#!/bin/sh

PATH=/sbin:/usr/sbin:/bin:/usr/bin ; export PATH

ipchains -P input DENY
ipchains -P forward DENY
ipchains -P output ACCEPT

#anti-spoofing
ipchains -A input -s 127.0.0.1/255.255.255.255 -d 0/0 ! -i lo -j DENY -l -b
ipchains -A input -s 172.16.0.0/255.240.0.0 -d 0/0 -j DENY -l -b
ipchains -A input -s 192.168.0.0/255.255.0.0 -d 0/0 -j DENY -l -b
ipchains -A input -s 10.0.0.0/255.0.0.0 -j DENY -l -b

#UDP returns
#DNS
ipchains -A input -s 0/0 53:53 -d 0/0 1024:65535 -p 17 -j ACCEPT
#NTP
ipchains -A input -s 158.152.1.65/255.255.255.255 123:123 -d 0/0 123:123 -p 17 -j ACCEPT
ipchains -A input -s 194.159.253.2/255.255.255.255 123:123 -d 0/0 123:123 -p 17 -j ACCEPT

#Open loopback wide (doesn't need to be but is relatively safe)
ipchains -A input -i lo -j ACCEPT

#ICMP-handling: pong not ping, other useful
ipchains -A input -s 0/0 0:0 -d $hostname -p 1 -j ACCEPT
ipchains -A input -s 0/0 3:3 -d $hostname 0:13 -p 1 -j ACCEPT -l
ipchains -A input -s 0/0 4:4 -d $hostname -p 1 -j ACCEPT -l
ipchains -A input -s 0/0 11 -d $hostname 0:1 -p 1 -j ACCEPT -l

#Open holes
ipchains -A input -d 0/0 10022:10022 -p 6 -j ACCEPT
ipchains -A input -d $hostname 53:53 -p 17 -j ACCEPT
ipchains -A input -d $hostname 25:25 -p 6 -j ACCEPT
ipchains -A input -d $hostname 80:80 -p 6 -j ACCEPT
ipchains -A input 22:22 -d 0/0 -p 6 -j ACCEPT ! -y
ipchains -A input -d 0/0 22:22 -p 6 -j ACCEPT

#Identd
ipchains -A input -s 0/0 -d 0/0 113:113 -p 6 -j REJECT -l

#TCP continuations
ipchains -A input -s 0/0 -d 0/0 1024:65535 -p 6 -j ACCEPT ! -y

#Silently drop samba
ipchains -A input -s 0/0 -d 0/0 137:139 -p 17 -j DENY
ipchains -A input -s 0/0 -d 0/0 137:139 -p 6 -j DENY

#catch-all
ipchains -A input -j DENY -l

#Forwarding
ipchains -A forward -s 10.0.0.0/24 -j MASQ
ipchains -A forward -j DENY -l

#output
#anti-spoof only
ipchains -A output -s 192.168.0.0/16 -j DENY -b
ipchains -A output -s 172.16.0.0/12  -j DENY -b
ipchains -A output -s 127.0.0.0/8    -j DENY -b