#!/bin/sh
IPT=/sbin/iptables

$IPT -F
$IPT -X
$IPT -t mangle -F
$IPT -t nat -F
$IPT -t raw -F

$IPT -P INPUT ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT

$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -I INPUT -s 127.0.0.0/24 -d 127.0.0.0/24 -j ACCEPT

# Settings
SYN_FLOOD_PROTECTION=1
ICMP_IGNORE_BROADCAST=1
ICMP_REDIRECTS=0
ICMP_IGNORE_BAD_MSGS=1
LOG_MARTIANS=0
TCP_TIMESTAMPS=0
ACCEPT_SOURCE_ROUTE=0
ICMP_PING=1

LOG_SCANS=0
XMAS_SCAN=1
XMAS_PSH_SCAN=1
NMAP_XMAS_SCAN=1
NULL_SCAN=1
SYN_RST_SCAN=1
SYN_FIN_SCAN=1

# Generic Protection
print_status() {
  if [ $1 == 1 ]; then
    echo "Enabled"
  else
    echo "Disabled"
  fi
}
print_statusex() {
  printf "$1"
  if [ $2 == 1 ]; then
    echo "Enabled"
  else
    echo "Disabled"
  fi
}

echo "  Setting up..."
printf "    SYN-Flood protection               "
if [ -f /proc/sys/net/ipv4/tcp_syncookies ]; then
  echo $SYN_FLOOD_PROTECTION > /proc/sys/net/ipv4/tcp_syncookies
  print_status $SYN_FLOOD_PROTECTION
else
  echo "Default"
fi
printf "    Ignore ICMP broadcasts             "
if [ -f /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts ] && [ $ICMP_IGNORE_BROADCAST == 1 ]; then
  echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
  print_status $ICMP_IGNORE_BROADCAST
else
  echo "Default"
fi
printf "    Log Martians                       "
if [ -f /proc/sys/net/ipv4/conf/all/log_martians ]; then
  echo $LOG_MARTIANS > /proc/sys/net/ipv4/conf/all/log_martians
  print_status $LOG_MARTIANS
else
  echo "Default"
fi
printf "    TCP Timestamps                     "
if [ -f /proc/sys/net/ipv4/tcp_timestamps ]; then
  echo $TCP_TIMESTAMPS > /proc/sys/net/ipv4/tcp_timestamps
  print_status $TCP_TIMESTAMPS
else
  echo "Default"
fi
printf "    ICMP redirects                     "
if [ -f /proc/sys/net/ipv4/conf/all/accept_redirects ]; then
  echo $ICMP_REDIRECTS > /proc/sys/net/ipv4/conf/all/accept_redirects
  print_status $ICMP_REDIRECTS
else
  echo "Default"
fi
printf "    Accept source route                "
if [ -f /proc/sys/net/ipv4/conf/all/accept_source_route ]; then
  echo $ACCEPT_SOURCE_ROUTE > /proc/sys/net/ipv4/conf/all/accept_source_route
  print_status $ACCEPT_SOURCE_ROUTE
else
  echo "Default"
fi
printf "    Ignore bad ICMP msgs               "
if [ -f /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses ]; then
  echo $ICMP_IGNORE_BAD_MSGS > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
  print_status $ICMP_IGNORE_BAD_MSGS
else
  echo "Default"
fi
printf "    Reply to ICMP Ping                 "
if [ $ICMP_PING == 0 ]; then
  $IPTABLES -A INPUT -p icmp --icmp-type echo-reply -s 0/0 -i $EXTIF -j ACCEPT
  $IPTABLES -A INPUT -p icmp --icmp-type destination-unreachable -s 0/0 -i $EXTIF -j ACCEPT
  $IPTABLES -A INPUT -p icmp --icmp-type time-exceeded -s 0/0 -i $INTIF -j ACCEPT
  $IPTABLES -A INPUT -p icmp -i $EXTIF -j DROP
fi
print_status $ICMP_PING

# Web Server
$IPT -A INPUT -p tcp --dport 21 -d xxx.xxx.xxx.xxx -j ACCEPT
$IPT -A INPUT -p tcp --dport 25 -d xxx.xxx.xxx.xxx -j ACCEPT
$IPT -A INPUT -p tcp --dport 80 -d xxx.xxx.xxx.xxx -j ACCEPT
$IPT -A INPUT -p tcp --dport 88 -d xxx.xxx.xxx.xxx -j ACCEPT
$IPT -A INPUT -p tcp --dport 110 -d xxx.xxx.xxx.xxx -j ACCEPT
# $IPT -A INPUT -p tcp --dport 143 -d xxx.xxx.xxx.xxx -j ACCEPT
$IPT -A INPUT -p tcp --dport 443 -d xxx.xxx.xxx.xxx -j ACCEPT
$IPT -A INPUT -p tcp --dport 2222 -d xxx.xxx.xxx.xxx -j ACCEPT
$IPT -A INPUT -p tcp --dport 32555:32565 -d xxx.xxx.xxx.xxx -j ACCEPT

# DNS
$IPT -A INPUT -p tcp --dport 53 -d xxx.xxx.xxx.xxx -j ACCEPT
$IPT -A INPUT -p tcp --dport 53 -d xxx.xxx.xxx.xxx -j ACCEPT
$IPT -A INPUT -p udp --dport 53 -d xxx.xxx.xxx.xxx -j ACCEPT
$IPT -A INPUT -p udp --dport 53 -d xxx.xxx.xxx.xxx-j ACCEPT
$IPT -A INPUT -p tcp --dport 88 -d xxx.xxx.xxx.xxx -j ACCEPT
$IPT -A INPUT -p tcp --dport 88 -d xxx.xxx.xxx.xxx -j ACCEPT

# Game Server
$IPT -A INPUT -p udp --dport 27012 -d xxx.xxx.xxx.xxx -j ACCEPT
$IPT -A INPUT -p udp --dport 27015 -d xxx.xxx.xxx.xxx -j ACCEPT
$IPT -A INPUT -p udp --dport 27025 -d xxx.xxx.xxx.xxx -j ACCEPT
$IPT -A INPUT -p udp --dport 27035 -d xxx.xxx.xxx.xxx -j ACCEPT
$IPT -A INPUT -p tcp --dport 88 -d xxx.xxx.xxx.xxx -j ACCEPT
# $IPT -A OUTPUT -p tcp --dport 1809 -d xxx.xxx.xxx.xxx -j ACCEPT
# $IPT -A OUTPUT -p tcp --dport 80 -d xxx.xxx.xxx.xxx -j ACCEPT

# Reply to ping
iptables -I INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Drop everything else
$IPT -A INPUT -j DROP