##public interface
WANIFACE=eth0

##private interface
LAN=10.0.0.0/24
LANIFACE=eth1

## Misc IP INfo
WANIP=`ifconfig $WANIFACE | grep inet | cut -d : -f 2 | cut -d \  -f 1`
WANMASK=`ifconfig $WANIFACE | grep Mask | cut -d : -f 4`
WANBCAST=`ifconfig $WANIFACE | grep inet | cut -d : -f 3 | cut -d \  -f 1`

LANIP=`ifconfig $LANIFACE | grep inet | cut -d : -f 2 | cut -d \  -f 1`
LANMASK=`ifconfig $LANIFACE | grep Mask | cut -d : -f 4`
LANBCAST=`ifconfig $LANIFACE | grep inet | cut -d : -f 3 | cut -d \  -f 1`

##local
LO_IFACE="lo"
LO_IP="127.0.0.1"

echo
echo "<--Start-->"
echo "Set WAN interface, Internal interface, and Local interface"

#iptables location
IPTABLES="/sbin/iptables"

# modules setup
/sbin/depmod -a
/sbin/modprobe ip_tables
/sbin/modprobe ipt_conntrack
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_state
/sbin/modprobe ipt_MASQUERADE
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc

#setup /proc
echo 0 > /proc/sys/net/ipv4/ip_forward
echo
echo "Set IP tables, IP conntrack, IP Masquerade, IP Forwarding modules"

## Delete and Flush
$IPTABLES --flush
$IPTABLES --table nat --flush
$IPTABLES --delete-chain
$IPTABLES --table nat --delete-chain
echo
echo "Deleted and Flushed current tables"

## Accept
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT
echo
echo "Basic Policy"

## Forward & Masquerade
$IPTABLES --table nat --append POSTROUTING --out-interface $WANIFACE -j MASQUERADE
$IPTABLES --append FORWARD --in-interface $LANIFACE -j ACCEPT
echo
echo "Set basic forwarding, and masquerade"

## Accept loopback -- I don't know why
$IPTABLES -A INPUT -i lo -p all -j ACCEPT
$IPTABLES -A OUTPUT -o lo -p all -j ACCEPT
echo
echo "Accept loopback"

## Some basic DOS protection
$IPTABLES -N ILLEGAL
$IPTABLES -F ILLEGAL
echo
echo "Established Basic DOS Protection"

# Furtive port scanner 
$IPTABLES -A ILLEGAL -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

# Drop illegal flag combinations which also prevents most port scanning
$IPTABLES -A ILLEGAL -i $LANIFACE -p tcp --tcp-flags ALL ALL -j DROP
$IPTABLES -A ILLEGAL -i $LANIFACE -p tcp --tcp-flags ALL NONE -j DROP
$IPTABLES -A ILLEGAL -i $LANIFACE -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
$IPTABLES -A ILLEGAL -i $LANIFACE -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
$IPTABLES -A ILLEGAL -i $LANIFACE -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPTABLES -A ILLEGAL -i $LANIFACE -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$IPTABLES -A ILLEGAL -i $LANIFACE -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
$IPTABLES -A ILLEGAL -i $LANIFACE -p tcp --tcp-flags ACK,FIN FIN -j DROP
$IPTABLES -A ILLEGAL -i $LANIFACE -p tcp --tcp-flags ACK,PSH PSH -j DROP
$IPTABLES -A ILLEGAL -i $LANIFACE -p tcp --tcp-flags ACK,URG URG -j DROP

echo
echo "Set illegal flag combinations of packeting"
echo "---------------------------------------------"
echo

# Refuse directed broadcasts used in Smurf/Fraggle type DOS attacks
$IPTABLES -A ILLEGAL -i $LANIFACE -d 255.255.255.255 -j DROP
$IPTABLES -A ILLEGAL -i $LANIFACE -d $WANBCAST -j DROP

# Refuse spoofed packets pretending to be from your IP address
$IPTABLES -A ILLEGAL -i $WANIFACE -s $WANIP -d $WANIP -j DROP

