#!/bin/bash
# This should only need to be run once and should reset iptables to my own 'default' values.

# This will clear previous entries
iptables -F
ip6tables -F
iptables -X
ip6tables -X

# Automatically stop all communication.
iptables -P INPUT DROP
ip6tables -P INPUT DROP
iptables -P FORWARD DROP
ip6tables -P FORWARD DROP
iptables -P OUTPUT DROP
ip6tables -P OUTPUT DROP

# These are permaaccepted addresses.
iptables -A INPUT -i lo -j ACCEPT
ip6tables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
ip6tables -A OUTPUT -o lo -j ACCEPT


# These are permabanned addresses.
iptables -A INPUT --source 218.65.30.43 -j RETURN
iptables -A INPUT --source 153.99.182.23 -j RETURN

# Allow any established connections.
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -s 192.168.1.11 -j ACCEPT
iptables -A OUTPUT -s 192.168.1.11 -j ACCEPT

# Allow icmp connectoins
iptables -A INPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT

# Allow emerge --sync
iptables -A INPUT -p TCP --dport 873 -j ACCEPT
iptables -A OUTPUT -p TCP --dport 873 -j ACCEPT

# Needed emerge IP addresses
iptables -A INPUT -s 200.236.31.1 -j ACCEPT
iptables -A OUTPUT -s 200.236.31.1 -j ACCEPT

# Allow ssh
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport ssh -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A INPUT -p tcp -s 192.168.1.0/24 --sport ssh -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -p tcp -s 192.168.1.0/24 --dport ssh -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -p tcp -s 192.168.1.0/24 --sport ssh -m state --state NEW,ESTABLISHED -j ACCEPT

# Allow webserver
#iptables -A INPUT -p TCP --dport http -j ACCEPT
#iptables -A OUTPUT -p TCP --dport http -j ACCEPT
iptables -A INPUT -p TCP --dport https --syn -m conntrack --ctstate NEW -j ACCEPT
iptables -A OUTPUT -p TCP --dport https --syn -m conntrack --ctstate NEW -j ACCEPT

# Allow ftp
iptables -A INPUT -p TCP -s 192.168.1.0/24 --dport ftp -j ACCEPT
iptables -A OUTPUT -p TCP -s 192.168.1.0/24 --dport ftp -j ACCEPT
iptables -A INPUT -p TCP -s 192.168.1.0/24 --dport sftp -j ACCEPT
iptables -A OUTPUT -p TCP -s 192.168.1.0/24 --dport sftp -j ACCEPT

# DNS server
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --sport 53 -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 53 -j ACCEPT

# Plex server
iptables -A INPUT -p tcp --dport 32400 -j ACCEPT # Plex REQUIRED server
iptables -A INPUT -p udp --dport 1900 -j ACCEPT # Plex DLNA server
iptables -A INPUT -p tcp --dport 3005 -j ACCEPT # Plex Home Theater companion
iptables -A INPUT -p udp --dport 5353 -j ACCEPT # Bonjour/Avahi discovery
iptables -A INPUT -p tcp --dport 8324 -j ACCEPT # Plex Roku companion
iptables -A INPUT -p udp --dport 32410 -j ACCEPT # GDM network discovery
iptables -A INPUT -p udp --dport 32412 -j ACCEPT # GDM network discovery
iptables -A INPUT -p udp --dport 32413 -j ACCEPT # GDM network discovery
iptables -A INPUT -p udp --dport 32414 -j ACCEPT # GDM network discovery
iptables -A INPUT -p tcp --dport 32469 -j ACCEPT # Plex DLNA server

iptables -A OUTPUT -p tcp --dport 32400 -j ACCEPT # Plex REQUIRED server
iptables -A OUTPUT -p udp --dport 1900 -j ACCEPT # Plex DLNA server
iptables -A OUTPUT -p tcp --dport 3005 -j ACCEPT # Plex Home Theater companion
iptables -A OUTPUT -p udp --dport 5353 -j ACCEPT # Bonjour/Avahi discovery
iptables -A OUTPUT -p tcp --dport 8324 -j ACCEPT # Plex Roku companion
iptables -A OUTPUT -p udp --dport 32410 -j ACCEPT # GDM network discovery
iptables -A OUTPUT -p udp --dport 32412 -j ACCEPT # GDM network discovery
iptables -A OUTPUT -p udp --dport 32413 -j ACCEPT # GDM network discovery
iptables -A OUTPUT -p udp --dport 32414 -j ACCEPT # GDM network discovery
iptables -A OUTPUT -p tcp --dport 32469 -j ACCEPT # Plex DLNA server

# Samba server
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 137 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 138 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 139 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 445 -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.1.0/24 --dport 445 -j ACCEPT

# Speedtest ports
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT

# Restart fail2ban
/etc/init.d/fail2ban stop
/etc/init.d/fail2ban start