#! /bin/sh
#
# i havent found any bugs, but USE IT AT YOUR OWN RISK.
# should work on all modern linux distribs.
#
# this is intended for people who have many services available
# for lan but dont want them to be used through internet.
# (or the other way around:) 
#
# there are four modes: start, stop, paranoid and panic.
# the difference between paranoid and panic is that
# panic switch really denies ALL traffic, when
# paranoid denies incoming service-connections..
#
# !WARNING! dont use paranoid and panic on remote
# machines, as it blocks your access too to them!
#
# naturally, this needs the kernel to be configured for
# firewalling. today almost all default kernels are,
# though.
#
# STEP 1. check the location of ipchains & ifconfig
# STEP 2. specify the interfaces
# STEP 3. specify what to block on interfaces.
# STEP 4. do you want masquerading? (you dont if you
#         dont know what it is!)
# YOU ARE DONE.

# STEP 1
IPCHAINS="/sbin/ipchains"
IFCONFIG="/sbin/ifconfig"

# STEP 2
# interfaces to work on ( if you have only one.. for example ppp0,
# change the first one to be correct and dont use switches 2 and 3
# in STEP 3. )
INTERFACE="eth0"
INTERFACE2="ppp0"

# STEP 3
# 0 = dont block in any interface
# 1 = block ONLY in interface 1
# 2 = block ONLY in interface 2
# 3 = block in BOTH.

BLOCK_FTP=2
BLOCK_HTTP=2
BLOCK_TELNET=2
BLOCK_SSH=2
BLOCK_X=3
BLOCK_IDENT=0
BLOCK_SAMBA=2
BLOCK_NFS=2
BLOCK_RPC=2

# do you want to block pinging of you, but let replys come through so that you can ping others?
# this affects the basic mode, in paranoid this is always on.
BLOCK_ECHO=2

# STEP 4
# change ENABLE_MASQ=0 to 1 to enable.
ENABLE_MASQ=0

# for example, this would masquerade 192.168.0.*
# the lower would masquerade 192.168.*.*
# choose only one (for dummies :))
MASQ=192.168.0.0/24
# MASQ=192.168.0.0/16

# YOU ARE DONE.
# DONT TOUCH ANYTHING BELOW THIS POINT UNLESS VERY 3R33T!
# -------------------------------------------------------------------------------
#
#

IP=`$IFCONFIG $INTERFACE 2>/dev/null |grep inet |cut -d : -f 2 |cut -d " " -f 1`
IP2=`$IFCONFIG $INTERFACE2 2>/dev/null |grep inet |cut -d : -f 2 |cut -d " " -f 1`

IPCHAINSVER=`$IPCHAINS -V | cut -d , -f 1 | cut -d " " -f 2`
SYSTEMTYPE=`cat /proc/sys/kernel/ostype`
SYSTEMVER=`cat /proc/sys/kernel/osrelease`

KERNEL1=`cat /proc/sys/kernel/osrelease | cut -d . -f 1`
KERNEL2=`cat /proc/sys/kernel/osrelease | cut -d . -f 2`

echo
echo "               easychains 1.3                "
echo "+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+"
echo -n "checking for support from kernel.."

if [ ! -f /proc/net/ip_fwchains ];
  then
   echo
   echo
   echo "your kernel does not support ip chains!!"
   echo "either it is older than 2.1.102 and not patched,"
   echo "or it does not have the support compiled in it."
   echo
   exit
  else
   echo -n " ok."
   echo
fi

echo -n "found $SYSTEMTYPE $SYSTEMVER"
echo -n "    found ipchains $IPCHAINSVER"

                if [ "$KERNEL1" = "2" ] && [ "$KERNEL2" = "0" ];
                   then
                     echo "using 2.0 kernels can cause problems.."
                fi

                if [ "$KERNEL1" = "2" ] && [ "$KERNEL2" = "1" ];
                   then
                     echo "using 2.1 kernels can cause problems.."
                fi

               if [ ! -z "`$IFCONFIG $INTERFACE 2>/dev/null | grep UP`" ];
                  then
                    echo
                    echo -n "$INTERFACE="
                    echo -n "$IP"
                  else
                    echo
                    echo -n "$INTERFACE=not found"
               fi
       
