#!/bin/sh
#
# rc.firewall
#

IPT=/usr/sbin/iptables

###############################
# Load modules
#

echo "Loading kernel modules..."
modprobe ip_tables
modprobe ip_conntrack
modprobe iptable_filter
modprobe ipt_state
modprobe ip_conntrack_ftp

echo "Flushing rules..."
$IPT -F INPUT
$IPT -F OUTPUT

if [ "$1" == "stop" ]; then
	$IPT -P INPUT ACCEPT
	$IPT -P OUTPUT ACCEPT
	echo
	echo "*** Rules flushed - now running with no firewall!"
	echo
	exit
fi

###############################
# Rules for incoming packets
#

echo "Applying INPUT rules..."

# Default policy: Deny everything there isn't a rule for
$IPT -P INPUT DROP

# Allow computer to access itself via loopback interface
$IPT -A INPUT -i lo -j ACCEPT

# Allow "related" packets
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow inbound SSH
$IPT -A INPUT -p tcp --destination-port 22 -j ACCEPT

# Allow inbound Samba
$IPT -A INPUT -p udp --dport 137:138 -j ACCEPT
$IPT -A INPUT -p tcp -m multiport --dports 139,445 -j ACCEPT

###############################
# Rules for outgoing packets
#

echo "Applying OUTPUT rules..."

# Default policy: Allow everything there isn't a rule for
$IPT -P OUTPUT ACCEPT

echo "Firewall up."