#! /bin/sh
# maths router: netfilter setup
# eth0 - maths
# eth1 - internet

# flush the rules
iptables -F

# drop all input packets by default
iptables -P INPUT DROP

# accept all output
iptables -P OUTPUT ACCEPT

# drop all forward packets by default
iptables -P FORWARD DROP

# loopback:
iptables -A INPUT -i lo -j ACCEPT

# maths side
iptables -A INPUT -i eth0 -j ACCEPT

## internet input

iptables --new-chain internet_input
iptables -A INPUT -i eth1 -j internet_input

#accept already accepted
iptables -A internet_input -m state --state RELATED,ESTABLISHED -j ACCEPT

# ospf
iptables -A internet_input -p 89 -m state --state NEW -j ACCEPT

# ssh
iptables -A internet_input -s <trusted-network> -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

iptables -A internet_input -p icmp --icmp-type echo-request -j ACCEPT
iptables -A internet_input -j REJECT

# routing:

iptables --new-chain forward_allow

iptables -A FORWARD -j forward_allow

# accept what was already accepted
iptables -A forward_allow -m state --state RELATED,ESTABLISHED -j ACCEPT

# ssh
iptables -A forward_allow -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

# http
iptables -A forward_allow -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

#https
iptables -A forward_allow -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT

# smtp
iptables -A forward_allow -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT

# smtp over ssl
iptables -A forward_allow -p tcp -m state --state NEW -m tcp --dport 465 -j ACCEPT

# jet direct
iptables -A forward_allow -s <trusted-network> -p tcp -m state --state NEW -m tcp --dport 9100 -j ACCEPT

# reject the rest
iptables -A forward_allow -j REJECT