#!/bin/bash
# My very simple iptables firewall
# This is intended to give basic protection to a network

# load some needed kernel modules
#modprobe ip_conntrack
#modprobe ip_conntrack_ftp
#modprobe ip_conntrack_irc

# temporarily allow everything to make sure we don't drop any connections
# while we change the rules. connections might be dropped anyway the first
# time you run the script after a reboot, since connection states
# won't be aviable.
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT

# remove previous rules
iptables -F

# always allow connections to localhost
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Enable transparent proxy
#iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

# always allow connections to/from the local lan
# iptables -A INPUT -i eth0 -s 192.168.10.1/16 -j ACCEPT
# iptables -A OUTPUT -o eth0 -d 192.168.10.1/16 -j ACCEPT

# drop bad connections (port scans, etc) that are marked below
iptables -A INPUT -m recent --name scan --update --seconds 600 --rttl --hitcount 3 -j DROP

# allow connections that are already established
iptables -A OUTPUT -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

# allow new outgoing tcp, udp and icmp connections
iptables -A OUTPUT -p tcp -o eth1 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp -o eth1 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p icmp -o eth1 -m state --state NEW -j ACCEPT

# allow new incoming tcp connections from the internet to selected ports
# currently ssh, http, irc
iptables -A INPUT -p tcp -i eth1 --dport 22 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp -i eth1 --dport 25565 -m state --state NEW -j ACCEPT

# reject ident instead of dropping, to speed up connecting to irc
iptables -A INPUT -p tcp -i eth1 --dport 113 -m state --state NEW -j REJECT --reject-with tcp-reset

# incoming connections that have reached this points are possibly port scan
# attempts or otherwise bad. mark those ips here so they can be blocked.
iptables -A INPUT -i eth1 -m recent --name scan --set -j DROP

# set default policies
# ignore everything
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP


# Allow established connections, and those not coming from the outside
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow outgoing connections from the LAN side.
# iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

# Masquerade.
# iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

# Don't forward from the outside to the inside.
iptables -A FORWARD -i eth1 -o eth1 -j REJECT

# Enable routing.
# echo 1 > /proc/sys/net/ipv4/ip_forward