# Set default Policy
iptables -P INPUT   DROP
iptables -P FORWARD DROP
iptables -P OUTPUT  DROP

echo -e "* set default policy.."

# full connection from loopback
iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

echo -e "* set loopback device.."

# full connection from localnet
iptables -A INPUT  -i eth0 -j ACCEPT
iptables -A OUTPUT -o eth0 -j ACCEPT
iptables -A INPUT  -i eth1 -j ACCEPT
iptables -A OUTPUT -o eth1 -j ACCEPT

echo -e "* set localnet access.."

# connection from internet
# only established connection from internet is allowed
iptables -A INPUT   -i ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT  -o ppp0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# allow forward for established connection
iptables -A FORWARD -i ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -o ppp0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Drop bogus TCP packets
iptables -A INPUT -i ppp0 -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -i ppp0 -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP

# Defeat DDoS
iptables -A INPUT -p tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 1/s --limit-burst 10 -j RETURN
iptables -A INPUT -p tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 1/s --limit-burst 10 -j LOG --log-prefix "[DDoS?]: "
iptables -A INPUT -p tcp --tcp-flags SYN,RST,ACK SYN -j DROP
iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

# Protect SSH BruteForce
iptables -A INPUT -i ppp0 -p tcp --syn -m limit --limit 1/m --limit-burst 3 --dport 22 -j ACCEPT
iptables -A INPUT -i ppp0 -p tcp --syn -m limit --limit 1/m --limit-burst 3 --dport 22 -j LOG --log-prefix SSH-DROP:
iptables -A INPUT -i ppp0 -p tcp --syn --dport 22 -j DROP

# Protect SYN
iptables -A INPUT -i ppp0 -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT
iptables -A INPUT -i ppp0 -p tcp --syn -m limit --limit 1/s --limit-burst 3 --dport ! 6881 -j LOG --log-prefix SYN-DROP:
iptables -A INPUT -i ppp0 -p tcp --syn -j DROP

# Limiting the incoming icmp ping request:
iptables -A INPUT -i ppp0 -p icmp -m icmp --icmp-type address-mask-request -j DROP
iptables -A INPUT -i ppp0 -p icmp -m icmp --icmp-type timestamp-request -j DROP
iptables -A INPUT -i ppp0 -p icmp -m limit --limit 1/s --limit-burst 1 -j ACCEPT
iptables -A INPUT -i ppp0 -p icmp -m limit --limit 1/s --limit-burst 1 -j LOG --log-prefix PING-DROP:
iptables -A INPUT -i ppp0 -p icmp -j DROP

# port redirected to squid webcache
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.254:3128
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

echo -e "* set internet access (outbound - inbound).."
echo -e "Starting Firewall: done \n"