#ip 192.168.168.123
IPTABLES=/usr/sbin/iptables
test -x $IPTABLES || exit 5
if [ -z "$1" ];then
set start
fi
#Case statment
case "$1" in
start)
echo "Looding config "
#load module
modprobe ip_tables
#clearn rule's
$IPTABLES --flush
$IPTABLES --delete-chain
#set default rule for chain
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
#accept loopback
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT
#$IPTABLES -A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "spoof"
#$IPTABLES -A INPUT -s 255.0.0.0/8 -j DROP
#$IPTABLES -A INPUT -s 0.0.0.0/8 -j LOG --log-prefix "spoof"
#iptalbes -A INPUT -s 0.0.0.0/8 -j DROP
#$IPTABLES -A INPUT -s 192.168.168.100 -LOG --log-prefix "spoof"
#$IPTABLES -A INPUT -s 192.168.168.100 -j DROP
#$IPTABLES -A INPUT -s 192.168.0.0/16 -LOG --log-prefix "spoof"
#$IPTABLES -A INPUT -s 192.168.0.0/16 -j DROP
#Access from ip 192.168.168.108
$IPTABLES -A INPUT -p tcp -j ACCEPT -s 192.168.168.108 --dport 21 -m state --state NEW
$IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "spoof2"
$IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
#allow 22,21,80
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
$IPTABLES -A INPUT -p tcp -j ACCEPT --dport 22 -m state --state NEW
$IPTABLES -A INPUT -p tcp -j ACCEPT --dport 21 -m state --state NEW
$IPTABLES -A INPUT -p tcp -j ACCEPT --dport 80 -m state --state NEW
$IPTABLES -A INPUT -j LOG --log-prefix "Droped by default"
#outgoing chain rule
$IPTABLES -I OUTPUT 1 -m state --state RELATED,ESTABLISHED -j ACCEPT
#stop ping after firewall configure corect
#$IPTABLES -A OUTPUT -p icmp -j ACCEPT --icmp-type echo request
$IPTABLES -A OUTPUT -p udp --dport 53 -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -j LOG --log-prefix "Droped by default"
;;
open_allow)
echo "Danger!!!"
$IPTABLES --flush
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
;;
stop)
echo -n "Clean and set default politics"
$IPTABLES --flush
$IPTABLES --delete-chain
;;
status)
echo -e "Query of $IPTABLES is\n"
$IPTABLES --line-number -v --list
;;
*)
echo "This not agrument!!!"
exit 1
;;
esac