#!/bin/bash

# Flush tables

/sbin/iptables   -P INPUT ACCEPT
/sbin/iptables   -F
/sbin/iptables   -X

# Related / Established

/sbin/iptables   -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables   -A INPUT -p ICMP --icmp-type   "echo-request" -m limit --limit 1/second -j ACCEPT
/sbin/iptables   -A INPUT -p ICMP -m icmp --icmp-type timestamp-request -j DROP
/sbin/iptables   -A INPUT -p ICMP -m icmp --icmp-type timestamp-reply -j DROP
/sbin/iptables   -A INPUT -p ICMP --icmp-type ! "echo-request"                           -j ACCEPT


# Allowed Services 


/sbin/iptables  -A INPUT -p tcp -m state --state NEW --dport 80    -j ACCEPT
/sbin/iptables  -A INPUT -p tcp -m state --state NEW --dport 443   -j ACCEPT
/sbin/iptables  -A INPUT -p tcp --dport 53    -j ACCEPT
/sbin/iptables  -A INPUT -p tcp --dport 22    -j ACCEPT
/sbin/iptables  -A INPUT -p udp --dport 53    -j ACCEPT

# Block blacklisted IPs
#
for i in $(</etc/blacklist) ; do
	if [[ "$i" = [0-9]*.*[0-9]*.*[0-9]*.*[0-9]* ]] ; then
		/sbin/iptables -I INPUT -s "$i" -j DROP
	else
		echo "$i is in a wrong format. Please use an IP instead."
	fi
done

# Activate Firewall

/sbin/iptables -P INPUT DROP