www.wavebourn.com

#!/bin/bash

export ipt=/sbin/iptables

#
#       These source addresses are trusted
#

admnet="1.2.3.0/26 3.4.5.6/30 6.7.8.1 6.7.8.2 9.10.11.12/27"
trusted="192.168.0.0/16 $admnet"

#
#       Only ssh is allowed even for the trusted sources
#

trustedports="22/tcp"

openports="53/tcp 53/udp"

reset()
{
#
#       Clean up.
#

$ipt -F
$ipt -X
$ipt -P INPUT ACCEPT
$ipt -P FORWARD ACCEPT
$ipt -P OUTPUT ACCEPT
}

if [[ ${1:-"NOPARAM"} = "NOPARAM" ]] ; then
        command=NOPARAM
else
        command=$1
fi

case $command in

        off)
                reset;
                /bin/rm -f /var/run/fw;
                exit;
        ;;

        test)
                export ipt="echo iptables";
                echo '# Test mode: no commands are actually executed!'
        ;;

        on)
                :
        ;;
        *)
                commands='off|on|test'
                echo $0 $commands
                exit;
esac

#
#       Now, the actual work (or printout)
#

reset

$ipt -P INPUT DROP
$ipt -P OUTPUT ACCEPT

#
#       For now, just DROP forwards; other hosts may need to forward something
#

$ipt -P FORWARD DROP

#       Open ports from the openports list for everybody

for port in $openports; do
        {
        portnum=${port%%/*};
        proto=${port##*/};
        $ipt -A INPUT -s 0/0 -p $proto --dport $portnum -j ACCEPT;
        }
done

#       Open connections to trustedports from the trusted addresses

for addr in $trusted; do
        {
        for port in $trustedports; do
                {
                portnum=${port%%/*};
                proto=${port##*/};
                $ipt -A INPUT -s $addr -p $proto --dport $portnum -j ACCEPT;
                }
        done;
        }
done

#       Let established connections work

$ipt -A INPUT -m state -p ALL --state ESTABLISHED,RELATED -j ACCEPT;

#       Open up for all packets from localhost: it woulnd't help anyway

$ipt -A INPUT -s 127.0.0.1 -j ACCEPT

#       Finally, let all icmp packets be. Ping me, I dare you!

$ipt -A INPUT -s 0/0 -p icmp -j ACCEPT

echo on > /var/run/fw