# Drop Fragments
$IPTABLES -A ILLEGAL -i $LANIFACE -f -j DROP

echo "Basic Rule: Drop all Smurf/Fraggle, spoofed, fragmented packets"

# Make sure packets are associated with known connections
$IPTABLES -A ILLEGAL -i $WANIFACE -m state --state INVALID -j DROP

echo "Basic Rule: Drop all packets not associated with know packets"

# Block external ICMP requests 
$IPTABLES -A INPUT -p ICMP -i $WANIFACE -s 0/0 --icmp-type 8 -j DROP

echo "Basic Rule: Block ICMP requests any host"

# Make sure NEW tcp connections are SYN packets
$IPTABLES -A ILLEGAL -i $WANIFACE -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A INPUT -i $LANIFACE -p tcp -j ILLEGAL

### System Rules/Virus Protection ###
echo
echo "Rules: Damn rules everywhere"
echo "-------------------------------"

# Port forward DHT TCP and UDP traffic
#
# This code wrong
#$IPTABLES -A FORWARD -p tcp -i $WANIFACE -d 10.10.0.253 --dport 56432 -j ACCEPT
#$IPTABLES -A FORWARD -p udp -i $WANIFACE -d 10.10.0.253 --dport 56432 -j ACCEPT
#$IPTABLES -t nat -A PREROUTING -p tcp -i $WANIFACE --dport 56432 -j DNAT --to 10.10.0.253:56432
#$IPTABLES -t nat -A PREROUTING -p udp -i $WANIFACE --dport 56432 -j DNAT --to 10.10.0.253:56432
#
# This code RIGHT

# Test this - Removed 23-08-07 
#$IPTABLES -A PREROUTING -t nat -p tcp -d $WANIP --dport 56432 -j DNAT --to 10.0.0.253:56432
#$IPTABLES -A FORWARD -i $WANIFACE -o $LANIFACE -p tcp --dport 56432 -m state --state NEW -j ACCEPT 
#$IPTABLES -A PREROUTING -t nat -p udp -d $WANIP --dport 56432 -j DNAT --to 10.0.0.253:56432
#$IPTABLES -A FORWARD -i $WANIFACE -o $LANIFACE -p udp --dport 56432 -m state --state NEW -j ACCEPT 

echo "Rule: Allow DHT Forwarding for torrents"
echo "      Blocked out 23-08-07"

# Port forward for VNC for work machine
#
# Attempt 1 (wrong)
#$IPTABLES -A FORWARD -p tcp -i $WANIFACE -d 10.10.0.253 --dport 5800 -j ACCEPT
#$IPTABLES -A FORWARD -p udp -i $WANIFACE -d 10.10.0.253 --dport 5800 -j ACCEPT
#$IPTABLES -t nat -I PREROUTING -p tcp -i $WANIFACE --dport 5800 -j DNAT --to 10.10.0.253:5800
#$IPTABLES -t nat -I PREROUTING -p udp -i $WANIFACE --dport 5800 -j DNAT --to 10.10.0.253:5800
#$IPTABLES -A FORWARD -p tcp -i $WANIFACE -d 10.10.0.253 --dport 5900 -j ACCEPT
#$IPTABLES -A FORWARD -p udp -i $WANIFACE -d 10.10.0.253 --dport 5900 -j ACCEPT
#$IPTABLES -t nat -I PREROUTING -p tcp -i $WANIFACE --dport 5900 -j DNAT --to 10.10.0.253:5900
#$IPTABLES -t nat -I PREROUTING -p udp -i $WANIFACE --dport 5900 -j DNAT --to 10.10.0.253:5900
#
# Attempt 2 (wrong)
#$IPTABLES -t nat -A PREROUTING -i eth0 -p tcp --sport 5800 -d 166.70.210.102 -j DNAT --to-destination 10.0.0.253:5800
#$IPTABLES -A FORWARD -i eth0 -o eth1 -p tcp --sport 5800 -d 10.0.0.253 --dport 5800 -m state --state NEW -j ACCEPT
#$IPTABLES -t nat -A PREROUTING -i eth0 -p tcp --sport 5900 -d 166.70.210.102 -j DNAT --to-destination 10.0.0.253:5900
#$IPTABLES -A FORWARD -i eth0 -o eth1 -p tcp --sport 5900 -d 10.0.0.253 --dport 5900 -m state --state NEW -j ACCEPT
#
# Port forwarding VNC for work machine (finally works)

