#!/bin/bash
for x in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $x ; done
IPTABLES=/sbin/iptables
$IPTABLES -N out-throttle
iptables -A INPUT -s 10.0.0.0/8     -j DROP
iptables -A INPUT -s 169.254.0.0/16 -j DROP
iptables -A INPUT -s 172.16.0.0/12  -j DROP
iptables -A INPUT -s 127.0.0.0/8    -j DROP
iptables -A INPUT -s 224.0.0.0/4      -j DROP
iptables -A INPUT -d 224.0.0.0/4      -j DROP
iptables -A INPUT -s 240.0.0.0/5      -j DROP
iptables -A INPUT -d 240.0.0.0/5      -j DROP
iptables -A INPUT -s 0.0.0.0/8        -j DROP
iptables -A INPUT -d 0.0.0.0/8        -j DROP
iptables -A INPUT -d 239.255.255.0/24 -j DROP
iptables -A INPUT -d 255.255.255.255  -j DROP
iptables -p tcp --syn --dport 22 -m connlimit --connlimit-above 8 --connlimit-mask 24 -j REJECT
iptables -A OUTPUT -p icmp -m pcmp -m limit --limit 30/second -j ACCEPT
iptables -A OUTPUT -p udp -m udp -m limit --limit 30/second -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A OUTPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP

## If I have this, then do I need whats at the bottom?
### create queue class for udp
tc class add dev eth0 parent 10:1 classid 10:100 cbq bandwidth 1Mbit rate \
  10Kbit allot 1514 weight 800Kbit prio 5 maxburst 20 avpkt 250 \
  bounded
### And slow it down
tc filter add dev eth0 parent 10:0 protocol ip prio 100 u32 match ip protocol 17 0xFF flowid 10:100
$IPTABLES -t filter -A OUTPUT -j out-throttle


echo -n " rate throttling: "
#syn flood limit
$IPTABLES -t filter -A out-throttle -j RETURN -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 10/sec
$IPTABLES -t filter -A out-throttle -j rate-logdrop -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN
#rst flood limit
$IPTABLES -t filter -A out-throttle -j RETURN -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 10/sec
$IPTABLES -t filter -A out-throttle -j rate-logdrop -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST
$IPTABLES -t filter -A out-throttle -j RETURN -p tcp
#icmp rate limit
$IPTABLES -t filter -A out-throttle -j RETURN -p icmp -m limit --limit 25/sec
$IPTABLES -t filter -A out-throttle -j RETURN -p udp -m limit --limit 25/sec
#log the flood
$IPTABLES -t filter -A out-throttle -j LOG -m limit --limit 10/min --log-prefix "FW-out-throttle: "
#enable this to debug inbound flood throttling
#$IPTABLES -t filter -A out-throttle -j RETURN
#normally this is the policy
# Why do i want you to drop
#$IPTABLES -t filter -A out-throttle -j DROP

sleep 60
iptables -F