#!/bin/sh

IPTABLES=/sbin/iptables

# Tell the kernel that we don't want to
# do ipforwarding. We are not a router,
# so all ipforwarding can be disabled at
# the kernel level.
echo "0" > /proc/sys/net/ipv4/ip_forward

# Tell the kernel that we don't want to acccept source
# routing info.
# "Source routing is rarely essential.... The danger with
# source routing is that an attacker can misuse it in an 
# attempt to force two machines to communicate through a 
# router under the attacker's control, allowing him to sniff 
# the data.... Because of this, source routing is deprecated, 
# and many firewalls and routers are configured by default 
# to drop source-routed packets."
# --Peter G. Smith, p. 110, Linux Network Security,
# Charles River Media, 2005.
echo "0" > /proc/sys/net/ipv4/conf/eth0/accept_source_route

# Clean out any iptables rules

# Flush all tables.
$IPTABLES --table filter --flush
$IPTABLES --table nat --flush
$IPTABLES --table mangle --flush
# Delete all chains in all tables.
$IPTABLES --table filter --delete-chain
$IPTABLES --table nat --delete-chain
# Zero out all counters.
$IPTABLES --table filter --zero
$IPTABLES --table nat --zero
$IPTABLES --table mangle --zero

# Open up all traffic everywhere.

$IPTABLES --table filter --policy INPUT ACCEPT
$IPTABLES --table filter --policy OUTPUT ACCEPT
# With accept_source_route 0, I assume the next
# policy is superfluous.
$IPTABLES --table filter --policy FORWARD ACCEPT

$IPTABLES --table nat --policy PREROUTING ACCEPT
$IPTABLES --table nat --policy OUTPUT ACCEPT
$IPTABLES --table nat --policy POSTROUTING ACCEPT

$IPTABLES --table mangle --policy PREROUTING ACCEPT
$IPTABLES --table mangle --policy OUTPUT ACCEPT

# Allow only incoming traffic on eth0 from already-established
# connections. Hence, no new connections can start from outside;
# new connections can only begin from the inside.
$IPTABLES --table filter --append INPUT --in-interface eth0 --match state --state ESTABLISHED,RELATED --jump ACCEPT

# Here are the exceptions to the rule above. These rules
# define which connections are allowed to start from the outside.

# ssh connections can originate from outside, but only from
# this ip address ranges.
# *** WARNING *** If you just open up ssh access to all ip addresses,
# script kiddies *will* try to launch dictionary attacks trying
# to logon via ssh; *only* allow incoming ssh traffic from ip address
# ranges you trust!
$IPTABLES --table filter --append INPUT --in-interface eth0 --source 165.96.0.0/16 --protocol tcp --destination-port 22 --jump ACCEPT
$IPTABLES --table filter --append INPUT --in-interface eth0 --source 109.6.0.0/16 --protocol tcp --destination-port 22 --jump ACCEPT
$IPTABLES --table filter --append INPUT --in-interface eth0 --source 164.34.162.151 --protocol tcp --destination-port 22 --jump ACCEPT

# https connections to our apache/svn server running on a non-standard port can originate from outside.
$IPTABLES --table filter --append INPUT --in-interface eth0 --protocol tcp --destination-port 8003 --jump ACCEPT

# https connections to our apache/bugzilla server running on a non-standard port can originate from outside.
$IPTABLES --table filter --append INPUT --in-interface eth0 --protocol tcp --destination-port 8001 --jump ACCEPT

# https connections to our demo/proofing server can originate from outside.
$IPTABLES --table filter --append INPUT --in-interface eth0 --protocol tcp --destination-port 8006 --jump ACCEPT

# Drop any other incoming packets on eth0.
$IPTABLES --table filter --append INPUT --in-interface eth0 --jump DROP


