#!/bin/sh
# Firewall Policy of Aliyun Server

IPTABLES=/sbin/iptables
MODPROBE=/sbin/modprobe
INT_INTF=eth0
EXT_INTF=eth1

### flush existing rules and set chain policy setting to DROP
echo "[+] Flushing existing iptables rules..."
$IPTABLES -F
$IPTABLES -F -t nat
$IPTABLES -X
$IPTABLES -P INPUT DROP
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT

### load connection-tracking modules
#
$MODPROBE ip_conntrack
$MODPROBE iptable_nat
$MODPROBE ip_conntrack_ftp
$MODPROBE ip_nat_ftp

###### INPUT chain ######
#
echo "[+] Setting up INPUT chain..."

### make sure that loopback traffic is accepted
$IPTABLES -A INPUT -i ${INT_INTF} -j ACCEPT
$IPTABLES -A OUTPUT -o ${INT_INTF} -j ACCEPT

### state tracking rules
$IPTABLES -A INPUT -m conntrack --ctstate INVALID -j LOG --log-prefix "DROP INVALID " --log-ip-options --log-tcp-options
$IPTABLES -A INPUT -m conntrack --ctstate INVALID -j DROP
$IPTABLES -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

### ACCEPT rules for allowing connections out
$IPTABLES -A INPUT -i ${EXT_INTF} -p tcp --dport 2015 -m conntrack --ctstate NEW -m comment --comment "SSH rule" -j ACCEPT
$IPTABLES -A INPUT -i ${EXT_INTF} -p tcp -m multiport --dport 80,443 -m conntrack --ctstate NEW -j ACCEPT
$IPTABLES -A INPUT -i ${EXT_INTF} -p icmp --icmp-type 8 -m limit --limit 3/m --limit-burst 5 -j ACCEPT
$IPTABLES -A INPUT -i ${EXT_INTF} -p icmp -j DROP

### Rules save
/sbin/service iptables save >/dev/null
echo "[+] Save rules..."
