IP Tables with TUN VPN

#!/bin/sh

# $IPT script : 0.2

IPT="/sbin/iptables"
TUN0_IP=$(ifconfig tun0 | awk '/t addr:/{gsub(/.*:/,"",$2);print$2}')

# Flush old rules, old custom tables
echo "Stopping firewall and allowing everyone.."
$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT

# set default policy to drop
echo "Setting default policies.."
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP

# allow loopback
echo "Allow loopback.."
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

# https://arashmilani.com/post?id=53
# allow VPN to tun0 etc.
echo "Allow VPN to TUN0 on $TUN0_IP."
$IPT -A INPUT -i tun+ -j ACCEPT
$IPT -A FORWARD -i tun+ -j ACCEPT
$IPT -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -t nat -A POSTROUTING -s $TUN0_IP/24 -o eth0 -j MASQUERADE
$IPT -A OUTPUT -o tun+ -j ACCEPT

# drop invalid packets
echo "Drop invalid packets.."
$IPT -A INPUT  -m state --state INVALID -j DROP
$IPT -A OUTPUT -m state --state INVALID -j DROP
$IPT -A FORWARD -m state --state INVALID -j DROP

# allow established, related packets we've already seen
echo "Allow established connections.."
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# input chain
echo "Allow inbound port 22.."
$IPT -A INPUT -p tcp --dport 22 -m state --state NEW -s 0.0.0.0/0 -m comment --comment "SSH" -j ACCEPT
$IPT -A INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 123 -m comment --comment "NTP" -j ACCEPT
$IPT -A INPUT -p tcp --dport 6881:6999 -m comment --comment "BITTORRENT" -j ACCEPT

# output chain
echo "Permit the following on the output chain.."
$IPT -A OUTPUT -p tcp -m tcp --dport 21 -m comment --comment "FTP" -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp --dport 22 -m comment --comment "SSH" -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp --dport 53 -m comment --comment "DNS-TCP" -j ACCEPT
$IPT -A OUTPUT -p udp -m udp --dport 53 -m comment --comment "DNS-UDP" -j ACCEPT
$IPT -A OUTPUT -p udp -m udp --dport 67:68 -m comment --comment "DHCP" -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp --dport 80 -m comment --comment "HTTP" -j ACCEPT
$IPT -A OUTPUT -p udp -m udp --dport 123 -m comment --comment "NTP" -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp --dport 389 -m comment --comment "LDAP" -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp --dport 443 -m comment --comment "HTTPS" -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp --dport 465 -m comment --comment "SMTPS" -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp --dport 587 -m comment --comment "SMTPS" -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp --dport 636 -m comment --comment "LDAPS" -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp --dport 993 -m comment --comment "IMAPS" -j ACCEPT
$IPT -A OUTPUT -p tcp --source-port 6881:6999 -m comment --comment "BITTORRENT" -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp --dport 8080 -m comment --comment "HTTP-PROXY" -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp --dport 9000 -m comment --comment "HTTP-PORTAINER" -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp --dport 9100 -m comment --comment "PRINTING" -j ACCEPT

# allow icmp packets (e.g. ping...)
echo "Allow ICMP.."
$IPT -A INPUT -p icmp -m state --state NEW -j ACCEPT
$IPT -A OUTPUT -p icmp -m state --state NEW -j ACCEPT

# Enable logging
echo "Allow logging of dropped packets.."
$IPT -N LOGGING
$IPT -A INPUT -j LOGGING
$IPT -A OUTPUT -j LOGGING
$IPT -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
$IPT -A LOGGING -j DROP

echo "Finished."