               if [ ! -z "`$IFCONFIG $INTERFACE2 2>/dev/null | grep UP`" ];
                  then
                    echo -n "    $INTERFACE2="
                    echo -n "$IP2"
                    echo
                  else
                    echo -n "     $INTERFACE2=not found"
                    echo
               fi

       case "$1" in
           start)
                echo "flushing old rules.."
                  $IPCHAINS --flush

                echo "setting basic policies.."
                  $IPCHAINS -P input ACCEPT
                  $IPCHAINS -P forward DENY
                  $IPCHAINS -P output ACCEPT

                if [ "$ENABLE_MASQ" = "1" ];
                   then
                    echo 1 > /proc/sys/net/ipv4/ip_forward
                    echo "setting timeout values for masq.."
                    $IPCHAINS -M -S 7200 10 60
                    echo "masquerading from $MASQ.."
                    $IPCHAINS -A forward -s $MASQ -j MASQ
                else
                    echo "masquerading not enabled.."
                fi

                # TOS values are not widely supported, but it doesnt hurt if
                # they are set. (these only tell your ISP how to treat your
                # data.. e.g. minimum delay)
                echo "setting tos values.."
    
                  #$IPCHAINS -A output -p tcp -d 0/0 www -t 0x01 0x10
                  $IPCHAINS -A output -p tcp -d 0/0 telnet -t 0x01 0x10
                  #$IPCHAINS -A output -p tcp -d 0/0 ftp -t 0x01 0x10   
                  $IPCHAINS -A output -p tcp -d 0/0 6660:6670 -t 0x01 0x10
                  $IPCHAINS -A output -p tcp -d 0/0 ftp-data -t 0x01 0x08

                echo "turning on packet filtering.. "
                     sleep 1

                if [ "$BLOCK_X" = "1" ];
                then
                  $IPCHAINS -A input -i $INTERFACE -p tcp -s 0/0 --destination-port 6000:6010 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p udp -s 0/0 --destination-port 6000:6010 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p udp -s 0/0 --destination-port 7100 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p tcp -s 0/0 --destination-port 7100 -j DENY
                fi
                
                if [ "$BLOCK_X" = "2" ];
                then
                  $IPCHAINS -A input -i $INTERFACE2 -p tcp -s 0/0 --destination-port 6000:6010 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p udp -s 0/0 --destination-port 6000:6010 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p udp -s 0/0 --destination-port 7100 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p tcp -s 0/0 --destination-port 7100 -j DENY
                fi

                if [ "$BLOCK_X" = "3" ];
                then
                  $IPCHAINS -A input -i $INTERFACE -p tcp -s 0/0 --destination-port 6000:6010 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p udp -s 0/0 --destination-port 6000:6010 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p tcp -s 0/0 --destination-port 6000:6010 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p udp -s 0/0 --destination-port 6000:6010 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p udp -s 0/0 --destination-port 7100 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p tcp -s 0/0 --destination-port 7100 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p udp -s 0/0 --destination-port 7100 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p tcp -s 0/0 --destination-port 7100 -j DENY
                fi

                if [ "$BLOCK_FTP" = "1" ];
                then
                  $IPCHAINS -A input -i $INTERFACE -p tcp -s 0/0 --destination-port 20:21 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p udp -s 0/0 --destination-port 20:21 -j DENY
                fi

                if [ "$BLOCK_FTP" = "2" ];
                then
                  $IPCHAINS -A input -i $INTERFACE2 -p tcp -s 0/0 --destination-port 20:21 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p udp -s 0/0 --destination-port 20:21 -j DENY
                fi
                
                if [ "$BLOCK_FTP" = "3" ];
                then
                  $IPCHAINS -A input -i $INTERFACE -p tcp -s 0/0 --destination-port 20:21 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p tcp -s 0/0 --destination-port 20:21 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p udp -s 0/0 --destination-port 20:21 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p udp -s 0/0 --destination-port 20:21 -j DENY
                fi

                if [ "$BLOCK_HTTP" = "1" ];
                then
                  $IPCHAINS -A input -i $INTERFACE -p tcp -s 0/0 --destination-port 80 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p udp -s 0/0 --destination-port 80 -j DENY
                fi
                
                if [ "$BLOCK_HTTP" = "2" ];
                then
                  $IPCHAINS -A input -i $INTERFACE2 -p tcp -s 0/0 --destination-port 80 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p udp -s 0/0 --destination-port 80 -j DENY
                fi
                
