#!/bin/sh

# prevent SYN floods from consuming memory resources
echo "1" > /proc/sys/net/ipv4/tcp_syncookies

# no ICMP
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all

# no spoofing
if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]
  then
    for filtre in /proc/sys/net/ipv4/conf/*/rp_filter
  do
    echo 1 > $filtre
  done
fi 

# handles FTP better
modprobe ip_conntrack_ftp

# policy for default chains
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# flush (remove) all rules from default chains
iptables -F INPUT 
iptables -F FORWARD 
iptables -F OUTPUT 

# remove all custom chains
iptables -X

# allow traffic for sessions which are already established
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# open the loopback address for all traffic
iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT


# console message
echo "Port-based firewall rules:    /etc/rc.d/rc.easywall:"
echo "  enabling all OUTPUT traffic"