$IPTABLES -A PREROUTING -t nat -p tcp -d $WANIP --dport 5800 -j DNAT --to 10.0.0.253:5800
$IPTABLES -A FORWARD -i $WANIFACE -o $LANIFACE -p tcp --dport 5800 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT 
$IPTABLES -A PREROUTING -t nat -p tcp -d $WANIP --dport 5900 -j DNAT --to 10.0.0.253:5900
$IPTABLES -A FORWARD -i $WANIFACE -o $LANIFACE -p tcp --dport 5900 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT 

echo "Rule: VNC port forwarding enabled"

# Old DHT TCP and UDP forwarding (obsolete)
#$IPTABLES -A INPUT -p tcp -m state --state NEW --dport 56432 -i $WANIFACE -j ACCEPT
#$IPTABLES -A INPUT -p udp -m state --state NEW --dport 56432 -i $WANIFACE -j ACCEPT
#$IPTABLES -t nat -A PREROUTING -p -i $WANIFACE -m TCP --dport 56432 \ -j DNAT --to-destination 10.0.0.253:56432
#$IPTABLES -t nat -A PREROUTING -p -m TCP --dport 56432 \ -j DNAT --to-destination 10.0.0.253:56432
#$IPTABLES -t nat -A PREROUTING -p -i $WANIFACE -m UDP --dport 56432 \ -j DNAT --to-destination 10.0.0.253:56432
#$IPTABLES -t nat -A PREROUTING -p -m UDP --dport 56432 \ -j DNAT --to-destination 10.0.0.253:56432

## smb (Old) DENY ALL
#$IPTABLES -A INPUT -p tcp -s 0/0 -d 0/0 --dport 135:139 -j DROP
#$IPTABLES -A INPUT -p udp -s 0/0 -d 0/0 --dport 135:139 -j DROP
#$IPTABLES -A INPUT -p tcp -s 0/0 -d 0/0 --dport 445 -j DROP
#$IPTABLES -A INPUT -p udp -s 0/0 -d 0/0 --dport 445 -j DROP
#$IPTABLES -A OUTPUT -p tcp -s 0/0 -d 0/0 --dport 135:139 -j DROP
#$IPTABLES -A OUTPUT -p udp -s 0/0 -d 0/0 --dport 135:139 -j DROP
#$IPTABLES -A OUTPUT -p tcp -s 0/0 -d 0/0 --dport 445 -j DROP
#$IPTABLES -A OUTPUT -p udp -s 0/0 -d 0/0 --dport 445 -j DROP

echo "Rule: Block all SMBD/NMBD traffic, except to internal and peno.com"
echo "      Blocked out 23-08-07"

