#!/bin/bash

[ -x $IPTABLES ] || exit 43

# ----------------------------- filter out chain -------------------------------

    $IPTABLES -F filter_out_global

# ------------------------------ filter in chain -------------------------------

    $IPTABLES -F filter_in_global

    # Protect against common attacks
    $IPTABLES -A filter_in_global -p tcp ! --syn -m state --state NEW -j DROP  # NEW packets should be SYN
    $IPTABLES -A filter_in_global -f -j DROP                                   # IP fragmentation attack

    $IPTABLES -A filter_in_global -p tcp --tcp-flags ACK,FIN FIN -j DROP
    $IPTABLES -A filter_in_global -p tcp --tcp-flags ACK,PSH PSH -j DROP
    $IPTABLES -A filter_in_global -p tcp --tcp-flags ACK,URG URG -j DROP
    $IPTABLES -A filter_in_global -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
    $IPTABLES -A filter_in_global -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
    $IPTABLES -A filter_in_global -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
    $IPTABLES -A filter_in_global -p tcp --tcp-flags ALL ALL -j DROP           # XMAS packets
    $IPTABLES -A filter_in_global -p tcp --tcp-flags ALL NONE -j DROP          # NULL packets
    $IPTABLES -A filter_in_global -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
    $IPTABLES -A filter_in_global -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
    $IPTABLES -A filter_in_global -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

    # Protect against fake loopback connections
    SPOOF="0.0.0.0/8 127.0.0.0/8"
    for spoofip in $SPOOF; do
        $IPTABLES -A filter_in_global -p all -s $spoofip -j DROP
    done

    # ICMP PING allowed
    $IPTABLES -A filter_in_global -p icmp --icmp-type echo-request -m limit --limit 10/s -j ACCEPT

    # -----------------------------------------------------------------------------

    #SSH
    $IPTABLES -A filter_in_global -p tcp --dport 222 -j ACCEPT

    #identd -> REJECT [needed, but DROP if not]
    $IPTABLES -A filter_in_global -p tcp --dport 113 -m limit --limit 4/s  -j REJECT
