!/bin/bash

# No spoofing
if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]
then
for filtre in /proc/sys/net/ipv4/conf/*/rp_filter
do
echo 1 > $filtre
done
fi 

# No icmp
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

#load some modules you may need
modprobe ip_tables
modprobe ip_nat_ftp 
modprobe ip_nat_irc
modprobe iptable_filter
modprobe iptable_nat

# iptables module added for passive ftp access to ftpd on local system
modprobe ip_conntrack 
modprobe ip_conntrack_ftp port=21

# Remove all rules and chains
iptables -F
iptables -X

# first set the default behaviour => accept connections
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

# Create 2 chains, it allows to write a clean script
iptables -N FIREWALL
iptables -N TRUSTED

# Allow Kde
#iptables -A OUTPUT -o lo -j ACCEPT
#iptables -A INPUT -i lo -j ACCEPT


# Allow ESTABLISHED and RELATED incoming connection
iptables -A FIREWALL -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Send all package to the TRUSTED chain
iptables -A FIREWALL -j TRUSTED
# DROP all other packets
iptables -A FIREWALL -j DROP

# Send all INPUT packets to the FIREWALL chain
iptables -A INPUT -j FIREWALL
# DROP all forward packets, we don't share internet connection in this example
iptables -A FORWARD -j DROP

# Allow dns
iptables -A TRUSTED -o eth0 --protocol udp -m udp --destination-port 53 -j ACCEPT
iptables -A TRUSTED -o eth0 --protocol tcp -m tcp --destination-port 53 -j ACCEPT

# Allow http
iptables -A TRUSTED -o eth0 --protocol tcp -m tcp --destination-port 80 -j ACCEPT
iptables -A TRUSTED -o eth0 --protocol udp -m udp --destination-port 80 -j ACCEPT

# Allow ftp 
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 20 -j ACCEPT


# Allow https
iptables -A TRUSTED -i eth0 -p udp -m udp --sport 443 -j ACCEPT
iptables -A TRUSTED -i eth0 -p tcp -m tcp --sport 443 -j ACCEPT

# Allow pop3
iptables -A TRUSTED -o eth0 --protocol tcp -m tcp --dport 110 -j ACCEPT

# Allow imap2
#iptables -A TRUSTED -o eth0 --protocol udp -m udp --destination-port 143 -j ACCEPT
#iptables -A TRUSTED -o eth0 --protocol tcp -m tcp --destination-port 143 -j ACCEPT

# Allow imap3
#iptables -A TRUSTED -o eth0 --protocol udp -m udp --destination-port 220 -j ACCEPT
#iptables -A TRUSTED -o eth0 --protocol tcp -m tcp --destination-port 220 -j ACCEPT

# Allow smtp
iptables -A TRUSTED -o eth0 --protocol tcp -m tcp --dport 587 -j ACCEPT

# Allow MSN
iptables -A TRUSTED -i eth0 -p tcp --sport 1863 -j ACCEPT 
iptables -A TRUSTED -i eth0 -p tcp --sport 6890:6900 -j ACCEPT 
iptables -A TRUSTED -i eth0 -p udp --sport 6890:6900 -j ACCEPT
#iptables -A FORWARD -i eth0 -p tcp --sport 6901 -j ACCEPT # Msn voice comp-comp comp-phone
#iptables -A FORWARD -i eth0 -p tcp --sport 6901 -j ACCEPT
#IPTABLES -A FORWARD -i eth0 -p tcp --sport 2001:2120 -j ACCEPT # Msn voice comp-phone
#iptables -A FORWARD -i eth0 -p tcp --sport 6801 -j ACCEPT # Msn voice comp-phone

# Allow amule-edonkey
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A TRUSTED -i eth0 -p udp -m udp --dport 4665 -j ACCEPT
iptables -A TRUSTED -i eth0 -p udp -m udp --dport 4672 -j ACCEPT
iptables -A TRUSTED -i eth0 -p tcp -m tcp --dport 4662 -j ACCEPT

# Allow IRC IDENT & DCC
iptables -A TRUSTED -i eth0 -p tcp -m tcp --sport 6667 -j ACCEPT

# Allow skype 
iptables -A TRUSTED -i eth0 -p tcp -m tcp --dport 65535 -j ACCEPT
iptables -A TRUSTED -i eth0 -p udp -m udp --dport 65535 -j ACCEPT

# Allow azureus
iptables -I INPUT 1 -i eth0 -p tcp --tcp-flags SYN,RST,ACK SYN --dport 51000 -m state --state NEW -j ACCEPT 
iptables -I INPUT 1 -i eth0 -p udp --dport 51000 -m state --state NEW -j ACCEPT

# Allow limewire
iptables -A TRUSTED -i eth0 -p tcp -m tcp --dport 6346 -j ACCEPT
iptables -A TRUSTED -i eth0 -p udp -m udp --dport 6346 -j ACCEPT

# Allow DC++
iptables -A TRUSTED -i eth0 -p tcp -m tcp --dport 1412 -j ACCEPT
iptables -A TRUSTED -i eth0 -p udp -m udp --dport 1412 -j ACCEPT

# Allow no-ip
#iptables -A TRUSTED -i eth0 -p tcp -m tcp --dport 8245 -j ACCEPT

# Allow Bittorrent
#iptables -A TRUSTED -i eth0 -p tcp -m tcp --dport 10000:10009 -j ACCEPT

# Allow rdesktop
iptables -A TRUSTED -i eth0 -p tcp -m tcp --dport 3389 -j ACCEPT

# Allow wengophone
#iptables -A TRUSTED -i eth0 -p udp -m udp --dport 5061 -j ACCEPT
#iptables -A TRUSTED -i eth0 -p udp -m udp --dport 10600:10601 -j ACCEPT

# Allow nicotine
iptables -A TRUSTED -i eth0 -p tcp -m tcp --dport 2234 -j ACCEPT

# End message
echo " [End iptables rules setting]"