#!/bin/sh
# Start/stop/restart my iptables configuration for server.
#

start() {

iptables -F

# default policy
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# enable all lookback packets
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# disable all fragment packets
iptables -A INPUT -f -j DROP

# enable services:
iptables -A INPUT -p tcp --dport ssh -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport ssh -m state --state ESTABLISHED -j ACCEPT

# enalbe ping me
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT

# other

}

resume_all() {

# enable all
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

}

stop() {

iptables -F

}


case "$1" in
'start')
	start
	;;
'stop')
	stop
	resume_all
	;;
'restart')
	stop
	start
	;;
*)
	echo "usage $0 start|stop|restart"
esac