# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [ 0 : 0 ]
:FORWARD ACCEPT [ 0 : 0 ]
:OUTPUT ACCEPT [ 0 : 0 ]
:RH-Firewall- 1 -INPUT - [ 0 : 0 ]
-A INPUT -j RH-Firewall- 1 -INPUT
-A FORWARD -j RH-Firewall- 1 -INPUT
-A RH-Firewall- 1 -INPUT -i lo -j ACCEPT
-A RH-Firewall- 1 -INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall- 1 -INPUT -p  50  -j ACCEPT
-A RH-Firewall- 1 -INPUT -p  51  -j ACCEPT
-A RH-Firewall- 1 -INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall- 1 -INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state NEW -m udp -p udp --sport 137 -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state NEW -m udp -p udp --sport 138 -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state NEW -m tcp -p tcp --sport 139 -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state NEW -m tcp -p tcp --sport 445 -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state NEW -m udp -p udp --dport 137 -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state NEW -m udp -p udp --dport 138 -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
-A RH-Firewall- 1 -INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

[root@localhost ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
RH-Firewall- 1 -INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
RH-Firewall- 1 -INPUT  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain RH-Firewall- 1 -INPUT ( 2  references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     ipv6-crypt--  anywhere             anywhere
ACCEPT     ipv6-auth--  anywhere             anywhere
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:5353
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:netbios-ns
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:netbios-dgm
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:netbios-ssn
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:microsoft-ds
ACCEPT     udp  --  anywhere             anywhere            state NEW udp spt:netbios-ns
ACCEPT     udp  --  anywhere             anywhere            state NEW udp spt:netbios-dgm
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp spt:netbios-ssn
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp spt:microsoft-ds
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited
[root@localhost ~]# iptables-save
# Generated by iptables-save v1. 2 . 11  on Fri Jul   8   10 : 10 : 28   2005 
*filter
:INPUT ACCEPT [ 0 : 0 ]
:FORWARD ACCEPT [ 0 : 0 ]
:OUTPUT ACCEPT [ 528 : 15844 ]
:RH-Firewall- 1 -INPUT - [ 0 : 0 ]
-A INPUT -j RH-Firewall- 1 -INPUT
-A FORWARD -j RH-Firewall- 1 -INPUT
-A RH-Firewall- 1 -INPUT -i lo -j ACCEPT
-A RH-Firewall- 1 -INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall- 1 -INPUT -p ipv6-crypt -j ACCEPT
-A RH-Firewall- 1 -INPUT -p ipv6-auth -j ACCEPT
-A RH-Firewall- 1 -INPUT -d  224 . 0 . 0 . 251  -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall- 1 -INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall- 1 -INPUT -p udp -m state --state NEW -m udp --dport 137 -j ACCEPT
-A RH-Firewall- 1 -INPUT -p udp -m state --state NEW -m udp --dport 138 -j ACCEPT
-A RH-Firewall- 1 -INPUT -p tcp -m state --state NEW -m tcp --dport 139 -j ACCEPT
-A RH-Firewall- 1 -INPUT -p tcp -m state --state NEW -m tcp --dport 445 -j ACCEPT
-A RH-Firewall- 1 -INPUT -p udp -m state --state NEW -m udp --sport 137 -j ACCEPT
-A RH-Firewall- 1 -INPUT -p udp -m state --state NEW -m udp --sport 138 -j ACCEPT
-A RH-Firewall- 1 -INPUT -p tcp -m state --state NEW -m tcp --sport 139 -j ACCEPT
-A RH-Firewall- 1 -INPUT -p tcp -m state --state NEW -m tcp --sport 445 -j ACCEPT
-A RH-Firewall- 1 -INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Fri Jul   8   10 : 10 : 28   2005 
[root@localhost ~]# cat /sbin/iptables-save | iptables-restore -c
iptables-restore: line  1  failed
[root@localhost ~]#

# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [ 0 : 0 ]
:FORWARD ACCEPT [ 0 : 0 ]
:OUTPUT ACCEPT [ 0 : 0 ]
:RH-Firewall- 1 -INPUT - [ 0 : 0 ]
-A INPUT -j RH-Firewall- 1 -INPUT
-A FORWARD -j RH-Firewall- 1 -INPUT
-A RH-Firewall- 1 -INPUT -i lo -j ACCEPT
-A RH-Firewall- 1 -INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall- 1 -INPUT -p  50  -j ACCEPT
-A RH-Firewall- 1 -INPUT -p  51  -j ACCEPT
-A RH-Firewall- 1 -INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall- 1 -INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state NEW -m udp -p udp --sport 137 -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state NEW -m udp -p udp --sport 138 -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state NEW -m tcp -p tcp --sport 139 -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state NEW -m tcp -p tcp --sport 445 -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state NEW -m udp -p udp --dport 137 -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state NEW -m udp -p udp --dport 138 -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
-A RH-Firewall- 1 -INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
-A RH-Firewall- 1 -INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

