#!/bin/bash -e -u

# Clear existing rules.
iptables -F
iptables -t nat -F
iptables -t mangle -F

# Set defaults.
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP

# Allow loopback.
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow responses to outbound traffic.
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Log inbound TCP connections.
iptables -A INPUT -p tcp --tcp-flags SYN SYN -j LOG