                if [ "$BLOCK_HTTP" = "3" ];
                then
                  $IPCHAINS -A input -i $INTERFACE -p tcp -s 0/0 --destination-port 80 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p tcp -s 0/0 --destination-port 80 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p udp -s 0/0 --destination-port 80 -j DENY   
                  $IPCHAINS -A input -i $INTERFACE2 -p udp -s 0/0 --destination-port 80 -j DENY   
                fi

                if [ "$BLOCK_TELNET" = "1" ];
                then
                  $IPCHAINS -A input -i $INTERFACE -p tcp -s 0/0 --destination-port 23 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p udp -s 0/0 --destination-port 23 -j DENY
                fi

                if [ "$BLOCK_TELNET" = "2" ];
                then
                  $IPCHAINS -A input -i $INTERFACE2 -p tcp -s 0/0 --destination-port 23 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p udp -s 0/0 --destination-port 23 -j DENY
                fi

                if [ "$BLOCK_TELNET" = "3" ];
                then
                  $IPCHAINS -A input -i $INTERFACE -p tcp -s 0/0 --destination-port 23 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p tcp -s 0/0 --destination-port 23 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p udp -s 0/0 --destination-port 23 -j DENY 
                  $IPCHAINS -A input -i $INTERFACE2 -p udp -s 0/0 --destination-port 23 -j DENY
                fi

                if [ "$BLOCK_SSH" = "1" ];
                then
                  $IPCHAINS -A input -i $INTERFACE -p tcp -s 0/0 --destination-port 22 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p udp -s 0/0 --destination-port 22 -j DENY
                fi

                if [ "$BLOCK_SSH" = "2" ];
                then
                  $IPCHAINS -A input -i $INTERFACE2 -p tcp -s 0/0 --destination-port 22 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p udp -s 0/0 --destination-port 22 -j DENY
                fi

                if [ "$BLOCK_SSH" = "3" ];
                then
                  $IPCHAINS -A input -i $INTERFACE -p tcp -s 0/0 --destination-port 22 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p tcp -s 0/0 --destination-port 22 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p udp -s 0/0 --destination-port 22 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p udp -s 0/0 --destination-port 22 -j DENY
                fi

                if [ "$BLOCK_ECHO" = "1" ];
                  then $IPCHAINS -A input -i $INTERFACE -s 0/0 8 -p icmp -j DENY
                fi

                if [ "$BLOCK_ECHO" = "2" ];
                  then $IPCHAINS -A input -i $INTERFACE2 -s 0/0 8 -p icmp -j DENY
                fi

                if [ "$BLOCK_ECHO" = "3" ];
                then 
                  $IPCHAINS -A input -i $INTERFACE -s 0/0 8 -p icmp -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -s 0/0 8 -p icmp -j DENY
                fi

                if [ "$BLOCK_SAMBA" = "1" ];
                then
                  $IPCHAINS -A input -i $INTERFACE -s 0/0 --destination-port 137:139 -p tcp -j DENY
                  $IPCHAINS -A input -i $INTERFACE -s 0/0 --destination-port 137:139 -p udp -j DENY
                fi

                if [ "$BLOCK_SAMBA" = "2" ];
                then 
                  $IPCHAINS -A input -i $INTERFACE2 -s 0/0 --destination-port 137:139 -p tcp -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -s 0/0 --destination-port 137:139 -p udp -j DENY
                fi

                if [ "$BLOCK_SAMBA" = "3" ];
                then 
                  $IPCHAINS -A input -i $INTERFACE -s 0/0 --destination-port 137:139 -p tcp -j DENY
                  $IPCHAINS -A input -i $INTERFACE -s 0/0 --destination-port 137:139 -p udp -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -s 0/0 --destination-port 137:139 -p tcp -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -s 0/0 --destination-port 137:139 -p udp -j DENY
                fi


                if [ "$BLOCK_IDENT" = "1" ];
                  then $IPCHAINS -A input -i $INTERFACE -s 0/0 --destination-port 113 -p tcp -j DENY
                fi  

                if [ "$BLOCK_IDENT" = "2" ];
                  then $IPCHAINS -A input -i $INTERFACE2 -s 0/0 --destination-port 113 -p tcp -j DENY
                fi

                if [ "$BLOCK_IDENT" = "3" ];
                then 
                  $IPCHAINS -A input -i $INTERFACE -s 0/0 --destination-port 113 -p tcp -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -s 0/0 --destination-port 113 -p tcp -j DENY
                fi

