Simple iptables configuration script

firewall.sh

#!/bin/sh

IPT=/sbin/iptables

case "$1" in
start)
$IPT -F INPUT # Flush Input
$IPT -F OUTPUT # Flush Output
$IPT -F FORWARD # Flush Forward

$IPT -P INPUT DROP # Input Policy
$IPT -P OUTPUT ACCEPT # Output Policy
$IPT -P FORWARD DROP # Forward Policy

$IPT -A INPUT -i lo -j ACCEPT # Loopback
$IPT -A OUTPUT -o lo -j ACCEPT

#$IPT -A INPUT -i eth0 -p tcp --dport 7 -j ACCEPT # echo
#$IPT -A INPUT -i eth0 -p udp --dport 7 -j ACCEPT
#$IPT -A INPUT -i eth0 -p tcp --dport 20 -j ACCEPT # ftp-data
#$IPT -A INPUT -i eth0 -p tcp --dport 21 -j ACCEPT # ftp
$IPT -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT # ssh
$IPT -A INPUT -i eth0 -p udp --dport 22 -j ACCEPT
#$IPT -A INPUT -i eth0 -p tcp --dport 53 -j ACCEPT # DNS
#$IPT -A INPUT -i eth0 -p udp --dport 53 -j ACCEPT
$IPT -A INPUT -i eth0 -p tcp --dport 79 -j ACCEPT # finger
$IPT -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT # http
$IPT -A INPUT -i eth0 -p udp --dport 80 -j ACCEPT
$IPT -A INPUT -i eth0 -p tcp --dport 115 -j ACCEPT # sftp
#$IPT -A INPUT -i eth0 -p tcp --dport 161 -j ACCEPT # snmp
#$IPT -A INPUT -i eth0 -p udp --dport 161 -j ACCEPT
#$IPT -A INPUT -i eth0 -p tcp --dport 162 -j ACCEPT # snmp-trap
#$IPT -A INPUT -i eth0 -p udp --dport 162 -j ACCEPT
$IPT -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT # https
$IPT -A INPUT -i eth0 -p udp --dport 443 -j ACCEPT
#$IPT -A INPUT -i eth0 -p tcp --dport 989 -j ACCEPT # ftps-data
#$IPT -A INPUT -i eth0 -p tcp --dport 990 -j ACCEPT # ftps
#$IPT -A INPUT -i eth0 -p tcp --dport 1194 -j ACCEPT # openvpn
#$IPT -A INPUT -i eth0 -p udp --dport 1194 -j ACCEPT
#$IPT -A INPUT -i eth0 -p tcp --dport 3306 -j ACCEPT # mysql
#$IPT -A INPUT -i eth0 -p udp --dport 3306 -j ACCEPT
#$IPT -A INPUT -i eth0 -p tcp --dport 5432 -j ACCEPT # postgresql
#$IPT -A INPUT -i eth0 -p udp --dport 5432 -j ACCEPT
#$IPT -A INPUT -i eth0 -p tcp --dport 5671 -j ACCEPT # amqps
#$IPT -A INPUT -i eth0 -p tcp --dport 5672 -j ACCEPT # amqp
#$IPT -A INPUT -i eth0 -p udp --dport 5672 -j ACCEPT
$IPT -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT # http-alt
$IPT -A INPUT -i eth0 -p udp --dport 8080 -j ACCEPT
$IPT -A INPUT -i eth0 -p tcp --dport 8081 -j ACCEPT # http-alt 2
$IPT -A INPUT -i eth0 -p udp --dport 8081 -j ACCEPT
$IPT -A INPUT -i eth0 -p tcp --dport 8090 -j ACCEPT # http_alt_alt
$IPT -A INPUT -i eth0 -p udp --dport 8090 -j ACCEPT

$IPT -A INPUT -i eth0 -p icmp -j ACCEPT # ICMP

$IPT -A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT # Established connections
$IPT -A OUTPUT -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT

exit 0
;;

stop)
$IPT -F INPUT # Flush Input
$IPT -F OUTPUT # Flush Output
$IPT -F FORWARD # Flush Forward
exit 0
;;

*)
echo "Usage: firewall {start|stop}"
exit 1
;;

esac