#!/bin/bash
#define variables
INTERFACES="lo eth0 eth1 ath0 wifi0"
SERVICES="ftp ssh rsync"
INT =""
EXT = "eth0"
#if you assign *anything* to the INT variable, 
#you can use that to automatically determine if the system should be a router. 
  if [ "$1" = "start" ]
 then
 	echo "Starting firewall..."
# Flush all existing chains and erase personal chains
CHAINS=`cat /proc/net/ip_tables_names 2>/dev/null`
for i in $CHAINS;
do
 $IPT -t $i -F
done
for i in $CHAINS;
do
 $IPT -t $i -X
done
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
#creating rules
 	iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    iptables -P OUTPUT ACCEPT
 	#enable services
 	for x in ${SERVICES}
 	do
 		iptables -A INPUT -p tcp --dport ${x} -m state --state NEW -j  ACCEPT
 	done
 	
 	     iptables -A INPUT -p udp -i ${EXT}-j REJECT --reject-with  icmp-port-unreachable
 	#hide our firewall
	     iptables -A INPUT -p tcp -i  ${EXT}-j REJECT --reject-with tcp-reset
         iptables -A INPUT -p udp -i ${EXT} -j REJECT --reject-with icmp-port-unreachable
 	
	# disable ECN
 	if [ -e /proc/sys/net/ipv4/tcp_ecn ]
 	then
 		echo 0 > /proc/sys/net/ipv4/tcp_ecn
 	fi   
 
 	#disable spoofing on all interfaces
 	for x in ${INTERFACES} 
 	do	
 		echo 1 > /proc/sys/net/ipv4/conf/${x}/rp_filter     
 	done
    	echo 1 > /proc/sys/net/ipv4/ip_forward
		
		 elif [ "$1" = "stop" ]
 then
 	echo "Stopping firewall..."
 	iptables -F INPUT
 	iptables -P INPUT ACCEPT
 	 fi