#    SMB / Windows filesharing, don't let it outside this LAN
iptables -A FORWARD -p tcp --sport 137 -j DROP
iptables -A FORWARD -p udp --sport 137 -j DROP
iptables -A FORWARD -p tcp --sport 138 -j DROP
iptables -A FORWARD -p udp --sport 138 -j DROP
iptables -A FORWARD -p tcp --sport 139 -j DROP
iptables -A FORWARD -p udp --sport 139 -j DROP


# IN the filter table (the default)  Append a rule to the INPUT chain that says
# accept incoming packets which are part of an already established connection
 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# IN the filter table (the default)  Append a rule to the INPUT chain that says
# accept incoming packets that are starting new connections from any interface EXCEPT eth0.
 iptables -A INPUT -m state --state NEW -i ! eth0 -j ACCEPT