#!/bin/bash

                                                                       
echo "Firewalling..."

iptables -F                                                # Clear the tables
iptables -F -t nat                                         # Clear the tables
iptables -X                                                # Clear the tables
iptables -P INPUT DROP                                     # Default policies
iptables -P OUTPUT ACCEPT                                  # Default policies
iptables -P FORWARD DROP                                   # Default policies
iptables -A INPUT -p icmp         --icmp-type 0 -j ACCEPT  # Accept ping replies
iptables -A INPUT -p icmp -i tap+ --icmp-type 8 -j ACCEPT  # Accept ping requests on AnoNet
iptables -A INPUT -p icmp         --icmp-type 3 -j ACCEPT  # Accept Dest-Unreachable (Traceroute)
iptables -A INPUT -p icmp         --icmp-type 11 -j ACCEPT # Accept Time-Exceeded (Sometimes traceroute)
iptables -A INPUT -i lo -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT  # Accept all loopback stuff
iptables -A INPUT -i +  -m state --state ESTABLISHED,RELATED -j ACCEPT      # Accept reply packets
##################################
                                                              
################## This section is for NATing boxes on your home lan. Feel free                                                                               
# ANONET GATEWAY #  to remove it.                                                                               
##################                                                                                
#iptables -A FORWARD -i eth0 -s <IP-TO-PERMIT-NAT--EX:192.168.0.9> -j ACCEPT
#iptables -t nat -A POSTROUTING -s <IP-TO-PERMIT-NAT--EX:192.168.0.9> -j MASQUERADE
#iptables -A FORWARD -i tap+ -s 1.0.0.0/8 -d 1.0.0.0/8 -j ACCEPT
#iptables -A FORWARD -i tap+ -d 10.0.0.0/8 -j ACCEPT
#iptables -A FORWARD -i tap+ -d 192.168.0.0/24 -m state --state NEW,INVALID         -j DROP
#iptables -A FORWARD -i tap+ -d 192.168.0.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT

#################                                                                                 
# ANONET SERVER #                                                                                 
#################                                                                                 
iptables -A INPUT -i ppp-e.r.srn-0 --protocol tcp --dport 179 -d 1.9.8.4 -j ACCEPT       # Opens port 80 on Ano
iptables -A INPUT -i ppp-e.r.srn-0 --protocol tcp --dport 53 -d 1.9.8.4 -j ACCEPT
iptables -A INPUT -i ppp-e.r.srn-0 --protocol udp --dport 53 -d 1.9.8.4 -j ACCEPT
iptables -A INPUT -i ppp-e.r.srn-0 --protocol tcp --dport 80 -d 1.9.8.4 -j ACCEPT
iptables -A INPUT -i ppp-e.r.srn-0 --protocol udp --dport 2998 -d 1.9.8.4 -j ACCEPT
iptables -t nat -A POSTROUTING ! -s 1.0.0.0/8 -d 1.0.0.0/8 -j SNAT --to-source 1.9.8.4
#iptables -A INPUT -i tap+ -d 224.0.0.5 -j ACCEPT            # You need this for OSPF to work
#iptables -A INPUT -i tap+ -d 224.0.0.6 -j ACCEPT            # You need this for OSPF to work

##################################                                                              
iptables -A INPUT -i + -m state --state NEW -j DROP
iptables -A INPUT -i + -m state --state INVALID -j DROP
echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all          # Ignore Pings
echo "1" > /proc/sys/net/ipv4/ip_forward                    # Forward Traffic
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts   # Ignore broadcast pings (good)
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route  # You may want to turn this on if you're a router
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
echo "0" > /proc/sys/net/ipv4/conf/all/secure_redirects
echo "0" > /proc/sys/net/ipv4/conf/all/rp_filter            # if you are a router; not to be used
                                                            # in general (has security implications).      
                                                            # See rfc1812, 5.3.8
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
echo "1" > /proc/sys/net/ipv4/tcp_syncookies                # Nice new anti-DoS feature
echo "Firewalled"