[root@localhost ~]# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  192.168.15.19        192.168.15.255
logaborted  tcp  --  anywhere             anywhere            state RELATED,ESTABLISHED tcp flags:RST/RST
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable
ACCEPT     icmp --  anywhere             anywhere            icmp time-exceeded
ACCEPT     icmp --  anywhere             anywhere            icmp parameter-problem
nicfilt    all  --  anywhere             anywhere
srcfilt    all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable
ACCEPT     icmp --  anywhere             anywhere            icmp time-exceeded
ACCEPT     icmp --  anywhere             anywhere            icmp parameter-problem
srcfilt    all  --  anywhere             anywhere

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable
ACCEPT     icmp --  anywhere             anywhere            icmp time-exceeded
ACCEPT     icmp --  anywhere             anywhere            icmp parameter-problem
s1         all  --  anywhere             anywhere

Chain f0to1 ( 3  references)
target     prot opt source               destination
logdrop    all  --  anywhere             anywhere

Chain f1to0 ( 1  references)
target     prot opt source               destination
logdrop    all  --  anywhere             anywhere

Chain logaborted ( 1  references)
target     prot opt source               destination
logaborted2  all  --  anywhere             anywhere            limit: avg 1/sec burst 10
LOG        all  --  anywhere             anywhere            limit: avg 2/min burst 1 LOG level warning prefix `LIMITED '

Chain logaborted2 ( 1  references)

[root@localhost ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
RH-Firewall- 1 -INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
RH-Firewall- 1 -INPUT  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain RH-Firewall- 1 -INPUT ( 2  references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     ipv6-crypt--  anywhere             anywhere
ACCEPT     ipv6-auth--  anywhere             anywhere
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:5353
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:netbios-ns
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:netbios-dgm
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:netbios-ssn
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:microsoft-ds
ACCEPT     udp  --  anywhere             anywhere            state NEW udp spt:netbios-ns
ACCEPT     udp  --  anywhere             anywhere            state NEW udp spt:netbios-dgm
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp spt:netbios-ssn
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp spt:microsoft-ds
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited
[root@localhost ~]#

/etc/sysconfig

#!/bin/sh
#
# iptables	Start iptables firewall
#
# chkconfig:  2345   08   92 
# description:	Starts, stops and saves iptables firewall
#
# config: /etc/sysconfig/iptables
# config: /etc/sysconfig/iptables-config

# Source function library.
. /etc/init.d/functions

IPTABLES=iptables
IPTABLES_DATA=/etc/sysconfig/$IPTABLES
IPTABLES_CONFIG=/etc/sysconfig/${IPTABLES}-config
IPV=${IPTABLES%tables} # ip for ipv4 | ip6 for ipv6
PROC_IPTABLES_NAMES=/proc/net/${IPV}_tables_names
VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES

if [ ! -x /sbin/$IPTABLES ]; then
    echo -n $"/sbin/$IPTABLES does not exist."; warning; echo
    exit  0 
fi

if lsmod  2 >/dev/null | grep -q ipchains ; then
    echo -n $"ipchains and $IPTABLES can not be used together."; warning; echo
    exit  0 
fi

# Old or new modutils
/sbin/modprobe --version 2>&1 | grep -q module-init-tools \
    && NEW_MODUTILS= 1  \
    || NEW_MODUTILS= 0 

# Default firewall configuration:
IPTABLES_MODULES=""
IPTABLES_MODULES_UNLOAD="yes"
IPTABLES_SAVE_ON_STOP="no"
IPTABLES_SAVE_ON_RESTART="no"
IPTABLES_SAVE_COUNTER="no"
IPTABLES_STATUS_NUMERIC="yes"

# Load firewall configuration.
[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"

rmmod_r() {
    # Unload module with all referring modules.
    # At first all referring modules will be unloaded, then the module itself.
    local mod=$ 1 
    local ret= 0 
    local ref=

    # Get referring modules.
    # New modutils have another output format.
    [ $NEW_MODUTILS =  1  ] \
	&& ref=`lsmod | awk "/^${mod}/ { print \\\$4; }" | tr ',' ' '` \
	|| ref=`lsmod | grep ^${mod} | cut -d "[" -s -f  2  | cut -d "]" -s -f  1 `

