#!/bin/sh

IPT="/sbin/iptables"

wan_if="ppp+"
lan_if="eth0"

lan="192.168.1.1"

wan_to_me_allow_tcp="22"
wan_to_me_allow_udp=""

icmp_allow="destination-unreachable redirect time-exceeded parameter-problem"

chains=`cat /proc/net/ip_tables_names 2>/dev/null`
for i in $chains; do
	$IPT -t $i -F
	$IPT -t $i -X
done

$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT ACCEPT

$IPT -A INPUT -i ! lo -p all -s 127.0.0.0/8 -j DROP
$IPT -A INPUT -i $wan_if -p all -s 10.0.0.0/8 -j DROP
$IPT -A INPUT -i $wan_if -p all -s 172.16.0.0/12 -j DROP
$IPT -A INPUT -i $wan_if -p all -s 192.168.0.0/16 -j DROP
$IPT -A INPUT -i $lan_if -p all -s ! $lan -j DROP

$IPT -A INPUT -m state --state INVALID -j REJECT --reject-with "icmp-admin-prohibited"
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A INPUT -i lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT

if [ -n "$icmp_allow" ]; then
	for type in $icmp_allow; do
		$IPT -A INPUT -p icmp --icmp-type $type -j ACCEPT
	done
fi

if [ -n "$wan_to_me_allow_tcp" ]; then
	for port in $wan_to_me_allow_tcp; do
		$IPT -A INPUT -p tcp -i $wan_if --dport $port -j ACCEPT
	done
fi

if [ -n "$wan_to_me_allow_udp" ]; then
	for port in $wan_to_me_allow_udp; do
		$IPT -A INPUT -p udp -i $wan_if --dport $port -j ACCEPT
	done
fi

$IPT -A INPUT -i $lan_if -p udp -s 192.168.1.1 -d 192.168.1.2 --dport 123 -j ACCEPT
