echo "[x] Flushing existing iptables rules..."
$IPTABLES -F                #flush all rules in the filter table
$IPTABLES -F -t nat         #flush all rules in the nat tables
$IPTABLES -X                #remove all chains outside of the default chains
$IPTABLES -P INPUT DROP     #Set default target for INPUT chain
$IPTABLES -P OUTPUT DROP    #Set default target for OUTPUT chain
$IPTABLES -P FORWARD DROP   #Set default target for FORWARD chain

######### INPUT chain   ###########
echo "[x] Setting up INPUT chain..."

$IPTABLES -A INPUT -m state --state INVALID -j LOG --log-prefix "DROP INVALID " --log-ip-options --log-tcp-options
$IPTABLES -A INPUT -m state --state INVALID -j DROP
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

### anti-spoofing rules ###

#$IPTABLES -A INPUT -i $LAN ! -s  $INT_NET -j LOG --log-prefix "SPOOFED PKT "
#$IPTABLES -A INPUT -i $LAN ! -s  $INT_NET -j DROP

### ACCEPT rules ###

$IPTABLES -I INPUT \! --src 12.96.160.84 -m tcp -p tcp --dport 80 -j DROP
#$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 2345 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 53 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 25 -j ACCEPT



##default INPUT LOG rule ###
$IPTABLES -A INPUT  -j LOG --log-prefix "MISC DROP " --log-ip-options --log-tcp-options

######### END INPUT CHAIN ##########


######## OUTPUT CHAIN #########

echo "[x] Setting up OUTPUT chain..."

### state tracking rules ###

$IPTABLES -A OUTPUT -m state --state INVALID -j LOG --log-prefix "DROP INVALID  " --log-ip-options --log-tcp-options
$IPTABLES -A OUTPUT -m state --state INVALID -j DROP
$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

### ACCEPT rules for allowing connections out  ####
### These would be the only ports that could also be port scanned???##

$IPTABLES -A OUTPUT -p tcp --syn --dport 21  -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --syn --dport 2345  -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --syn --dport 80 -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --syn --dport 443 -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --syn --dport 22  -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --syn --dport 43  -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --syn  --dport 25 -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p udp --dport 53  -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT

### default OUTPUT LOG rule ####
$IPTABLES -A OUTPUT ! -o lo -j LOG --log-prefix "MISC DROP " --log-ip-options --log-tcp-options