    # recursive call for all referring modules
    for i in $ref; do
	rmmod_r $i
	let ret+=$?;
    done

    # Unload module.
    # The extra test is for  2 . 6 : The module might have autocleaned,
    # after all referring modules are unloaded.
    if grep -q "^${mod}" /proc/modules ; then
	modprobe -r $mod > /dev/null  2 >& 1 
	let ret+=$?;
    fi

    return $ret
}

flush_n_delete() {
    # Flush firewall rules and delete chains.
    [ -e "$PROC_IPTABLES_NAMES" ] || return  1 

    # Check if firewall is configured (has tables)
    tables=`cat $PROC_IPTABLES_NAMES  2 >/dev/null`
    [ -z "$tables" ] && return  1 

    echo -n $"Flushing firewall rules: "
    ret= 0 
    # For all tables
    for i in $tables; do
        # Flush firewall rules.
	$IPTABLES -t $i -F;
	let ret+=$?;

        # Delete firewall chains.
	$IPTABLES -t $i -X;
	let ret+=$?;

	# Set counter to zero.
	$IPTABLES -t $i -Z;
	let ret+=$?;
    done

    [ $ret -eq  0  ] && success || failure
    echo
    return $ret
}

set_policy() {
    # Set policy for configured tables.
    policy=$ 1 

    # Check if iptable module is loaded
    [ ! -e "$PROC_IPTABLES_NAMES" ] && return  1 

    # Check if firewall is configured (has tables)
    tables=`cat $PROC_IPTABLES_NAMES  2 >/dev/null`
    [ -z "$tables" ] && return  1 

    echo -n $"Setting chains to policy $policy: "
    ret= 0 
    for i in $tables; do
	echo -n "$i "
	case "$i" in
	    filter)
                $IPTABLES -t filter -P INPUT $policy \
		    && $IPTABLES -t filter -P OUTPUT $policy \
		    && $IPTABLES -t filter -P FORWARD $policy \
		    || let ret+= 1 
		;;
	    nat)
		$IPTABLES -t nat -P PREROUTING $policy \
		    && $IPTABLES -t nat -P POSTROUTING $policy \
		    && $IPTABLES -t nat -P OUTPUT $policy \
		    || let ret+= 1 
		;;
	    mangle)
	        $IPTABLES -t mangle -P PREROUTING $policy \
		    && $IPTABLES -t mangle -P POSTROUTING $policy \
		    && $IPTABLES -t mangle -P INPUT $policy \
		    && $IPTABLES -t mangle -P OUTPUT $policy \
		    && $IPTABLES -t mangle -P FORWARD $policy \
		    || let ret+= 1 
		;;
	    *)
	        let ret+= 1 
		;;
        esac
    done

    [ $ret -eq  0  ] && success || failure
    echo
    return $ret
}

start() {
    # Do not start if there is no config file.
    [ -f "$IPTABLES_DATA" ] || return  1 

    echo -n $"Applying $IPTABLES firewall rules: "

    OPT=
    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"

    $IPTABLES-restore $OPT $IPTABLES_DATA
    if [ $? -eq  0  ]; then
	success; echo
    else
	failure; echo; return  1 
    fi
    
    # Load additional modules (helpers)
    if [ -n "$IPTABLES_MODULES" ]; then
	echo -n $"Loading additional $IPTABLES modules: "
	ret= 0 
	for mod in $IPTABLES_MODULES; do
	    echo -n "$mod "
	    modprobe $mod > /dev/null  2 >& 1 
	    let ret+=$?;
	done
	[ $ret -eq  0  ] && success || failure
	echo
    fi
    
    touch $VAR_SUBSYS_IPTABLES
    return $ret
}

stop() {
    # Do not stop if iptables module is not loaded.
    [ -e "$PROC_IPTABLES_NAMES" ] || return  1 

    flush_n_delete
    set_policy ACCEPT
    
    if [ "x$IPTABLES_MODULES_UNLOAD" = "xyes" ]; then
	echo -n $"Unloading $IPTABLES modules: "
	ret= 0 
	rmmod_r ${IPV}_tables
	let ret+=$?;
	rmmod_r ${IPV}_conntrack
	let ret+=$?;
	[ $ret -eq  0  ] && success || failure
	echo
    fi
    
    rm -f $VAR_SUBSYS_IPTABLES
    return $ret
}

save() {
    # Check if iptable module is loaded
    [ ! -e "$PROC_IPTABLES_NAMES" ] && return  1 

    # Check if firewall is configured (has tables)
    tables=`cat $PROC_IPTABLES_NAMES  2 >/dev/null`
    [ -z "$tables" ] && return  1 

    echo -n $"Saving firewall rules to $IPTABLES_DATA: "

