#!/bin/sh

#Change the part after the = to the where you IPTABLES is on your system
IPTABLES=/sbin/iptables

case "$1" in
  start|reload|restart)
        #flush existing rules
        ${IPTABLES} -F INPUT

        #This allows all data that has been sent out to get reply's back.
        ${IPTABLES} -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p icmp
        ${IPTABLES} -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p tcp
        ${IPTABLES} -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p udp

        #Allow incoming SSH requests
        ${IPTABLES} -A INPUT -p tcp --dport ssh -j ACCEPT

        #Allow incoming NTP - Disabled because I'm not running a time server:)
        #${IPTABLES} -A INPUT -p udp --dport ntp -j ACCEPT

        #Allow incoming netbios and microsoft-ds for Samba
        #Someday I might experiement to see which of these is actually required.
        #so I can close off the rest.
        ${IPTABLES} -A INPUT -p tcp --dport netbios-ssn -j ACCEPT
        ${IPTABLES} -A INPUT -p tcp --dport microsoft-ds -j ACCEPT
        ${IPTABLES} -A INPUT -p udp --dport netbios-ns -j ACCEPT
        ${IPTABLES} -A INPUT -p udp --dport netbios-dgm -j ACCEPT

        #Allow incoming ipp connections for network printing
        ${IPTABLES} -A INPUT -p tcp --dport ipp -j ACCEPT
        ${IPTABLES} -A INPUT -p udp --dport ipp -j ACCEPT

        #Drop and log all other data
        #The logging is set so if more than 5 packets are dropped in
        #three seconds they will be ignored. This helps to prevent a DOS attack
        #Crashing the computer the firewall is running on
        ${IPTABLES} -A INPUT -m limit --limit 3/second --limit-burst 5 -i ! lo -j LOG
        ${IPTABLES} -A INPUT -i ! lo -j DROP
        ;;
  stop)
        #flush existing rules
        ${IPTABLES} -F INPUT
        ;;
  status)
        ${IPTABLES} -L -v -n
        ;;
  *)
        echo "Usage: $0 {start|restart|reload|stop|status}"
        exit 1
esac

exit 0