#!/bin/bash

# Enable TCP SYN Cookie Protection
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

# Enable broadcast echo Protection
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

# Disable Source Routed Packets
for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
   echo 0 > $f
done

# Disable ICMP Redirect Acceptance
for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
   echo 0 > $f
done

# Don't send Redirect Messages
for f in /proc/sys/net/ipv4/conf/*/send_redirects; do
   echo 0 > $f
done

# Drop Spoofed Packets coming in on an interface, which if replied to,
# would result in the reply going out a different interface.
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
   echo 1 > $f
done

# The interface that connect Internet
  EXTIF="ppp0"

set `ip route ls | awk '/ppp0.*src/ {print $1 " " $9}'`
# gateway of ppp0
ppp0_gw=$1
# IP of ppp0
ppp0_ip=$2

  INIF=""
  INNET="192.168.1.0/24"	# This is for NAT's network

  PATH=/sbin:/bin:/usr/sbin:/usr/bin
  export PATH EXTIF INIF INNET
  modprobe ip_tables		> /dev/null 2>&1
  modprobe iptable_nat		> /dev/null 2>&1
  modprobe ip_nat_ftp		> /dev/null 2>&1
  modprobe ip_nat_irc		> /dev/null 2>&1
  modprobe ip_conntrack		> /dev/null 2>&1
  modprobe ip_conntrack_ftp	> /dev/null 2>&1
  modprobe ip_conntrack_irc	> /dev/null 2>&1

  /sbin/iptables -F
  /sbin/iptables -X
  /sbin/iptables -Z
  /sbin/iptables -F -t nat
  /sbin/iptables -X -t nat
  /sbin/iptables -Z -t nat
  /sbin/iptables -P INPUT   DROP
  /sbin/iptables -P OUTPUT  ACCEPT
  /sbin/iptables -P FORWARD ACCEPT
  /sbin/iptables -t nat -P PREROUTING  ACCEPT
  /sbin/iptables -t nat -P POSTROUTING ACCEPT
  /sbin/iptables -t nat -P OUTPUT      ACCEPT

  # Unlimited traffic on the loopback interface
  /sbin/iptables -A INPUT -i lo -j ACCEPT

############################################################
# Stealth Scans and TCP State Flags
# All of the bits are cleared
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

# SYN and FIN are both set
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

# SYN and RST are both set
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

# FIN and RST are both set
iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP

# FIN is the only bit set, without the expected accompanying ACK
iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP

# PSH is the only bit set, without the expected accompanying ACK
iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP

# URG is the only bit set, without the expected accompanying ACK
iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
############################################################

# Using Connection State to By-pass Rule Checking
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

/sbin/iptables -A INPUT -m state --state INVALID -j DROP
/sbin/iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
############################################################
# Source Address Spoofing and Other Bad Addresses

# Refuse spoofed packets pretending to be from
# the external interface's IP address
/sbin/iptables -A INPUT -i $EXTIF -s $ppp0_ip -j DROP

# Refuse packets claiming to be from a Class A private network
/sbin/iptables -A INPUT -i $EXTIF -s 10.0.0.0/8 -j DROP

# Refuse packets claiming to be from a Class B private network
/sbin/iptables -A INPUT -i $EXTIF -s 172.16.0.0/12 -j DROP

# Refuse packets claiming to be from a Class C private network
/sbin/iptables -A INPUT -i $EXTIF -s 192.168.0.0/16 -j DROP

# Refuse packets claiming to be from a Class D multicast addresses
/sbin/iptables -A INPUT -i $EXTIF -s 224.0.0.0/4 -j DROP

# Refuse packets claiming to be from a Class E reserved IP addresses
/sbin/iptables -A INPUT -i $EXTIF -s 240.0.0.0/5 -j DROP

# Refuse packets claiming to be from the loopback interface
/sbin/iptables -A INPUT -i $EXTIF -s 127.0.0.0/8 -j DROP

# Refuse addresses defined as reserved by the IANA
/sbin/iptables -A INPUT -i $EXTIF -s 0.0.0.0/8 -j DROP
/sbin/iptables -A INPUT -i $EXTIF -s 169.254.0.0/16 -j DROP
/sbin/iptables -A INPUT -i $EXTIF -s 192.0.2.0/24 -j DROP

# Refuse malformed broadcast packets
/sbin/iptables -A INPUT -i $EXTIF -s 255.255.255.255 -j DROP
/sbin/iptables -A INPUT -i $EXTIF -d 0.0.0.0 -j DROP
############################################################

# Start NAT Server
  if [ "$INIF" != "" ]; then
	/sbin/iptables -A INPUT -i $INIF -j ACCEPT
	echo "1" > /proc/sys/net/ipv4/ip_forward
	/sbin/iptables -t nat -A POSTROUTING -s $INNET -o $EXTIF -j MASQUERADE
  fi

  AICMP="0 3 3/4 4 11 12 14 16 18"
  for tyicmp in $AICMP
  do
	/sbin/iptables -A INPUT -i $EXTIF -p icmp --icmp-type $tyicmp -j ACCEPT
  done

#  /sbin/iptables -A INPUT -p TCP -i $EXTIF --dport  22 -j ACCEPT	# SSH
#  /sbin/iptables -A INPUT -p TCP -i $EXTIF --dport  25 -j ACCEPT	# SMTP
#  /sbin/iptables -A INPUT -p UDP -i $EXTIF --dport  53 -j ACCEPT	# DNS
#  /sbin/iptables -A INPUT -p TCP -i $EXTIF --dport  53 -j ACCEPT	# DNS
#  /sbin/iptables -A INPUT -p TCP -i $EXTIF --dport  80 -j ACCEPT	# WWW
#  /sbin/iptables -A INPUT -p TCP -i $EXTIF --dport 110 -j ACCEPT	# POP3
#  /sbin/iptables -A INPUT -p TCP -i $EXTIF --dport 113 -j ACCEPT	# auth