    OPT=
    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"

    ret= 0 
    TMP_FILE=`/bin/mktemp -q /tmp/$IPTABLES.XXXXXX` \
	&& chmod  600  "$TMP_FILE" \
	&& $IPTABLES-save $OPT > $TMP_FILE  2 >/dev/null \
	&& size=`stat -c '%s' $TMP_FILE` && [ $size -gt  0  ] \
	|| ret= 1 
    if [ $ret -eq  0  ]; then
	if [ -e $IPTABLES_DATA ]; then
	    cp -f $IPTABLES_DATA $IPTABLES_DATA.save \
		&& chmod  600  $IPTABLES_DATA.save \
		|| ret= 1 
	fi
	if [ $ret -eq  0  ]; then
	    cp -f $TMP_FILE $IPTABLES_DATA \
		&& chmod  600  $IPTABLES_DATA \
	        || ret= 1 
	fi
    fi
    [ $ret -eq  0  ] && success || failure
    echo
    rm -f $TMP_FILE
    return $ret
}

status() {
    # Do not print status if lockfile is missing and iptables modules are not 
    # loaded.
    # Check if iptable module is loaded
    if [ ! -f "$VAR_SUBSYS_IPTABLES" ]; then
	echo $"Firewall is stopped."
	return  1 
    fi

    # Check if firewall is configured (has tables)
    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
	echo $"Firewall is not configured. "
	return  1 
    fi
    tables=`cat $PROC_IPTABLES_NAMES  2 >/dev/null`
    if [ -z "$tables" ]; then
	echo $"Firewall is not configured. "
	return  1 
    fi

    NUM=
    [ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"

    for table in $tables; do
	echo $"Table: $table"
	$IPTABLES -t $table --list $NUM && echo
    done

    return  0 
}

restart() {
    [ "x$IPTABLES_SAVE_ON_RESTART" = "xyes" ] && save
    stop
    start
}

case "$1" in
    start)
	stop
	start
	RETVAL=$?
	;;
    stop)
	[ "x$IPTABLES_SAVE_ON_STOP" = "xyes" ] && save
	stop
	RETVAL=$?
	;;
    restart)
	restart
	RETVAL=$?
	;;
    condrestart)
	[ -e "$VAR_SUBSYS_IPTABLES" ] && restart
	;;
    status)
	status
	RETVAL=$?
	;;
    panic)
	flush_n_delete
	set_policy DROP
	RETVAL=$?
        ;;
    save)
	save
	RETVAL=$?
	;;
    *)
	echo $"Usage: $0 {start|stop|restart|condrestart|status|panic|save}"
	exit  1 
	;;
esac

exit $RETVAL

#!/bin/bash
# [Guarddog2]
# DO NOT EDIT!
# This firewall script was generated by "Guarddog" by Simon Edwards
# http://www.simonzone.com/software/guarddog/ This script requires Linux
# kernel version  2 . 2 .x and ipchains OR Linux kernel  2 . 4 .x and iptables.
#
# [Description]
#  
# [Config]
# LOCALPORTRANGESTART= 1024 
# LOCALPORTRANGEEND= 5999 
# DISABLED= 0 
# LOGREJECT= 1 
# LOGDROP= 1 
# LOGABORTEDTCP= 1 
# LOGIPOPTIONS= 1 
# LOGTCPOPTIONS= 1 
# LOGTCPSEQUENCE= 1 
# LOGLEVEL= 4 
# LOGRATELIMIT= 1 
# LOGRATE= 1 
# LOGRATEUNIT= 0 
# LOGRATEBURST= 10 
# LOGWARNLIMIT= 1 
# LOGWARNRATE= 2 
# LOGWARNRATEUNIT= 1 
# DHCPC= 0 
# DHCPCINTERFACENAME=eth0
# DHCPD= 0 
# DHCPDINTERFACENAME=eth0
# ALLOWTCPTIMESTAMPS= 0 
# [ServerZone] Internet
# [ClientZone] Local
# CONNECTED= 1 
# [ServerZone] Local
# [ClientZone] Internet
# CONNECTED= 1 
# [End]

