*filter
:INPUT DROP []
:FORWARD ACCEPT []
:OUTPUT ACCEPT []

# loopback allowed
-A INPUT -i lo -j ACCEPT

# Accept ping and traceroute (needs icmp)
-A INPUT -p icmp -j ACCEPT

# Established connections allowed
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# SSH
-A INPUT -p tcp -m tcp  --dport 22 -j ACCEPT

# SNMP allows from oit monitoring systems
-A INPUT -p udp -m udp -s 10.8.34.52 --dport 161 -j ACCEPT
-A INPUT -p udp -m udp -s 10.8.34.53 --dport 161 -j ACCEPT

# NTP servers (if any)
#-A INPUT -p udp -m udp -s ips-allowed-here --dport 123 -j ACCEPT

# Bacula Backups
-A INPUT -p tcp -m tcp -s 10.8.34.80 --dport 9102 -j ACCEPT

# Custom Services
<% custom.each do |cust| -%>
<%= cust %>
<% end -%>

# Services TCP
<% tcpPorts.each do |port| -%>
-A INPUT -p tcp -m tcp  --dport <%= port %> -j ACCEPT
<% end -%>

# Services UDP
<% udpPorts.each do |port| -%>
-A INPUT -p udp -m udp  --dport <%= port %> -j ACCEPT
<% end -%>

# more services we use - ports for random services and TG listeners.
COMMIT