                if [ "$BLOCK_NFS" = "1" ];
                then
                  $IPCHAINS -A input -i $INTERFACE -p tcp -s 0/0 --destination-port 2049 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p udp -s 0/0 --destination-port 2049 -j DENY
                fi

                if [ "$BLOCK_NFS" = "2" ];
                then
                  $IPCHAINS -A input -i $INTERFACE2 -p tcp -s 0/0 --destination-port 2049 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p udp -s 0/0 --destination-port 2049 -j DENY
                fi

                if [ "$BLOCK_NFS" = "3" ];
                then
                  $IPCHAINS -A input -i $INTERFACE -p tcp -s 0/0 --destination-port 2049 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p udp -s 0/0 --destination-port 2049 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p udp -s 0/0 --destination-port 2049 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p tcp -s 0/0 --destination-port 2049 -j DENY
                fi

                if [ "$BLOCK_RPC" = "1" ];
                then
                  $IPCHAINS -A input -i $INTERFACE -p tcp -s 0/0 --destination-port 111 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p udp -s 0/0 --destination-port 111 -j DENY
                fi
                
                if [ "$BLOCK_RPC" = "2" ];
                then
                  $IPCHAINS -A input -i $INTERFACE2 -p tcp -s 0/0 --destination-port 111 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p udp -s 0/0 --destination-port 111 -j DENY
                fi

                if [ "$BLOCK_RPC" = "3" ];
                then
                  $IPCHAINS -A input -i $INTERFACE -p tcp -s 0/0 --destination-port 111 -j DENY
                  $IPCHAINS -A input -i $INTERFACE -p udp -s 0/0 --destination-port 111 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p tcp -s 0/0 --destination-port 111 -j DENY
                  $IPCHAINS -A input -i $INTERFACE2 -p udp -s 0/0 --destination-port 111 -j DENY
                fi

                # status

                if [ "$BLOCK_ECHO" = "0" ];
                  then echo "- icmp_echo  not blocked"
                fi

                if [ "$BLOCK_ECHO" = "1" ];
                  then echo "- icmp_echo  blocked on   ($INTERFACE)"
                fi

                if [ "$BLOCK_ECHO" = "2" ];
                  then echo "- icmp_echo  blocked on            ($INTERFACE2)"
                fi

                if [ "$BLOCK_ECHO" = "3" ];
                  then echo "- icmp_echo  blocked on   ($INTERFACE) & ($INTERFACE2)"
                fi

                if [ "$BLOCK_X" = "0" ];
                  then echo "- X          not blocked"
                fi

                if [ "$BLOCK_X" = "1" ]; 
                  then echo "- X          blocked on   ($INTERFACE)"
                fi

                if [ "$BLOCK_X" = "2" ];
                  then echo "- X          blocked on            ($INTERFACE2)"
                fi

                if [ "$BLOCK_X" = "3" ];
                  then echo "- X          blocked on   ($INTERFACE) & ($INTERFACE2)"
                fi


                if [ "$BLOCK_FTP" = "0" ];
                  then echo "- ftp        not blocked"
                fi

                if [ "$BLOCK_FTP" = "1" ];
                  then echo "- ftp        blocked on   ($INTERFACE)"
                fi

                if [ "$BLOCK_FTP" = "2" ];
                  then echo "- ftp        blocked on            ($INTERFACE2)"
                fi

                if [ "$BLOCK_FTP" = "3" ];
                  then echo "- ftp        blocked on   ($INTERFACE) & ($INTERFACE2)"
                fi

                if [ "$BLOCK_HTTP" = "0" ];
                  then echo "- http       not blocked"
                fi

                if [ "$BLOCK_HTTP" = "1" ];
                  then echo "- http       blocked on   ($INTERFACE)"
                fi

                if [ "$BLOCK_HTTP" = "2" ];
                  then echo "- http       blocked on            ($INTERFACE2)"
                fi

                if [ "$BLOCK_HTTP" = "3" ];
                  then echo "- http       blocked on   ($INTERFACE) & ($INTERFACE2)"
                fi

                if [ "$BLOCK_TELNET" = "0" ];
                  then echo "- telnet     not blocked"
                fi

                if [ "$BLOCK_TELNET" = "1" ];
                  then echo "- telnet     blocked on   ($INTERFACE)"
                fi

