#!/bin/sh
#
# firewall-masq-iptables        This script sets up firewall rules for a machine
#                               acting as a masquerading gateway
#
#                                    
#                                    
#
# Copyright (C) 2002 ALT Linux Team.  This software may be distributed under the terms
# of the GNU General Public License, version 2 or any later version.

# Interface to Internet

EXTIF=ppp+

ANY=0.0.0.0/0

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD

# Syn-flood protection.
#   Syn-flood.
iptables -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
 
# Furtive port scanner.
#     .
iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
 
# Ping of death.
#   Ping of death.
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

# Deny NEW end INVALID incoming or required routings packets from ppp0.
#  NEW  INVALID       ppp0.
iptables -A INPUT -i $EXTIF -m state --state NEW,INVALID -j DROP
iptables -A FORWARD -i $EXTIF -m state --state NEW,INVALID -j DROP

# Allow a packets which is related to, and part of an existing connection.
#         .
iptables -N block
iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A block -m state --state NEW -i ! $EXTIF -j ACCEPT
iptables -A block -j DROP

iptables -A INPUT -j block
iptables -A FORWARD -j block

# Do masquerading.
#  ppp0.
iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

#   .
echo 1 > /proc/sys/net/ipv4/ip_forward
