Firewall Simples

#!/bin/sh -e
### BEGIN INIT INFO
# Provides:          firewall
# Required-Start:    networking
# Required-Stop:
# Default-Start:     S
# Default-Stop:      0 6
# Short-Description: Sets up the firewall
# Description:       Sets up the firewall
### END INIT INFO

IPTABLES=/sbin/iptables

#
# Reset everything
#

$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD


#############################################################
###        INPUT RULES: Block almost everything           ###
#############################################################

$IPTABLES -P INPUT DROP


#
# localhost and localnetwork connections
#
$IPTABLES -A INPUT -s 127.0.0.1/32       -j ACCEPT

#
#
# ICMP packets
#
$IPTABLES -A INPUT -p icmp --icmp-type echo-reply                -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type echo-request              -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type destination-unreachable   -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type time-exceeded             -j ACCEPT

#
# Established outgoing TCP connections
#
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT


## ssh - 3 conections per 10 minutes
$IPTABLES -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 600 --hitcount 3 --name SSH -j DROP
$IPTABLES -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH

#
# incoming connections through TCP
#
$IPTABLES -A INPUT -p tcp --dport auth     -j REJECT
$IPTABLES -A INPUT -p tcp --dport ssh      -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport ftp      -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport ftp-data -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport www      -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport smtp     -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport submission -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport imap2    -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport pop-3    -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport snmp     -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport domain   -j ACCEPT

#
# incoming UDP packets
#

$IPTABLES -A INPUT -p udp --dport domain   -j ACCEPT
$IPTABLES -A INPUT -p udp --dport snmp     -j ACCEPT


#############################################################
###          FORWARD RULES: Accept everything             ###
#############################################################

$IPTABLES -P FORWARD ACCEPT


#############################################################
###           OUTPUT RULES: Accept everything             ###
#############################################################

$IPTABLES -P OUTPUT ACCEPT