT_INT --protocol all --source $LAN_ADDR --jump ACCEPT

#enable NAT#
$IPTABLES --table nat --out-interface internet --append POSTROUTING --jump MASQUERADE
$FORWARD --out-interface $INTERNET_INT -m state --state NEW,ESTABLISHED,RELATED --jump ACCEPT
$FORWARD --in-interface $INTERNET_INT -m state --state ESTABLISHED,RELATED --jump ACCEPT

##################
# Incoming Stuff #
##################

#allow icmp echo/ping
$INPUT_INT --protocol icmp --icmp-type echo-request --jump ACCEPT
$INPUT_INT --protocol icmp --icmp-type echo-reply --jump ACCEPT

#allow http
$INPUT_INT --protocol tcp --dport 80 --jump ACCEPT
#allow ident
$INPUT_INT --protocol tcp --dport 113 --jump ACCEPT
#incoming mail
$INPUT_INT --protocol tcp --dport 25 --jump ACCEPT

#allow ssh & provide protection #
#$INPUT_INT --protocol tcp --dport 22 -m state --state NEW --match recent --update --seconds 60 --hitcount 8 --rttl --name SSH --jump DROP
$INPUT_INT --protocol tcp --dport 22 --jump ACCEPT

#drop nfs
$INPUT_INT --protocol tcp --dport 111 --jump DROP
$INPUT_INT --protocol udp --dport 111 --jump DROP
$INPUT_INT --protocol tcp --dport 2049 --jump DROP
$INPUT_INT --protocol udp --dport 2049 --jump DROP

#probably safe to allow anything outside the first 1024 ports
$INPUT_INT --protocol tcp --dport 1025:65535 --jump ACCEPT
$INPUT_INT --protocol udp --dport 1025:65535 --jump ACCEPT

#drop anything else
$INPUT_INT --jump DROP