Simple firewall script

firewall

#!/bin/bash
### BEGIN INIT INFO
# Provides:          firewall
# Required-Start:    $local_fs $syslog $time networking
# Required-Stop:     $local_fs $syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Start firewall.
### END INIT INFO

# just allow (space separated)
allow_input_tcp="http https"
allow_input_udp=""

# allow and log (space separated)
allow_input_tcp_logged="ssh"
allow_input_udp_logged=""

deny_icmp_replies=0


function start()
{
        case $1 in
        4)
                IPTABLES=iptables
                DIR=ipv4
                #${IPTABLES} -t nat -F
                ;;
        6)      IPTABLES=ip6tables
                DIR=ipv4
                ;;
        esac
                
        ${IPTABLES} -F

        ${IPTABLES} -P INPUT DROP
        ${IPTABLES} -P OUTPUT ACCEPT
        ${IPTABLES} -P FORWARD DROP

        # count packets for munin
        #${IPTABLES} -I INPUT -d <ip>
        #${IPTABLES} -I OUTPUT -s <ip>

        # we want to know what's being dropped
        ${IPTABLES} -N log-input
        ${IPTABLES} -A log-input -m limit --limit 5/minute --limit-burst 5 -j UL
OG --ulog-nlgroup 1 --ulog-prefix '[FW DROP INPUT] :' > /dev/null 2>&1
        ${IPTABLES} -A log-input -j DROP

        # and selectively when it's accepted
        ${IPTABLES} -N log-accept
        ${IPTABLES} -A log-accept -m limit --limit 5/minute --limit-burst 5 -j U
LOG --ulog-nlgroup 1 --ulog-prefix '[FW ACCEPTED] :' > /dev/null 2>&1
        ${IPTABLES} -A log-accept -j ACCEPT

        ${IPTABLES} -A INPUT -p icmp -j ACCEPT

        ${IPTABLES} -A INPUT -i lo -j ACCEPT

        ${IPTABLES} -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

        for i in $allow_input_tcp
        do
                ${IPTABLES} -A INPUT -p tcp --dport $i -j ACCEPT
        done

        for i in $allow_input_udp
        do
                ${IPTABLES} -A INPUT -p udp --dport $i -j ACCEPT
        done

        for i in $allow_input_tcp_logged
        do
                ${IPTABLES} -A INPUT -p tcp --dport $i -j log-accept
        done

        for i in $allow_input_udp_logged
        do
                ${IPTABLES} -A INPUT -p udp --dport $i -j log-accept
        done

        # ${IPTABLES} -A INPUT -p udp --dport 1024:65535 -j ACCEPT

        ${ACTION} ${IPTABLES} -A INPUT -j log-input

        echo 1 > /proc/sys/net/$DIR/icmp_echo_ignore_broadcasts
        echo 0 > /proc/sys/net/$DIR/icmp_echo_ignore_all
        echo 0 > /proc/sys/net/$DIR/tcp_timestamps
        echo 0 > /proc/sys/net/$DIR/ip_forward
        echo 1 > /proc/sys/net/$DIR/tcp_syncookies
}

function stop()
{
        case $1 in
        4)
                IPTABLES=iptables
                DIR=ipv4
                ;;
        6)      IPTABLES=ip6tables
                DIR=ipv4
                ;;
        esac

        ${IPTABLES} -P INPUT ACCEPT
        ${IPTABLES} -P OUTPUT ACCEPT
        ${IPTABLES} -P FORWARD ACCEPT
        ${IPTABLES} -F
        ${IPTABLES} -X
}

case $1 in
        start)
                echo Starting firewall.
                start 4
                start 6
                ;;

        stop)
                echo Stopping firewall.
                stop 4
                stop 6
                ;;

        restart)
                $0 stop
                $0 start
                ;;

        default)
                echo USAGE: $0 [start|stop|restart]
                ;;
esac