## SMB TABLES & Rules (NEW)
# commented out on 23-08-07
#
#$IPTABLES -A INPUT -p tcp -s 166.70.78.160/28 -d $WANIP/$WANMASK --dport 135:139 -j ACCEPT
#$IPTABLES -A INPUT -p udp -s 166.70.78.160/28 -d $WANIP/$WANMASK --dport 135:139 -j ACCEPT
#$IPTABLES -A INPUT -p tcp -s 166.70.210.97/29 -d $WANIP/$WANMASK --dport 135:139 -j ACCEPT
#$IPTABLES -A INPUT -p udp -s 166.70.210.97/29 -d $WANIP/$WANMASK --dport 135:139 -j ACCEPT
#$IPTABLES -A INPUT -p tcp -s 10.0.0.0/24 -d 10.0.0.1 --dport 135:139 -j ACCEPT
#$IPTABLES -A INPUT -p udp -s 10.0.0.0/24 -d 10.0.0.1 --dport 135:139 -j ACCEPT
#$IPTABLES -A INPUT -p tcp -s 0/0 -d 0/0 --dport 135:139 -j DROP
#$IPTABLES -A INPUT -p udp -s 0/0 -d 0/0 --dport 135:139 -j DROP
#$IPTABLES -A INPUT -p tcp -s 166.70.78.160/28 -d $WANIP/$WANMASK --dport 445 -j ACCEPT
#$IPTABLES -A INPUT -p udp -s 166.70.78.160/28 -d $WANIP/$WANMASK --dport 445 -j ACCEPT
#$IPTABLES -A INPUT -p tcp -s 166.70.210.97/29 -d $WANIP/$WANMASK --dport 445 -j ACCEPT
#$IPTABLES -A INPUT -p udp -s 166.70.210.97/29 -d $WANIP/$WANMASK --dport 445 -j ACCEPT
#$IPTABLES -A INPUT -p tcp -s 10.0.0.0/24 -d 10.0.0.1 --dport 445 -j DROP
#$IPTABLES -A INPUT -p udp -s 10.0.0.0/24 -d 10.0.0.1 --dport 445 -j DROP
#$IPTABLES -A INPUT -p tcp -s 0/0 -d 0/0 --dport 445 -j DROP
#$IPTABLES -A INPUT -p udp -s 0/0 -d 0/0 --dport 445 -j DROP
#$IPTABLES -A OUTPUT -p tcp -s 166.70.78.160/28 -d $WANIP/$WANMASK --dport 135:139 -j ACCEPT
#$IPTABLES -A OUTPUT -p udp -s 166.70.78.160/28 -d $WANIP/$WANMASK --dport 135:139 -j ACCEPT
#$IPTABLES -A OUTPUT -p tcp -s 166.70.210.97/29 -d $WANIP/$WANMASK --dport 135:139 -j ACCEPT
#$IPTABLES -A OUTPUT -p udp -s 166.70.210.97/29 -d $WANIP/$WANMASK --dport 135:139 -j ACCEPT
#$IPTABLES -A OUTPUT -p tcp -s 10.0.0.0/24 -d 10.0.0.1 --dport 135:139 -j ACCEPT
#$IPTABLES -A OUTPUT -p udp -s 10.0.0.0/24 -d 10.0.0.1 --dport 135:139 -j ACCEPT
#$IPTABLES -A OUTPUT -p tcp -s 0/0 -d 0/0 --dport 135:139 -j DROP
#$IPTABLES -A OUTPUT -p udp -s 0/0 -d 0/0 --dport 135:139 -j DROP
#$IPTABLES -A OUTPUT -p tcp -s 166.70.78.160/28 -d $WANIP/$WANMASK --dport 445 -j ACCEPT
#$IPTABLES -A OUTPUT -p udp -s 166.70.78.160/28 -d $WANIP/$WANMASK --dport 445 -j ACCEPT
#$IPTABLES -A OUTPUT -p tcp -s 166.70.210.97/29 -d $WANIP/$WANMASK --dport 445 -j ACCEPT
#$IPTABLES -A OUTPUT -p udp -s 166.70.210.97/29 -d $WANIP/$WANMASK --dport 445 -j ACCEPT
#$IPTABLES -A OUTPUT -p tcp -s 10.0.0.0/24 -d 10.0.0.1 --dport 445 -j DROP
#$IPTABLES -A OUTPUT -p udp -s 10.0.0.0/24 -d 10.0.0.1 --dport 445 -j DROP
#$IPTABLES -A OUTPUT -p tcp -s 0/0 -d 0/0 --dport 445 -j DROP
#$IPTABLES -A OUTPUT -p udp -s 0/0 -d 0/0 --dport 445 -j DROP

## IRC (IRC Allowed)
#$IPTABLES -A INPUT -p tcp -s 0/0 -d 0/0 --dport 6665-6669 -j DROP
#$IPTABLES -A INPUT -p udp -s 0/0 -d 0/0 --dport 6665-6669 -j DROP
#$IPTABLES -A OUTPUT -p tcp -s 0/0 -d 0/0 --dport 6665-6669 -j DROP
#$IPTABLES -A OUTPUT -p udp -s 0/0 -d 0/0 --dport 6665-6669 -j DROP

echo "Rule: Allow all IRC traffic"

