#!/bin/bash

# flush all the chains on three tables
iptables -F
iptables -F -t nat
iptables -F -t mangle

# delete any custom chain on three tables
iptables -X
iptables -X -t nat
iptables -X -t mangle

# policy
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# allow icmp
iptables -A INPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT

# reject loopback traffic outside loopback interface
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT ! -o lo -d 127.0.0.0/8 -j REJECT

# allow some inbound tcp ports
#iptables -A INPUT -p tcp -m state --state NEW --dport 21 -j ACCEPT
#iptables -A INPUT -p tcp -m state --state NEW --match multiport --dports 50000:50099 -j ACCEPT
#apparently --dport supports range by itself
#iptables -A INPUT -p tcp -m state --state NEW --dport 50000:50099 -j ACCEPT

# allow established inbound connections
#iptables -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT
#iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

# allow outbound traffic
#iptables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#iptables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED,RELATED,INVALID -j ACCEPT
#iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED,RELATED,INVALID -j ACCEPT

# enforcing the existing policy w/ REJECT
iptables -A INPUT -j REJECT
iptables -A FORWARD -j REJECT
iptables -A OUTPUT -j REJECT

# XEN
#iptables -A FORWARD -m physdev --physdev-out pierregw.1 --physdev-is-bridged -j ACCEPT
#iptables -A FORWARD -m physdev --physdev-in pierregw.1 --physdev-is-bridged -j ACCEPT
#iptables -A FORWARD -m physdev --physdev-out pierregw.0 --physdev-is-bridged -j ACCEPT
#iptables -A FORWARD -m physdev --physdev-in pierregw.0 --physdev-is-bridged -j ACCEPT

# pass all on eth1
#iptables -A INPUT -i eth1 -j ACCEPT
#iptables -A INPUT -i xenbr1 -j ACCEPT
#iptables -A OUTPUT -o eth1 -j ACCEPT
#iptables -A OUTPUT -o xenbr1 -j ACCEPT