#!/bin/sh
INTERFACE="eth0"
IPTABLES="/sbin/iptables"
#set -x

InTCP()   # srchost dstport
{
  ${IPTABLES} -A INPUT -j ACCEPT -i ${INTERFACE} -p tcp \
   -s $1 --dport $2 -m state --state NEW
}

InUDP()   # srchost dstport
{
  ${IPTABLES} -A INPUT -j ACCEPT -i ${INTERFACE} -p udp \
   -s $1 --dport $2 -m state --state NEW
}

In()    # srchost dstport
{
  InTCP $1 $2
  InUDP $1 $2
}

Filter()
{

    #Drop Koehlers SNMP
    ${IPTABLES} -A filter -j REJECT -i ${INTERFACE} -p udp -s 141.30.66.33 --dport snmp

    #Disable ident lookups
    ${IPTABLES} -A filter -j REJECT -i ${INTERFACE} -p tcp --dport ident

    # Disable Broadcasts
    ${IPTABLES} -A filter -j DROP -i ${INTERFACE} -d 141.30.225.255
    ${IPTABLES} -A filter -j DROP -i ${INTERFACE} -d 255.255.255.255
    ${IPTABLES} -A filter -j DROP -i ${INTERFACE} -d 172.16.255.255

    # Disable Multicasts
    ${IPTABLES} -A filter -j DROP -i ${INTERFACE} -d 224.0.0.0/16

    # Accept Port 80 RST's
    ${IPTABLES} -A filter -j ACCEPT -i ${INTERFACE} -p tcp --tcp-flags ALL RST

    # These rules are only there for logging.
    ${IPTABLES} -A filter -j LOG --log-level notice -m limit

    # And now Kill Them!
    ${IPTABLES} -A filter -j REJECT
}


Start()
{
    echo "Starting Firewall"
    modprobe ip_conntrack_ftp


    ${IPTABLES} -P INPUT DROP 
    ${IPTABLES} -P OUTPUT ACCEPT
    ${IPTABLES} -P FORWARD DROP
    ${IPTABLES} -F
    ${IPTABLES} -F INPUT
    ${IPTABLES} -F OUTPUT
    ${IPTABLES} -F FORWARD
    
    ${IPTABLES} -N filter

    ${IPTABLES} -A INPUT -j ACCEPT -i ${INTERFACE} -m state --state ESTABLISHED,RELATED
    
    ${IPTABLES} -A INPUT  -j ACCEPT -i lo

    InTCP	0/0	ssh		# sshd
    InTCP 	0/0	smtp 		# Mail
    InTCP	0/0	www
    In 		0/0	7001:7010 	# icq
    In		141.30.225.0/24	137:139	# samba
    InTCP	141.30.225.46/32 ftp
    InTCP	141.30.225.3/32 ftp
    
    InUDP	0/0	snmp-trap	# SNMP Traps
    InUDP	0/0	ntalk		# Talk
    In		141.30.225.0/24	ipp	# IPP
    
    # Firewall ICMP. ICMP is useful so allow any by default.
    ${IPTABLES} -A INPUT   -j ACCEPT -p icmp -m limit --limit 20/s

    # Filter & Log & Destroy the unwanted Packets
    Filter
    ${IPTABLES} -A INPUT  -j filter
}

# Kill all rules and open Firewall
Stop()
{
    ${IPTABLES} -P INPUT ACCEPT 
    ${IPTABLES} -P OUTPUT ACCEPT
    ${IPTABLES} -P FORWARD DROP
    ${IPTABLES} -F
    ${IPTABLES} -F INPUT
    ${IPTABLES} -F OUTPUT
    ${IPTABLES} -F FORWARD
    ${IPTABLES} -X filter     > /dev/null 2>&1
}

case "$1" in
   start)
     echo -n "Starting IP filtering... "
     Start
     echo "done."
     ;;
   stop)
     echo -n "Stopping IP filtering... "
     Stop
     echo "done."
     ;;
   *)
     echo "Usage: $0 start|stop"
     exit 1
 esac

 exit 0