## Block identd, only required for IRC
$IPTABLES -A INPUT -p tcp -s 0/0 -d 0/0 --dport 113 -j DROP
$IPTABLES -A INPUT -p udp -s 0/0 -d 0/0 --dport 113 -j DROP
$IPTABLES -A OUTPUT -p tcp -s 0/0 -d 0/0 --dport 113 -j DROP
$IPTABLES -A OUTPUT -p udp -s 0/0 -d 0/0 --dport 113 -j DROP

echo "Rule: Block identd"

## Worm\Trojan\Virii rules
$IPTABLES -A INPUT -p tcp -s 0/0 -d 0/0 --dport 3630 -j DROP
$IPTABLES -A INPUT -p udp -s 0/0 -d 0/0 --dport 3630 -j DROP
$IPTABLES -A OUTPUT -p tcp -s 0/0 -d 0/0 --dport 3630 -j DROP
$IPTABLES -A OUTPUT -p udp -s 0/0 -d 0/0 --dport 3630 -j DROP

echo "Rule: Block basic worm attacks"

## Korgo
$IPTABLES -A INPUT -p tcp -s 0/0 -d 0/0 --dport 1246 -j DROP
$IPTABLES -A INPUT -p udp -s 0/0 -d 0/0 --dport 1246 -j DROP
$IPTABLES -A OUTPUT -p tcp -s 0/0 -d 0/0 --dport 1246 -j DROP
$IPTABLES -A OUTPUT -p udp -s 0/0 -d 0/0 --dport 1246 -j DROP

echo "Rule: Block Korgo virus"

## MSBlaster
$IPTABLES -A INPUT -p tcp -s 0/0 -d 0/0 --dport 153 -j DROP
$IPTABLES -A INPUT -p udp -s 0/0 -d 0/0 --dport 153 -j DROP
$IPTABLES -A INPUT -p tcp -s 0/0 -d 0/0 --dport 707 -j DROP
$IPTABLES -A INPUT -p udp -s 0/0 -d 0/0 --dport 707 -j DROP
$IPTABLES -A OUTPUT -p tcp -s 0/0 -d 0/0 --dport 153 -j DROP
$IPTABLES -A OUTPUT -p udp -s 0/0 -d 0/0 --dport 153 -j DROP
$IPTABLES -A OUTPUT -p tcp -s 0/0 -d 0/0 --dport 707 -j DROP
$IPTABLES -A OUTPUT -p udp -s 0/0 -d 0/0 --dport 707 -j DROP

echo "Rule: Block MSBlaster worm/virus"

## Block TFTP going out
$IPTABLES -A FORWARD -p udp -i $LANIFACE -d 10.0.0.0/24 --dport 69 -j LOG --log-prefix " TFTP_PROBE "
$IPTABLES -A FORWARD -p udp -i eth1 -d 10.0.0.0/24 --dport 69 -j REJECT --reject-with icmp-port-unreachable

echo "Rule: Block TFTP outgoing traffic"

#### Personal Security Rules #####

## FTP (Drop all FTP, check /etc/services) 
#$IPTABLES -A INPUT -p tcp -s 0/0 -d 0/0 --dport 21 -j DROP
#$IPTABLES -A INPUT -p udp -s 0/0 -d 0/0 --dport 21 -j DROP
#$IPTABLES -A OUTPUT -p tcp -s 0/0 -d 0/0 --dport 21 -j DROP
#$IPTABLES -A OUTPUT -p udp -s 0/0 -d 0/0 --dport 21 -j DROP

## SSH (Drop all SSH, check /etc/services)
#$IPTABLES -A INPUT -p tcp -s 0/0 -d 0/0 --dport 1246 -j DROP
#$IPTABLES -A INPUT -p udp -s 0/0 -d 0/0 --dport 1246 -j DROP
#$IPTABLES -A OUTPUT -p tcp -s 0/0 -d 0/0 --dport 1246 -j DROP
#$IPTABLES -A OUTPUT -p udp -s 0/0 -d 0/0 --dport 1246 -j DROP

