# Clean old iptables 
iptables -F 
iptables -X 
iptables -Z

# Default forward policy to DROP


iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD ACCEPT

# Loopback - Allow unlimited traffic
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Fragments : Don't trust the little buggers. Send 'em to hell.
######iptables -A INPUT -f -j LOG --log-level debug --log-prefix "IPTABLES FRAGMENTS: "

# Refuse spoofed packets claiming to be the loopback
#iptables -A INPUT -d 127.0.0.0/8 -j DROP

iptables -A INPUT -i eth0 -p tcp ! --syn -m state --state NEW -j DROP

# Allow BootP/DHCP UDP requests

iptables -A INPUT -p udp  --dport 67:68 -j ACCEPT
# DNS Allow UDP packets in for DNS client from nameservers
iptables -A INPUT -p udp  --sport 53 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp  --dport 53 -j ACCEPT

#### TCP, log & drop
###iptables -A INPUT -i eth0 -p tcp -j LOG --log-level debug --log-prefix "IPTABLES TCP-IN: "
###iptables -A INPUT -i eth0 -p tcp -j DROP

# SSH 
# allow all sshd incoming connections (including the port fw)
iptables -A INPUT -p tcp -m tcp --dport 2222 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# FTP
# allow all ftpd incoming connections
iptables -A INPUT -p tcp   --dport 21 -j ACCEPT
# Enable active ftp transfers 
iptables -A INPUT -p tcp   --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Enable passive ftp transfers
iptables -A INPUT -p tcp   --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Enable ident probes (IRC)
iptables -t filter -A INPUT -p tcp   --dport 113 -j ACCEPT

# Allow ICMP in if it is related to other connections
iptables -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT

# LOGGING:

# UDP, log & drop
#iptables -A INPUT -i eth0 -p udp -j LOG --log-level debug --log-prefix "IPTABLES UDP-IN: "
#iptables -A INPUT -i eth0 -p udp -j DROP

# ICMP, log & drop
######iptables -A INPUT -i eth0 -p icmp -j LOG --log-level debug --log-prefix "IPTABLES ICMP-IN: "
iptables -A INPUT -i eth0 -p icmp -j DROP

# Windows NetBIOS noise, log & drop
######iptables -A INPUT -i eth0 -p tcp  --sport 137:139 -j LOG --log-level debug --log-prefix "IPTABLES NETBIOS-IN: "
iptables -A INPUT -i eth0 -p tcp  --sport 137:139 -j DROP

#### VLC
iptables -A INPUT -p igmp -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 1234 -m state --state NEW -j ACCEPT
iptables -A INPUT -d 224.2.127.254/32 -p udp -m udp --dport 9875 -j ACCEPT

#### Boinc
iptables -A INPUT -p tcp -m tcp --dport 1234 -m state --state NEW -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 31416 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 33103 -j ACCEPT

# HTTP
# allow all http/https incoming/return connections
iptables -A INPUT -p tcp -s 0/0 --sport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -s 0/0 --sport 443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -d 0/0 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -d 0/0 --dport 443 -j ACCEPT


# Anything else not allowed, log & drop
######iptables -A INPUT -j LOG --log-level debug --log-prefix "IPTABLES UNKNOWN-IN: "

iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -j DROP
  echo "Firewall rules applied!"
  trap - 2 3