                if [ "$BLOCK_TELNET" = "2" ];
                  then echo "- telnet     blocked on            ($INTERFACE2)"
                fi

                if [ "$BLOCK_TELNET" = "3" ];
                  then echo "- telnet     blocked on   ($INTERFACE) & ($INTERFACE2)"
                fi

                if [ "$BLOCK_SSH" = "0" ];
                  then echo "- ssh        not blocked"
                fi

                if [ "$BLOCK_SSH" = "1" ];
                  then echo "- ssh        blocked on   ($INTERFACE)"
                fi

                if [ "$BLOCK_SSH" = "2" ];
                  then echo "- ssh        blocked on            ($INTERFACE2)"
                fi

                if [ "$BLOCK_SSH" = "3" ];
                  then echo "- ssh        blocked on   ($INTERFACE) & ($INTERFACE2)"
                fi

                if [ "$BLOCK_IDENT" = "0" ];
                  then echo "- ident      not blocked"
                fi

                if [ "$BLOCK_IDENT" = "1" ];
                  then echo "- ident      blocked on   ($INTERFACE)"
                fi

                if [ "$BLOCK_IDENT" = "2" ];
                  then echo "- ident      blocked on            ($INTERFACE2)"
                fi

                if [ "$BLOCK_IDENT" = "3" ];
                  then echo "- ident      blocked on   ($INTERFACE) & ($INTERFACE2)"
                fi

                if [ "$BLOCK_SAMBA" = "0" ];
                  then echo "- samba      not blocked"
                fi

                if [ "$BLOCK_SAMBA" = "1" ];
                  then echo "- samba      blocked on   ($INTERFACE)"
                fi

                if [ "$BLOCK_SAMBA" = "2" ];
                  then echo "- samba      blocked on            ($INTERFACE2)"
                fi

                if [ "$BLOCK_SAMBA" = "3" ];
                  then echo "- samba      blocked on   ($INTERFACE) & ($INTERFACE2)"
                fi

                if [ "$BLOCK_NFS" = "0" ];
                  then echo "- nfs        not blocked"
                fi

                if [ "$BLOCK_NFS" = "1" ];
                  then echo "- nfs        blocked on   ($INTERFACE)"
                fi

                if [ "$BLOCK_NFS" = "2" ];
                  then echo "- nfs        blocked on            ($INTERFACE2)"
                fi

                if [ "$BLOCK_NFS" = "3" ];
                  then echo "- nfs        blocked on   ($INTERFACE) & ($INTERFACE2)"
                fi

                if [ "$BLOCK_RPC" = "0" ];
                  then echo "- sunrpc     not blocked"
                fi

                if [ "$BLOCK_RPC" = "1" ];
                  then echo "- sunrpc     blocked on   ($INTERFACE)"
                fi

                if [ "$BLOCK_RPC" = "2" ];
                  then echo "- sunrpc     blocked on            ($INTERFACE2)"
                fi

                if [ "$BLOCK_RPC" = "3" ];
                  then echo "- sunrpc     blocked on   ($INTERFACE) & ($INTERFACE2)"
                fi



                echo "+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+"
                echo
               ;;
           stop)
               echo "turning off packet filtering.. "
               echo "flushing old rules.."
                 $IPCHAINS --flush
               echo "setting basic policies.."
                 $IPCHAINS -P input ACCEPT
                 $IPCHAINS -P output ACCEPT
                 $IPCHAINS -P forward DENY

               # same old tos values again.
               echo "setting tos values.."
                 #$IPCHAINS -A output -p tcp -d 0/0 www -t 0x01 0x10
                 $IPCHAINS -A output -p tcp -d 0/0 telnet -t 0x01 0x10
                 #$IPCHAINS -A output -p tcp -d 0/0 ftp -t 0x01 0x10
                 $IPCHAINS -A output -p tcp -d 0/0 6660:6670 -t 0x01 0x10
                 $IPCHAINS -A output -p tcp -d 0/0 ftp-data -t 0x01 0x08

                if [ "$ENABLE_MASQ" = "1" ];
                   then
                    echo 1 > /proc/sys/net/ipv4/ip_forward
                    echo "setting timeout values for masq.."
                    $IPCHAINS -M -S 7200 10 60
                    echo "masquerading from $MASQ.."
                    $IPCHAINS -A forward -s $MASQ -j MASQ
                else
                    echo "masquerading not enabled.."
                fi