# Real code starts here
# If you change the line below then also change the # DISABLED line above.
DISABLE_GUARDDOG= 0 
if test -z $GUARDDOG_VERBOSE; then
  GUARDDOG_VERBOSE= 0 
fi;
if [ $DISABLE_GUARDDOG -eq  0  ]; then
# Set the path
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/sbin
# Detect which filter command we should use.
FILTERSYS= 0 
#  0  = unknown,  1  = ipchains,  2  = iptables
# Check for ipchains.
if [ -e /sbin/ipchains ]; then
  FILTERSYS= 1 
fi;
if [ -e /usr/sbin/ipchains ]; then
  FILTERSYS= 1 
fi;
if [ -e /usr/local/sbin/ipchains ]; then
  FILTERSYS= 1 
fi;
# Check for iptables support.
if [ -e /proc/sys/kernel/osrelease ]; then
  KERNEL_VERSION=`sed "s/^\([0-9][0-9]*\.[0-9][0-9]*\).*\$/\1/" < /proc/sys/kernel/osrelease`
  if [ $KERNEL_VERSION == "2.6" ]; then
    KERNEL_VERSION="2.4"
  fi;
  if [ $KERNEL_VERSION == "2.5" ]; then
    KERNEL_VERSION="2.4"
  fi;
  if [ $KERNEL_VERSION == "2.4" ]; then
    if [ -e /sbin/iptables ]; then
      FILTERSYS= 2 
    fi;
    if [ -e /usr/sbin/iptables ]; then
      FILTERSYS= 2 
    fi;
    if [ -e /usr/local/sbin/iptables ]; then
      FILTERSYS= 2 
    fi;
  fi;
fi;
if [ $FILTERSYS -eq  0  ]; then
  logger -p auth.info -t guarddog "ERROR Can't determine the firewall command! (Is ipchains or iptables installed?)"
  [ $GUARDDOG_VERBOSE -eq 1 ] && echo "ERROR Can't determine the firewall command! (Is ipchains or iptables installed?)"
  false
fi;
if [ $FILTERSYS -eq  1  ]; then
###############################
###### ipchains ###############
###############################
logger -p auth.info -t guarddog Configuring ipchains firewall now.
[ $GUARDDOG_VERBOSE -eq  1  ] && echo "Using ipchains."
[ $GUARDDOG_VERBOSE -eq  1  ] && echo "Resetting firewall rules."
# Shut down all traffic
ipchains -P forward DENY
ipchains -P input DENY
ipchains -P output DENY

# Delete any existing chains
ipchains -F
ipchains -X

[ $GUARDDOG_VERBOSE -eq  1  ] && echo "Setting kernel parameters."
# Turn on kernel IP spoof protection
echo  1  > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts  2 > /dev/null
# Set the up TCP timestamps config
echo  0  > /proc/sys/net/ipv4/tcp_timestamps  2 > /dev/null
# Enable TCP SYN Cookie Protection
echo  1  > /proc/sys/net/ipv4/tcp_syncookies  2 > /dev/null
echo  0  > /proc/sys/net/ipv4/conf/all/accept_source_route  2 > /dev/null
# Log truly weird packets.
echo  1  > /proc/sys/net/ipv4/conf/all/log_martians  2 > /dev/null
# Switch the current language for a moment
GUARDDOG_BACKUP_LANG=$LANG
GUARDDOG_BACKUP_LC_ALL=$LC_ALL
LANG=US
LC_ALL=US
export LANG
export LC_ALL
# Set kernel rp_filter. NICs used for IPSEC should not have rp_fitler turned on.
# Find the IPs of any ipsecX NICs
IPSEC_IPS="`ifconfig | gawk '/^ipsec\w/ { grabip = 1}
/inet addr:[[:digit:]\\.]+/ { if(grabip==1) printf \"%s \",gensub(/^.*inet addr:([[:digit:]\\.]+).*$/,\"\\\\1\",\"g\",$0)
grabip = 0}'`"
# Build a list of NIC names and metching IPs
IP_NIC_PAIRS="`ifconfig | gawk '/^\w/ { nic = gensub(/^(.*):.*/,\"\\\\1\",\"g\",$1)}
/inet addr:.*/ {match($0,/inet addr:[[:digit:]\.]+/)
ip=substr($0,RSTART+10,RLENGTH-10)
printf \"%s_%s\\n\",nic,ip }'`"

# Restore the language setting
LANG=$GUARDDOG_BACKUP_LANG
LC_ALL=$GUARDDOG_BACKUP_LC_ALL
export LANG
export LC_ALL

# Activate rp_filter for each NIC, except for NICs that are using
# an IP that is involved with IPSEC.
for X in $IP_NIC_PAIRS ; do
  NIC="`echo \"$X\" | cut -f 1 -d _`"
  IP="`echo \"$X\" | cut -f 2 -d _`"
  RPF="1"
  for SEC_IP in $IPSEC_IPS ; do
    if [[ $SEC_IP == $IP ]]; then
      RPF="0"
    fi
  done
  echo $RPF > /proc/sys/net/ipv4/conf/$NIC/rp_filter  2 > /dev/null
done

echo "1024 5999" > /proc/sys/net/ipv4/ip_local_port_range  2 > /dev/null

[ $GUARDDOG_VERBOSE -eq  1  ] && echo "Configuring firewall rules."
# Allow loopback traffic.
ipchains -A input -i lo -j ACCEPT
ipchains -A output -i lo -j ACCEPT