#### P2P RULES (block everything but BitTorrent) #####

## eMule / EDonkey 2000
#
# eMule / eDonkey is now a defunct p2p network
#
# $IPTABLES -A INPUT -p tcp -s 0/0 -d 0/0 --dport 4661:4665 -j DROP
# $IPTABLES -A INPUT -p udp -s 0/0 -d 0/0 --dport 4661:4665 -j DROP
# $IPTABLES -A OUTPUT -p tcp -s 0/0 -d 0/0 --dport 4661:4665 -j DROP
# $IPTABLES -A OUTPUT -p udp -s 0/0 -d 0/0 --dport 4661:4665 -j DROP
#
# echo "Rule: Allow eMule/eDonkey 2000 traffic"

## Gnutella
$IPTABLES -A INPUT -p tcp -s 0/0 -d 0/0 --dport 6346 -j DROP
$IPTABLES -A INPUT -p udp -s 0/0 -d 0/0 --dport 6346 -j DROP
$IPTABLES -A OUTPUT -p tcp -s 0/0 -d 0/0 --dport 6346 -j DROP
$IPTABLES -A OUTPUT -p udp -s 0/0 -d 0/0 --dport 6346 -j DROP

echo "Rule: Allow Gnutella Nucleus"

## Napster
$IPTABLES -A INPUT -p tcp -s 0/0 -d 0/0 --dport 6699:6701 -j DROP
$IPTABLES -A INPUT -p udp -s 0/0 -d 0/0 --dport 6699:6701 -j DROP
$IPTABLES -A OUTPUT -p tcp -s 0/0 -d 0/0 --dport 6699:6701 -j DROP
$IPTABLES -A OUTPUT -p udp -s 0/0 -d 0/0 --dport 6699:6701 -j DROP

echo "Rule: Allow Napster"

## BitTorent
#$IPTABLES -A INPUT -p tcp -s 0/0 -d 0/0 --dport 6881:6889 -j DROP
#$IPTABLES -A INPUT -p udp -s 0/0 -d 0/0 --dport 6881:6889 -j DROP
#$IPTABLES -A OUTPUT -p tcp -s 0/0 -d 0/0 --dport 6881:6889 -j DROP
#$IPTABLES -A OUTPUT -p udp -s 0/0 -d 0/0 --dport 6881:6889 -j DROP

echo "Rule: Allow BitTorrent"

## Kazaa rules
$IPTABLES -A INPUT -d 213.248.112.0/24 -j REJECT
$IPTABLES -A INPUT -p udp -s 0/0 -d 0/0 --dport 1214 -j REJECT
$IPTABLES -A INPUT -p tcp -s 0/0 -d 0/0 --dport 1214 -j REJECT
$IPTABLES -A OUTPUT -d 213.248.112.0/24 -j REJECT
$IPTABLES -A OUTPUT -p udp -s 0/0 -d 0/0 --dport 1214 -j REJECT
$IPTABLES -A OUTPUT -p tcp -s 0/0 -d 0/0 --dport 1214 -j REJECT

echo "Rule: Deny Kazaa w/ Reject Notification"

## TOS prioritization
$IPTABLES -A PREROUTING -t mangle -p tcp --sport ssh -j TOS --set-tos Minimize-Delay
$IPTABLES -A PREROUTING -t mangle -p tcp --sport http -j TOS --set-tos Maximize-Throughput

#echo "Anti-Peno Leeching Rule, so you can game"
#$IPTABLES -A INPUT -p tcp -s 166.70.78.164/255.255.255.240 -d 166.70.210.102/255.255.255.248 --dport 1008 -j DROP

#echo "Block that clown, for Justin"
#$IPTABLES -A INPUT -d 213.113.208.92 -j DROP
#$IPTABLES -A OUTPUT -d 213.113.208.92 -j DROP
#$IPTABLES -A INPUT -p tcp -s 213.113.208.92/24 -d 166.70.210.102/255.255.255.248 --dport 1:65535 -j DROP

echo "TOS prioritization"

## enable this stuff
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians

## disable this stuff
echo 0 > /proc/sys/net/ipv4/conf/all/proxy_arp
echo 0 > /proc/sys/net/ipv4/tcp_ecn
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 > /proc/sys/net/ipv4/conf/eth0/accept_redirects