#!/bin/bash
IP=/sbin/iptables



$IP -F
$IP -X
$IP -t nat -F
$IP -t nat -X
$IP -t mangle -F
$IP -t mangle -X
$IP -P INPUT DROP
$IP -A INPUT -i lo -j ACCEPT
$IP -A OUTPUT -o lo -j ACCEPT
$IP -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IP -A INPUT -m state --state INVALID -j DROP
$IP -A INPUT -p tcp --dport 22 -j ACCEPT
$IP -A INPUT -p tcp --dport 80 -j ACCEPT
$IP -A INPUT -p tcp --dport 443 -j ACCEPT
$IP -A INPUT -p tcp --dport 15570 -j ACCEPT
$IP -A INPUT -p tcp -m multiport --dport 20,21,25,110,143,993,995,1723 -j ACCEPT
$IP -A INPUT -p tcp --dport 25000:30000 -j ACCEPT
$IP -A INPUT -p tcp --dport 3306 -j DROP
$IP -A INPUT -p icmp -m limit --limit 3/s -j ACCEPT
$IP -A INPUT -p icmp -j DROP

#Drop access website 
#$IP -A INPUT -p tcp --dport 80 -s 213.238.175.29 -j DROP


# pptp setting

$IP -I INPUT -p udp -m multiport --dport 1723 -j ACCEPT
#$IP -t nat -A POSTROUTING -s 172.16.254.0/24 -o eth1 -j SNAT --to-source 121.40.125.206
$IP -t nat -A POSTROUTING -s 172.16.254.0/24 -o eth1 -j MASQUERADE
#$IP -t nat -A POSTROUTING -s 172.16.254.0/24 -o eth0 -j SNAT --to-source 10.171.249.36



/sbin/service iptables save
/sbin/service iptables restart 
echo "iptables is restart!"