# Accept broadcasts from ourself.
# Switch the current language for a moment
GUARDDOG_BACKUP_LANG=$LANG
GUARDDOG_BACKUP_LC_ALL=$LC_ALL
LANG=US
LC_ALL=US
export LANG
export LC_ALL
IP_BCAST_PAIRS="`ifconfig | gawk '/^\w/ { nic = gensub(/^(.*):.*/,\"\\\\1\",\"g\",$1)}
/inet addr:.*Bcast/ {match($0,/inet addr:[[:digit:]\\.]+/)
ip=substr($0,RSTART+10,RLENGTH-10)
match($0,/Bcast:[[:digit:]\\.]+/)
bcast = substr($0,RSTART+6,RLENGTH-6)
printf \"%s_%s_%s\\n\",nic,ip,bcast }'`"
# Restore the language setting
LANG=$GUARDDOG_BACKUP_LANG
LC_ALL=$GUARDDOG_BACKUP_LC_ALL
export LANG
export LC_ALL
for X in $IP_BCAST_PAIRS ; do
  NIC="`echo \"$X\" | cut -f 1 -d _`"
  IP="`echo \"$X\" | cut -f 2 -d _`"
  BCAST="`echo \"$X\" | cut -f 3 -d _`"
  ipchains -A input -i $NIC -s $IP -d $BCAST -j ACCEPT
done

# Allow certain critical ICMP types
ipchains -A input -p icmp --sport 3 -j ACCEPT                 # Dest unreachable
ipchains -A output -p icmp --sport 3 -j ACCEPT                # Dest unreachable
ipchains -A forward -p icmp --sport 3 -j ACCEPT &> /dev/null  # Dest unreachable
ipchains -A input -p icmp --sport 11 -j ACCEPT                # Time exceeded
ipchains -A output -p icmp --sport 11 -j ACCEPT               # Time exceeded
ipchains -A forward -p icmp --sport 11 -j ACCEPT &> /dev/null # Time exceeded
ipchains -A input -p icmp --sport 12 -j ACCEPT                # Parameter Problem
ipchains -A output -p icmp --sport 12 -j ACCEPT               # Parameter Problem
ipchains -A forward -p icmp --sport 12 -j ACCEPT &> /dev/null # Parameter Problem
# Work out our local IPs.
# Switch the current language for a moment
GUARDDOG_BACKUP_LANG=$LANG
GUARDDOG_BACKUP_LC_ALL=$LC_ALL
LANG=US
LC_ALL=US
export LANG
export LC_ALL
NIC_IP="`ifconfig | gawk '/^\w/ { nic = gensub(/^(.*):.*/,\"\\\\1\",\"g\",\$1)}
/inet addr:/ { match(\$0,/inet addr:[[:digit:]\\.]+/)
printf \"%s_%s\\n\",nic,substr(\$0,RSTART+10,RLENGTH-10) }
/Bcast/ { match(\$0,/Bcast:[[:digit:]\\.]+/)
printf \"%s_%s\\n\",nic,substr(\$0,RSTART+6,RLENGTH-6) }'`"
# Restore the language setting
LANG=$GUARDDOG_BACKUP_LANG
LC_ALL=$GUARDDOG_BACKUP_LC_ALL
export LANG
export LC_ALL
# Create the nicfilt chain
ipchains -N nicfilt
GOT_LO= 0 
NIC_COUNT= 0 
for X in $NIC_IP ; do
    NIC="`echo \"$X\" | cut -f 1 -d _`"
    IP="`echo \"$X\" | cut -f 2 -d _`"
    ipchains -A nicfilt -i $NIC -j RETURN
    # We also take this opportunity to see if we only have a lo interface.
    if [ $NIC == "lo" ]; then
        GOT_LO= 1 
    fi
    let NIC_COUNT=$NIC_COUNT+ 1 
done
IPS="`echo \"$NIC_IP\" | cut -f 2 -d _`"
# Do we have just a lo interface?
if [ $GOT_LO -eq  1  ] && [ $NIC_COUNT -eq  1  ] ; then
  MIN_MODE= 1 
else
  MIN_MODE= 0 
fi
# Are there *any* interfaces?
if [ $NIC_COUNT -eq  0  ] ; then
  MIN_MODE= 1 
fi
# If we only have a lo interface or no interfaces then we assume that DNS
# is not going to work and just skip any iptables calls that need DNS.
ipchains -A nicfilt -l -j DENY

