#!/bin/sh

IPTABLES=/sbin/iptables

# Tell the kernel that we don't want to
# do ipforwarding. We are not a router,
# so all ipforwarding can be disabled at
# the kernel level.
echo "0" > /proc/sys/net/ipv4/ip_forward

# Tell the kernel that we don't want to acccept source
# routing info.
# "Source routing is rarely essential.... The danger with
# source routing is that an attacker can misuse it in an 
# attempt to force two machines to communicate through a 
# router under the attacker's control, allowing him to sniff 
# the data.... Because of this, source routing is deprecated, 
# and many firewalls and routers are configured by default 
# to drop source-routed packets."
# --Peter G. Smith, p. 110, Linux Network Security,
# Charles River Media, 2005.
echo "0" > /proc/sys/net/ipv4/conf/eth0/accept_source_route

# Clean out any iptables rules

# Flush all tables.
$IPTABLES --table filter --flush
$IPTABLES --table nat --flush
$IPTABLES --table mangle --flush
# Delete all chains in all tables.
$IPTABLES --table filter --delete-chain
$IPTABLES --table nat --delete-chain
# Zero out all counters.
$IPTABLES --table filter --zero
$IPTABLES --table nat --zero
$IPTABLES --table mangle --zero

# Open up all traffic everywhere.

$IPTABLES --table filter --policy INPUT ACCEPT
$IPTABLES --table filter --policy OUTPUT ACCEPT
# With accept_source_route 0, I assume the next
# policy is superfluous.
$IPTABLES --table filter --policy FORWARD ACCEPT

$IPTABLES --table nat --policy PREROUTING ACCEPT
$IPTABLES --table nat --policy OUTPUT ACCEPT
$IPTABLES --table nat --policy POSTROUTING ACCEPT

$IPTABLES --table mangle --policy PREROUTING ACCEPT
$IPTABLES --table mangle --policy OUTPUT ACCEPT



