#!/usr/bin/ferm
# chango ruleset
table filter {
	chain INPUT {
		policy DROP;
#		interface lo ACCEPT;
		mod state state INVALID ULOG ulog-prefix "INVALID:";
		mod state state INVALID DROP;
		mod state state (ESTABLISHED RELATED) ACCEPT;
		fragment ULOG ulog-prefix "FRAGMENT:";
		fragment DROP;
# echo-reply=0, destination-unreachable=3, time-exceeded=11, 
# source-quench=4, parameter-problem=12
#	proto icmp {
#			icmp-type (0 3 4 11 12) ACCEPT;
#			ULOG ulog-prefix "BAD_ICMP:";
#		}
		goto PUB_IN;
		daddr 127.0.0.1 ACCEPT;
	}
	chain OUTPUT {
		policy ACCEPT;
		saddr 127.0.0.1 ACCEPT;
#		proto tcp sport (0:112 114:1023 6000:6063) {
#			ULOG ulog-prefix "SHIT:";
#			DROP;
#		}
#		proto udp sport (0:112 114:1023 6000:6063) {
#			ULOG ulog-prefix "SHIT:";
#			DROP;
#		}
		goto PUB_OUT;
		ACCEPT;
	}
	chain FORWARD {
		policy DROP;
	}
	chain PUB_IN {
		proto tcp dport (
#			50555 # azureus
#			44744 # azushu
#			50556:50560 # rtorrent
			50557 #utorrent
			44662 # amule
			42234:42244 # nicotine
			1024:1044 # im
#			39999:40000 # ftp
#			8000:8001 # cast
			auth
		) ACCEPT;
		proto udp dport (
			50557 # utorrent dht
			44665 # amule
			44672 # amule
		) ACCEPT;
	}
	chain PUB_OUT {
		protocol all ACCEPT;
	}
}