enable () { for file in $@; do echo 1 > $file; done }
        disable () { for file in $@; do echo 0 > $file; done }

        #Define local port range (the default range is 32768-61000)
        $ECHO "32768 61000" > /proc/sys/net/ipv4/ip_local_port_range

        #Set the TTL (Time To Live on onbound packet) size to give passive OS fingerprints a little more work to do (default is 64)
        $ECHO "60" > /proc/sys/net/ipv4/ip_default_ttl

        #The window scaling transmitted during the SYN segment, which should be shifted to left (default is 1; boolean)
        enable /proc/sys/net/ipv4/tcp_window_scaling

        #Disable the timestamps; can reduce overhead and hide passive OS fingerprints
        disable /proc/sys/net/ipv4/tcp_timestamps

        #Note that the following values are approximated for ADSL2+ Annex M 8mb/3mb
        #The delay was choosen by pinging various destinations far away (e.g. from .fi to .jp)
        #(8 000 000 bps / 8 bites-per-byte) / 0.400s = 400000
        #(3 000 000 bps / 8 bites-per-byte) / 0.400s = 150000

        #Tune core receiving buffer (default is 105472)
        $ECHO "400000" > /proc/sys/net/core/rmem_max

        #Tune core sending buffer (default is 105472)
        $ECHO "150000" > /proc/sys/net/core/wmem_max

        #Tune TCP receiving buffer (default is 4096    87380   174760)
        $ECHO "4096 87380 400000" > /proc/sys/net/ipv4/tcp_rmem

        #Tune TCP sending buffer (4096    16384   131072)
        $ECHO "4096 87380 150000" > /proc/sys/net/ipv4/tcp_wmem

        #We need to adjust also the TCP window scaling (default is 2)
        $ECHO "4" > /proc/sys/net/ipv4/tcp_adv_win_scale

        #Turn off IP forwarding in the kernel *before* all rules are loaded
        disable /proc/sys/net/ipv4/ip_forward

        #Disable dynamic IP addresses (enable if DHCP is going to be again used)
        disable /proc/sys/net/ipv4/ip_dynaddr

        #Enable tcp-syncookies
        enable /proc/sys/net/ipv4/tcp_syncookies

        #Disable inbound routed packets that may be spoofed (no legitimate use anyhow)
        disable /proc/sys/net/ipv4/conf/*/accept_source_route

        #Do not respond to packets that may cause a different interface than the one that is responding.
        #This does not affect our setup as no dynamic routes are used.
        enable /proc/sys/net/ipv4/conf/*/rp_filter

        #Furthermore, do not send any redirects.
        #This should not affect our setup as there are no alternative routes for clients.
        disable /proc/sys/net/ipv4/conf/*/send_redirects

        #Disable replies to ARP requests whenever we have a route to the host.
        disable /proc/sys/net/ipv4/conf/*/proxy_arp

        #Disable all insecure (ICMP) redirects
        disable /proc/sys/net/ipv4/conf/*/accept_redirects

        #Disable also redirects from trusted sources.
        #This should not affect our setup as no multiple routers are used.
        disable /proc/sys/net/ipv4/conf/*/secure_redirects

        #Disable ICMP echo requests (ping packets); can hide ping sweeps but prevent legitimate use
        disable /proc/sys/net/ipv4/icmp_echo_ignore_all

        #Ignore ICMP broadcasts and bogus ICMP error messages
        enable /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
        enable /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

        #Enable error message redirects so that the ICMP messages are sent back to the interface that caused the ICMP error (default: disabled)
        enable /proc/sys/net/ipv4/icmp_errors_use_inbound_ifaddr

        #Enable logging of all packets that have an IP that should not exist
        enable /proc/sys/net/ipv4/conf/*/log_martians

        #Reduce the ability of DoS by reducing TCP keepalive time (default is 7200)
        $ECHO "3600" > /proc/sys/net/ipv4/tcp_keepalive_time

        #Reduce the ability of DoS by reducing TCP-FIN timeout (default is 60)
        $ECHO "10" > /proc/sys/net/ipv4/tcp_fin_timeout

        #Reduce he ability o Dos by reducing the keepalive probe (default is 75)
        $ECHO "50" > /proc/sys/net/ipv4/tcp_keepalive_intvl

        #Define how many TCP keepalive probes kernel will sent before giving defining a connection broken (default is 9)
        $ECHO "5" > /proc/sys/net/ipv4/tcp_keepalive_probes

        #Set the number of SYN packets that the kernel will send before giving up on a new connection (default is 5)
        $ECHO "3" > /proc/sys/net/ipv4/tcp_syn_retries

        #Set the number (but not the timing) of the SYN-ACKs sent back before giving up (default is 5)
        $ECHO "3" > /proc/sys/net/ipv4/tcp_synack_retries

        #THE LAST-RESORT in case of DoS (do not enable unless absolutely neccessary)
        disable /proc/sys/net/ipv4/tcp_abort_on_overflow