#!/bin/sh


#--------------------------------------------------------------[ RESET RULES ]
echo "=========[ Setting Firewall ]========="
echo -n Reset rules
/sbin/iptables -F

/sbin/iptables -X
/sbin/iptables -t nat -X

/sbin/iptables -P INPUT DROP 
/sbin/iptables -P FORWARD DROP 
/sbin/iptables -P OUTPUT ACCEPT
echo -e "\t \033[01;32m OK \033[00m"


#--------------------------------------------------------------[ RESET RULES ]
echo -n Local \& EST/REL 
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
echo -e "\t \033[01;32m OK \033[00m"


#---------------------------------------------------------------[ Drop Invalid Connections ]
echo -n Drop invalid
/sbin/iptables -A INPUT -m state --state INVALID -j DROP
/sbin/iptables -A OUTPUT -m state --state INVALID -j DROP 
echo -e "\t \033[01;32m OK \033[00m"


#---------------------------------------------------------------[ Ping request ]
echo -n Ping rules
/sbin/iptables -I INPUT -p ICMP --icmp-type 8 -j ACCEPT
/sbin/iptables -I INPUT -p ICMP --icmp-type 37 -j ACCEPT
/sbin/iptables -I INPUT -p ICMP --icmp-type 38 -j ACCEPT
echo -e "\t \033[01;32m OK \033[00m"

#---------------------------------------------------------------[ Limit Connections ]
echo -n "Limit "
echo -n "ftp " 
/sbin/iptables -I INPUT -p tcp --dport 21 -i eth0 -m state --state NEW -m recent --set
/sbin/iptables -I INPUT -p tcp --dport 21 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 25 -j DROP
echo -n "httpd " 
/sbin/iptables -I INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set
/sbin/iptables -I INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 25 -j DROP
echo -n "ircd " 
/sbin/iptables -I INPUT -p tcp --dport 6667 -i eth0 -m state --state NEW -m recent --set
/sbin/iptables -I INPUT -p tcp --dport 6667 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 25 -j DROP
echo -n "icmp "
/sbin/iptables -I INPUT -p ICMP -m limit --limit 3/minute -j ACCEPT
/sbin/iptables -A INPUT -p ICMP -j DROP
#echo -n "svn "
#iptables -I INPUT -p tcp --dport 3690 -i eth0 -m state --state NEW -m recent --set
#iptables -I INPUT -p tcp --dport 3690 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 25 -j DROP
iptables -I INPUT -p tcp --dport 25 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 5 -j LOG --log-level DEBUG --log-prefix 'SMTP-Filter: '
echo -e "\t \033[01;32m OK \033[00m"


#---------------------------------------------------------------[ Servicii publice ]
echo -n Public ports
#/sbin/iptables -A INPUT -d $SERVER -p tcp --dport 20 -j ACCEPT
#/sbin/iptables -A INPUT -d $SERVER -p tcp --dport 22 -j ACCEPT
/sbin/iptables -A INPUT -d $SERVER -p tcp --dport 6542 -j ACCEPT
/sbin/iptables -A INPUT -d $SERVER -p tcp --dport 25 -j ACCEPT
/sbin/iptables -A INPUT -d $SERVER -p tcp --dport 53  -j ACCEPT
/sbin/iptables -A INPUT -d $SERVER -p udp --dport 53  -j ACCEPT
/sbin/iptables -A INPUT -d $SERVER -p tcp --dport 80  -j ACCEPT
/sbin/iptables -A INPUT -d $SERVER -p tcp --dport 110 -j ACCEPT
/sbin/iptables -A INPUT -d $SERVER -p tcp --dport 143 -j ACCEPT
#/sbin/iptables -A INPUT -d $SERVER -p tcp --dport 443 -j ACCEPT
#
#allow 1024> (ftp: passivemode, etc)
#/sbin/iptables -A INPUT -p tcp -m tcp --dport 1024:65534 -j ACCEPT
#echo -e "\t \033[01;32m OK \033[00m"

#---------------------------------------------------------------[ DROP some ]
#/sbin/iptables -A INPUT -d $SERVER -p tcp --dport 1241 -j DROP

#---------------------------------------------------------------[ ACCEPT ]
#echo -n "Trusted IP "
#for INIP in ${ALLOW[@]}
#do
# /sbin/iptables -A INPUT -s $INIP -p tcp -j ACCEPT
 echo -n .
#done
echo -e " \033[01;32m OK \033[00m"I tried that, also tried APF + DDoS deflate, but won't work with gbite ro