#!/bin/sh
#
# FTP server firewall rules

# These lines are here in case rules are already in place and the script is ever rerun on the fly.
# We want to remove all rules and pre-exisiting user defined chains and zero the counters
# before we implement new rules.
iptables -t filter -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
iptables -Z

# Set up a default DROP policy for the built-in chains.
# If we modify and re-run the script mid-session then (because we have a default DROP
# policy), what happens is that there is a small time period when packets are denied until
# the new rules are back in place. There is no period, however small, when packets we
# don't want are allowed.
iptables -P INPUT ACCEPT
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow ssh access
iptables -A INPUT -p tcp -m tcp -s 0/0 --dport ssh -j ACCEPT

# Allow incoming ftp access
iptables -A INPUT -p tcp -m tcp --syn --dport ftp -j ACCEPT

# TODO: fix this
# Allow passive mode ftp connections
# this rule, actually, allows every established tcp connection
iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT

# Allow http access so users can access the ftp thru web browser
iptables -A INPUT -p tcp --dport http -j ACCEPT

# Allow loopback use
iptables -A INPUT -i lo -j ACCEPT

#testing
iptables -A INPUT -p tcp -i ppp0 -m tcp --dport 21 -j LOG --log-prefix "TESTE FTP: "
# iptables -A INPUT -p tcp -i ppp0 -m tcp --dport 21 -j ACCEPT

# Reject everything else
iptables -A INPUT -p tcp -m tcp -j REJECT --syn

# Log attempts
iptables -A INPUT -p tcp -j LOG --log-prefix "FIREWALL DROPPED: "