# Create the filter chains
# Create chain to filter traffic going from 'Internet' to 'Local'
ipchains -N f0to1
# Create chain to filter traffic going from 'Local' to 'Internet'
ipchains -N f1to0
# Add rules to the filter chains

# Traffic from 'Internet' to 'Local'

# Rejected traffic from 'Internet' to 'Local'

# Traffic from 'Local' to 'Internet'

# Rejected traffic from 'Local' to 'Internet'

# Place DENY and log rules at the end of our filter chains.
# Failing all the rules above, we DENY and maybe log the packet.
ipchains -A f0to1 -l -j DENY
# Failing all the rules above, we DENY and maybe log the packet.
ipchains -A f1to0 -l -j DENY

# Add some temp DNS accept rules to the input and output chains.
# This is so that we can pass domain names to ipchains and have ipchains be
# able to look it up without being blocked by the our half-complete firewall.
if [ $MIN_MODE -eq  0  ] ; then
  ipchains -A output -p tcp --sport 0:65535 --dport 53:53 -j ACCEPT
  ipchains -A input -p tcp ! -y --sport 53:53 --dport 0:65535 -j ACCEPT
  ipchains -A output -p udp --sport 0:65535 --dport 53:53 -j ACCEPT
  ipchains -A input -p udp --sport 53:53 --dport 0:65535 -j ACCEPT
fi

# Chain to split traffic coming from zone 'Internet' by dest zone
ipchains -N s0
for X in $IPS ; do
    ipchains -A s0 -d $X -j f0to1
done
if [ $MIN_MODE -eq  0  ] ; then
true # make sure this if [] has a least something in it.
fi
ipchains -A s0 -l -j DENY

# Chain to split traffic coming from zone 'Local' by dest zone
ipchains -N s1
if [ $MIN_MODE -eq  0  ] ; then
true # make sure this if [] has a least something in it.
fi
ipchains -A s1 -j f1to0
# Create the srcfilt chain
ipchains -N srcfilt
if [ $MIN_MODE -eq  0  ] ; then
true # make sure this if [] has a least something in it.
fi
# Assume internet default rule
ipchains -A srcfilt -j s0

# Remove the temp DNS accept rules
if [ $MIN_MODE -eq  0  ] ; then
  ipchains -D output -p tcp --sport 0:65535 --dport 53:53 -j ACCEPT
  ipchains -D input -p tcp ! -y --sport 53:53 --dport 0:65535 -j ACCEPT
  ipchains -D output -p udp --sport 0:65535 --dport 53:53 -j ACCEPT
  ipchains -D input -p udp --sport 53:53 --dport 0:65535 -j ACCEPT
fi

# The output chain is quite simple. We diverge and filter any traffic from
# the local machine and accept the rest. The rest should have come via the
# forward chain, and hence is already filtered.
ipchains -A output -j nicfilt
for X in $IPS ; do
    ipchains -A output -s $X -j s1
done
ipchains -A output -j ACCEPT

ipchains -A input -j nicfilt
# Direct local bound traffic on the input chain to the srcfilt chain
for X in $IPS ; do
    ipchains -A input -d $X -j srcfilt
done
ipchains -A input -j ACCEPT

# All traffic on the forward chains goes to the srcfilt chain.
ipchains -A forward -j nicfilt &> /dev/null
ipchains -A forward -j srcfilt &> /dev/null

logger -p auth.info -t guarddog Finished configuring firewall
[ $GUARDDOG_VERBOSE -eq  1  ] && echo "Finished."
fi;
if [ $FILTERSYS -eq  2  ]; then
###############################
###### iptables firewall ######
###############################
logger -p auth.info -t guarddog Configuring iptables firewall now.
[ $GUARDDOG_VERBOSE -eq  1  ] && echo "Using iptables."
[ $GUARDDOG_VERBOSE -eq  1  ] && echo "Resetting firewall rules."
# Shut down all traffic
iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -P OUTPUT DROP

