/etc/init.d# cat firewall 
#!/bin/bash

###############################################################
################## Iptables Firewall  #####################
###############################################################


#---------------------------------------------------------------
# Loading moduls
#---------------------------------------------------------------

# modprobe iptable_nat // in this case we don't use NAT table
# modprobe ip_nat_ftp
modprobe ip_conntrack
modprobe ip_conntrack_ftp


#---------------------------------------------------------------
# Initialize all the chains by removing all rules
#---------------------------------------------------------------

iptables -F


#---------------------------------------------------------------
# Drop all packets 
#---------------------------------------------------------------

iptables --policy INPUT DROP
iptables --policy OUTPUT DROP
iptables --policy FORWARD DROP


#---------------------------------------------------------------
# The loopback interface should accept all traffic
# Necessary for X-Windows and other socket based services
#---------------------------------------------------------------

iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT


#---------------------------------------------------------------
# The local interface should accept all traffic
# Necessary for MS-SQL comunication // This one is for the case
# if SQL server is runnion on another computer connected to eth1 
#---------------------------------------------------------------

iptables -A INPUT -i eth1 -j ACCEPT
iptables -A OUTPUT -o eth1 -j ACCEPT


#---------------------------------------------------------------
# Open outgoing for yum // This one is for Red Hat based Linux 
# packages installer, but in this case it allows outgoing traffic
#---------------------------------------------------------------

iptables -A OUTPUT -o eth0 -j ACCEPT



     ###############################################################
     ################## Firewall Rules Section #####################
     ###############################################################



#---------------------------------------------------------------
# Allow port 21 (FTP) connections to the firewall
#---------------------------------------------------------------

iptables -A INPUT -p tcp -i eth0 --dport 21 -j ACCEPT

#---------------------------------------------------------------
# Allow port 22 (SSH) connections to the firewall
#---------------------------------------------------------------


iptables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT

#---------------------------------------------------------------
# Allow port 25 (SMTP) connections to the firewall
#---------------------------------------------------------------


iptables -A INPUT -p tcp -i eth0 --dport 25 -j ACCEPT


#---------------------------------------------------------------
# Allow port 53 (DNS) connections to the firewall
#---------------------------------------------------------------


iptables -A INPUT -p tcp -i eth0 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --dport 53 -j ACCEPT 

#---------------------------------------------------------------
# Allow port 80 (HTTP) connections to the firewall
#---------------------------------------------------------------


iptables -A INPUT -p tcp -i eth0 --dport 80 -j ACCEPT


#---------------------------------------------------------------
# Allow port 110 (POP3) connections to the firewall
#---------------------------------------------------------------


iptables -A INPUT -p tcp -i eth0 --dport 110 -j ACCEPT



#---------------------------------------------------------------
# Allow port 995 (POP3s) connections to the firewall
#---------------------------------------------------------------


# iptables -A INPUT -p tcp -i eth0 --dport 995 -j ACCEPT // not set yet


#---------------------------------------------------------------
# Allow port 143 (IMAP) connections to the firewall
#---------------------------------------------------------------


iptables -A INPUT -p tcp -i eth0 --dport 143 -j ACCEPT


#---------------------------------------------------------------
# Allow port 993 (IMAPs) connections to the firewall
#---------------------------------------------------------------


# iptables -A INPUT -p tcp -i eth0 --dport 993 -j ACCEPT // not set yet

#---------------------------------------------------------------
#
# Additional ports 
# 111 (tcp,udp)sunrpc, portmapper
# 113 (tcp) ident, aut service
# 119 (tcp) nntp , news server, should be disabled
# 999 (tcp) garcon, for computers comunication
#---------------------------------------------------------------

iptables -A INPUT -p tcp -i eth0 --dport 111 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 111 -j ACCEPT

iptables -A INPUT -p tcp -i eth0 --dport 113 -j ACCEPT

iptables -A INPUT -p tcp -i eth0 --dport 999 -j ACCEPT

iptables -A INPUT -p tcp -i eth0 --dport 119 -j REJECT
iptables -A OUTPUT -p tcp -o eth0 --dport 119 -j REJECT


###############################################################
############ Allow already established connections ###########
###############################################################



#---------------------------------------------------------------
# Allow previously established connections
#---------------------------------------------------------------

iptables -A INPUT -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A OUTPUT -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT


iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A OUTPUT -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT


# iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT



###############################################################
############ Fix Linux settings for better security ###########
###############################################################

#---------------------------------------------------------------
# Disable routing triangulation. Respond to queries out
# the same interface, not another. Helps to maintain state
# Also protects against IP spoofing
#---------------------------------------------------------------

echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter

#---------------------------------------------------------------

# Enable logging of packets with malformed IP addresses
#---------------------------------------------------------------

# echo 1 > /proc/sys/net/ipv4/conf/all/log_martians

#---------------------------------------------------------------
# Disable redirects
#---------------------------------------------------------------

echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects

#---------------------------------------------------------------
# Disable source routed packets
#---------------------------------------------------------------

echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route

#---------------------------------------------------------------
# Disable acceptance of ICMP redirects
#---------------------------------------------------------------

echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects

#---------------------------------------------------------------
# Turn on protection from Denial of Service (DOS) attacks
#---------------------------------------------------------------

echo 1 > /proc/sys/net/ipv4/tcp_syncookies

#---------------------------------------------------------------
# Disable responding to ping broadcasts
#---------------------------------------------------------------

# echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

#---------------------------------------------------------------
# Enable routing (IP forwarding)
#---------------------------------------------------------------

# echo 1 > /proc/sys/net/ipv4/ip_forward


exit 0