#!/bin/bash

##### DROP ALL POLICY
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

##### Flush all rules then enable forwarding and nating
/sbin/iptables -F
/sbin/iptables -F PREROUTING -t nat

/bin/echo "1" > /proc/sys/net/ipv4/ip_forward
/bin/echo "0" > /proc/sys/net/ipv4/ip_dynaddr

## DISABLE IPV6 IF WE ARE NOT USING IT
/bin/echo 1 > /proc/sys/net/ipv6/conf/ens32/disable_ipv6
/bin/echo 1 > /proc/sys/net/ipv6/conf/lo/disable_ipv6
/usr/sbin/sysctl -w net.ipv6.conf.all.disable_ipv6=1

## STATEFUL RULES

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


##### DROP ALL CRAZY KIDDIE HACKS LIKE SYN FLOODS, FRAGMENTED & CHRISMAS TREE STUFF

# Drop new connections unless they are SYN

/sbin/iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

# Drop fragmented packets

/sbin/iptables -A INPUT -f -j DROP

# Drop XMAS packets

/sbin/iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

# Drop NULL packets

/sbin/iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

# SUPREMLY DUMB SPAMMERS - THEY ARE ON MY S-LIST

iptables -A INPUT -s 75.102.22.112  -j DROP

# WORLD INBOUND SSH
# /sbin/iptables -A INPUT -p tcp  --dport 22 -m state --state NEW -j ACCEPT

#### YUM UPDATE OUTBOUND SERVICES - TIME BASED
/sbin/iptables -A OUTPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -m time --timestart 2:32 --timestop 3:35 --kerneltz -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --dport 443 -m state --state NEW,ESTABLISHED,RELATED -m time --timestart 2:32 --timestop 3:35 --kerneltz -j ACCEPT

### OUTBOUND SERVICES - FULL TIME OPEN
/sbin/iptables -A OUTPUT -p tcp -i lo -d 127.0.0.1 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --dport 8140 -m state --state NEW -d 192.168.200.88 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --dport 55415 -m state --state NEW -d 192.168.200.99 -j ACCEPT
/sbin/iptables -A OUTPUT -p udp --dport 53 -m state --state NEW -d 192.168.200.86 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --dport 53 -m state --state NEW -d 192.168.200.86 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --dport 8080 -m state --state NEW -d 192.168.200.73 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --dport 514 -m state --state NEW -d 192.168.200.20 -j ACCEPT
# /sbin/iptables -A OUTPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT
# /sbin/iptables -A OUTPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT

# WORLD INBOUND SERVICES
/sbin/iptables -A INPUT -p tcp --dport 443 -m state --state NEW -m limit --limit 30/minute --limit-burst 30 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m limit --limit 30/minute --limit-burst 30 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 35621 -m state --state NEW -s 192.168.200.99 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 35623 -m state --state NEW -s 192.168.200.99 -j ACCEPT

# INBOUND ICMP REPLIES
iptables -A INPUT -p icmp --icmp-type 8 -s 0/0  -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# INBOUND ALLOWED FROM INTERNAL
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -N LOGDROP
/sbin/iptables -A LOGDROP -j LOG --log-prefix "SSH BRUTE FORCE ATTEMPT "
/sbin/iptables -A LOGDROP -j DROP
/sbin/iptables -A INPUT -p tcp -s 192.168.200.0/24 --dport 22 -m state --state NEW -m recent --set --name SSH
/sbin/iptables -A INPUT -p tcp -s 192.168.200.0/24 --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 --rttl --name SSH -j LOGDROP
/sbin/iptables -A INPUT -p tcp -s 192.168.200.0/24 --dport 22 -m state --state NEW -j LOG --log-prefix "NEW SSH CONN "
/sbin/iptables -A INPUT -p tcp -s 192.168.200.0/24 --dport 22 -m state --state NEW -j ACCEPT

# INBOUND ICMP ALLOW

iptables -A INPUT -p ICMP -m limit --limit 10/minute --limit-burst 3 -j ACCEPT

#### CLEAN UP RULES
/sbin/iptables -A INPUT -m limit --limit 10/minute --limit-burst 3 -j LOG --log-prefix "INPUT CLEANUP RULE"
/sbin/iptables -A FORWARD -m limit --limit 10/minute --limit-burst 3 -j LOG --log-prefix "FORWARD CLEANUP RULE"
/sbin/iptables -A OUTPUT -m limit --limit 10/minute --limit-burst 3 -j LOG --log-prefix "OUTPUT CLEANUP RULE"
