#!/bin/sh
##############################################################
# Copyright © 2002 by ubra of PhY Group. All rights reserved.
# <ubra@phy.corp.org>
#
##############################################################
# iptables init script
# to be run at startup before any interfaces are brougth up
#
##############################################################

IPF="/usr/sbin/iptables"

$IPF -F
$IPF -X
$IPF -Z

$IPF -P INPUT DROP
$IPF -P FORWARD DROP
$IPF -P OUTPUT ACCEPT




$IPF -N LOGDROP
$IPF -t filter -A LOGDROP -m limit --limit 20/minute --limit-burst 3 -j LOG --log-level info --log-prefix "[DR] " --log-tcp-sequence --log-tcp-options --log-ip-options
$IPF -t filter -A LOGDROP -j DROP


$IPF -N LOGACCEPT
$IPF -t filter -A LOGACCEPT -m limit --limit 40/minute --limit-burst 3 -j LOG --log-level info --log-prefix "[AC] " --log-tcp-sequence --log-tcp-options --log-ip-options
$IPF -t filter -A LOGACCEPT -j ACCEPT



$IPF -N TCPINC
$IPF -t filter -A TCPINC -i lo -p tcp -j ACCEPT
#$IPF -t filter -A TCPINC -i eth0 -p tcp -m unclean -j LOGDROP
#$IPF -t filter -A TCPINC -i eth1 -p tcp -s 192.168.1.1 --dport 22 -j LOGACCEPT
#$IPF -t filter -A TCPINC -i eth0 -p tcp --syn --dport 666 -j LOGACCEPT
$IPF -t filter -A TCPINC -i eth0 -p tcp --syn -s 192.168.11.11 --dport 22 -j LOGACCEPT
$IPF -t filter -A TCPINC -i eth0 -p tcp --syn --dport 80 -j ACCEPT
#$IPF -t filter -A TCPINC -i eth0 -p tcp -s 63.98.19.244 --dport 113 -j LOGACCEPT
#$IPF -t filter -A TCPINC -i eth0 -p tcp -s 80.96.105.222 --dport 113 -j LOGACCEPT
#$IPF -t filter -A TCPINC -i eth0 -p tcp -s 81.196.222.27 --dport 113 -j LOGACCEPT
$IPF -t filter -A TCPINC -i eth0 -p tcp -m state --state ESTABLISHED -j ACCEPT
$IPF -t filter -A TCPINC -p tcp -j LOGDROP



$IPF -N UDPINC
$IPF -t filter -A UDPINC -i lo -p udp -j ACCEPT
#$IPF -t filter -A UDPINC -i eth0 -p udp -s 194.105.25.129 -d 255.255.255.255 -j DROP
#$IPF -t filter -A UDPINC -i eth0 -p udp -m unclean -j LOGDROP
$IPF -t filter -A UDPINC -i eth0 -p udp -m state --state ESTABLISHED --source-port 53 -j ACCEPT
$IPF -t filter -A UDPINC -p udp -j LOGDROP



$IPF -N ICMPINC
$IPF -t filter -A ICMPINC -i lo -p icmp -j ACCEPT
#$IPF -t filter -A ICMPINC -i eth0 -p icmp -m unclean -j LOGDROP
$IPF -t filter -A ICMPINC -i eth0 -p icmp --icmp-type echo-reply -m state --state ESTABLISHED -m limit --limit 90/minute --limit-burst 20 -j ACCEPT
$IPF -t filter -A ICMPINC -i eth0 -p icmp --icmp-type timestamp-reply -m state --state ESTABLISHED -m limit --limit 90/minute --limit-burst 20 -j ACCEPT
$IPF -t filter -A ICMPINC -i eth0 -p icmp --icmp-type destination-unreachable -m state --state RELATED -m limit --limit 15/minute --limit-burst 5 -j ACCEPT
$IPF -t filter -A ICMPINC -i eth0 -p icmp --icmp-type time-exceeded -m state --state RELATED -m limit --limit 15/minute --limit-burst 5 -j ACCEPT
$IPF -t filter -A ICMPINC -p icmp -j LOGDROP



$IPF -t filter -A INPUT -p tcp -j TCPINC
$IPF -t filter -A INPUT -p udp -j UDPINC
$IPF -t filter -A INPUT -p icmp -j ICMPINC