               echo "             ! EVERYTHING OPEN !             "
               echo "+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+"
               echo
               ;;
       paranoid)
               echo "turning on packet filtering.. hc mode.. "
               echo "flushing old rules.."
                 $IPCHAINS --flush
               
               echo "setting basic policies.."
                 $IPCHAINS -P input ACCEPT
                 $IPCHAINS -P output ACCEPT
                 $IPCHAINS -P forward DENY

                if [ "$ENABLE_MASQ" = "1" ];
                   then
                    echo 1 > /proc/sys/net/ipv4/ip_forward
                    echo "setting timeout values for masq.."
                    $IPCHAINS -M -S 7200 10 60
                    echo "masquerading from $MASQ.."
                    $IPCHAINS -A forward -s $MASQ -j MASQ
                else
                    echo "masquerading not enabled.."
                fi

               # same old tos values again. 
               echo "setting tos values.." 
                 #$IPCHAINS -A output -p tcp -d 0/0 www -t 0x01 0x10
                 $IPCHAINS -A output -p tcp -d 0/0 telnet -t 0x01 0x10
                 #$IPCHAINS -A output -p tcp -d 0/0 ftp -t 0x01 0x10
                 $IPCHAINS -A output -p tcp -d 0/0 6660:6670 -t 0x01 0x10
                 $IPCHAINS -A output -p tcp -d 0/0 ftp-data -t 0x01 0x08

               echo "setting new rules.."
                 $IPCHAINS -A input -i $INTERFACE -s 0/0 8 -p icmp -j DENY
                 $IPCHAINS -A input -i $INTERFACE -s 0/0 --destination-port 1:1024 -p tcp -j DENY
                 $IPCHAINS -A input -i $INTERFACE -s 0/0 --destination-port 1:1024 -p udp -j DENY
                 $IPCHAINS -A input -i $INTERFACE -s 0/0 --destination-port 6000:6010 -p tcp -j DENY
                 $IPCHAINS -A input -i $INTERFACE -s 0/0 --destination-port 7100 -p tcp -j DENY
                 $IPCHAINS -A input -i $INTERFACE -s 0/0 --destination-port 2049 -p tcp -j DENY
                 $IPCHAINS -A input -i $INTERFACE -s 0/0 --destination-port 7100 -p udp -j DENY
                 $IPCHAINS -A input -i $INTERFACE -s 0/0 --destination-port 2049 -p udp -j DENY

                 $IPCHAINS -A input -i $INTERFACE2 -s 0/0 8 -p icmp -j DENY
                 $IPCHAINS -A input -i $INTERFACE2 -s 0/0 --destination-port 1:1024 -p tcp -j DENY
                 $IPCHAINS -A input -i $INTERFACE2 -s 0/0 --destination-port 1:1024 -p udp -j DENY
                 $IPCHAINS -A input -i $INTERFACE2 -s 0/0 --destination-port 6000:6010 -p tcp -j DENY
                 $IPCHAINS -A input -i $INTERFACE2 -s 0/0 --destination-port 7100 -p tcp -j DENY
                 $IPCHAINS -A input -i $INTERFACE2 -s 0/0 --destination-port 2049 -p tcp -j DENY
                 $IPCHAINS -A input -i $INTERFACE2 -s 0/0 --destination-port 7100 -p udp -j DENY
                 $IPCHAINS -A input -i $INTERFACE2 -s 0/0 --destination-port 2049 -p udp -j DENY

               echo "all ports from 1 to 1024 blocked + others"
               echo "        ! SOME THINGS MAY NOT WORK !         "
               echo "+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+"
               echo
               ;;
          panic)
               echo "switching to panic mode.. "
               echo "flushing old rules.."
                 $IPCHAINS --flush

               echo "setting input, output and forward to DENY.."
                 $IPCHAINS -P input DENY
                 $IPCHAINS -P output DENY 
                 $IPCHAINS -P forward DENY
               echo "!WARNING! NOTHING WILL WORK (including masq)"
               echo "+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+"
               echo
               ;;
          stats)
               echo "displaying packet filtering current rules: "
               echo
               $IPCHAINS --list
               echo
               ;;
           *)
               echo
               echo "easychains {start|stop|paranoid|panic|stats}"
               echo "+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+"
               echo
               exit 1
               ;;
       esac

       exit 0