#!/bin/bash
#define variables
 INTERFACES="lo eth0 eth1 ath0 wifi0"
 SERVICES="ftp ssh rsync"
 UPLINK="eth0"
 ROUTER="yes"
 
 
 if [ "$1" = "start" ]
 then
 	echo "Starting firewall..."

# Flush all existing chains and erase personal chains
CHAINS=`cat /proc/net/ip_tables_names 2>/dev/null`
for i in $CHAINS;
do
 $IPT -t $i -F
done
for i in $CHAINS;
do
 $IPT -t $i -X
done
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

    #creating rules
 	iptables -A INPUT -i ${UPLINK}  -j ACCEPT
 	iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 
 	#enable services
 	for x in ${SERVICES}
 	do
 		iptables -A INPUT -p tcp --dport ${x} -m state --state NEW -j  ACCEPT
 	done
 	
 	     iptables -A INPUT -p udp -i ${UPLINK} -j REJECT --reject-with  icmp-port-unreachable
 	#hide our firewall
	     iptables -A INPUT -p tcp -i eth1 -j REJECT --reject-with tcp-reset
         iptables -A INPUT -p udp -i eth1 -j REJECT --reject-with icmp-port-unreachable
 	
	# disable ECN
 	if [ -e /proc/sys/net/ipv4/tcp_ecn ]
 	then
 		echo 0 > /proc/sys/net/ipv4/tcp_ecn
 	fi   
 
 	#disable spoofing on all interfaces
 	for x in ${INTERFACES} 
 	do	
 		echo 1 > /proc/sys/net/ipv4/conf/${x}/rp_filter     
 	done
	
	if [ "$ROUTER" = "yes" ]
 	then
 		# IP forwarding
 		echo 1 > /proc/sys/net/ipv4/ip_forward
		
		 elif [ "$1" = "stop" ]
 then
 	echo "Stopping firewall..."
 	iptables -F INPUT
 	iptables -P INPUT ACCEPT
 	 fi