# Delete any existing chains
iptables -F
iptables -X

# Load any special kernel modules.
[ $GUARDDOG_VERBOSE -eq  1  ] && echo "Loading kernel modules."

[ $GUARDDOG_VERBOSE -eq  1  ] && echo "Setting kernel parameters."
# Turn on kernel IP spoof protection
echo  1  > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts  2 > /dev/null
# Set the TCP timestamps config
echo  0  > /proc/sys/net/ipv4/tcp_timestamps  2 > /dev/null
# Enable TCP SYN Cookie Protection if available
test -e /proc/sys/net/ipv4/tcp_syncookies && echo  1  > /proc/sys/net/ipv4/tcp_syncookies  2 > /dev/null
echo  0  > /proc/sys/net/ipv4/conf/all/accept_source_route  2 > /dev/null
echo  0  > /proc/sys/net/ipv4/conf/default/accept_source_route  2 > /dev/null
# Log truly weird packets.
echo  1  > /proc/sys/net/ipv4/conf/all/log_martians  2 > /dev/null
echo  1  > /proc/sys/net/ipv4/conf/default/log_martians  2 > /dev/null
# Switch the current language for a moment
GUARDDOG_BACKUP_LANG=$LANG
GUARDDOG_BACKUP_LC_ALL=$LC_ALL
LANG=US
LC_ALL=US
export LANG
export LC_ALL
# Set kernel rp_filter. NICs used for IPSEC should not have rp_fitler turned on.
# Find the IPs of any ipsecX NICs
IPSEC_IPS="`ifconfig | gawk '/^ipsec\w/ { grabip = 1}
/inet addr:[[:digit:]\\.]+/ { if(grabip==1) printf \"%s \",gensub(/^.*inet addr:([[:digit:]\\.]+).*$/,\"\\\\1\",\"g\",$0)
grabip = 0}'`"
# Build a list of NIC names and metching IPs
IP_NIC_PAIRS="`ifconfig | gawk '/^\w/ { nic = gensub(/^(.*):.*/,\"\\\\1\",\"g\",$1)}
/inet addr:.*/ {match($0,/inet addr:[[:digit:]\.]+/)
ip=substr($0,RSTART+10,RLENGTH-10)
printf \"%s_%s\\n\",nic,ip }'`"

# Restore the language setting
LANG=$GUARDDOG_BACKUP_LANG
LC_ALL=$GUARDDOG_BACKUP_LC_ALL
export LANG
export LC_ALL

# Activate rp_filter for each NIC, except for NICs that are using
# an IP that is involved with IPSEC.
for X in $IP_NIC_PAIRS ; do
  NIC="`echo \"$X\" | cut -f 1 -d _`"
  IP="`echo \"$X\" | cut -f 2 -d _`"
  RPF="1"
  for SEC_IP in $IPSEC_IPS ; do
    if [[ $SEC_IP == $IP ]]; then
      RPF="0"
    fi
  done
  echo $RPF > /proc/sys/net/ipv4/conf/$NIC/rp_filter  2 > /dev/null
done

echo  1  > /proc/sys/net/ipv4/conf/default/rp_filter  2 > /dev/null
echo "1024 5999" > /proc/sys/net/ipv4/ip_local_port_range  2 > /dev/null

[ $GUARDDOG_VERBOSE -eq  1  ] && echo "Configuring firewall rules."
# Set up our logging and packet 'executing' chains
iptables -N logdrop2
iptables -A logdrop2 -j LOG --log-prefix "DROPPED " --log-level 4 --log-ip-options --log-tcp-options --log-tcp-sequence 
iptables -A logdrop2 -j DROP
iptables -N logdrop
iptables -A logdrop -m limit --limit 1/second --limit-burst 10 -j logdrop2
iptables -A logdrop -m limit --limit 2/minute --limit-burst 1 -j LOG --log-prefix "LIMITED " --log-level 4
iptables -A logdrop -j DROP
iptables -N logreject2
iptables -A logreject2 -j LOG --log-prefix "REJECTED " --log-level 4 --log-ip-options --log-tcp-options --log-tcp-sequence 
iptables -A logreject2 -p tcp -j REJECT --reject-with tcp-reset
iptables -A logreject2 -p udp -j REJECT --reject-with icmp-port-unreachable
iptables -A logreject2 -j DROP
iptables -N logreject
iptables -A logreject -m limit --limit 1/second --limit-burst 10 -j logreject2
iptables -A logreject -m limit --limit 2/minute --limit-burst 1 -j LOG --log-prefix "LIMITED " --log-level 4
iptables -A logreject -p tcp -j REJECT --reject-with tcp-reset
iptables -A logreject -p udp -j REJECT --reject-with icmp-port-unreachable
iptables -A logreject -j DROP
iptables -N logaborted2
iptables -A logaborted2 -j LOG --log-prefix "ABORTED " --log-level 4 --log-ip-options --log-tcp-options --log-tcp-sequence 
iptables -A logaborted2 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -N logaborted
iptables -A logaborted -m limit --limit 1/second --limit-burst 10 -j logaborted2
iptables -A logaborted -m limit --limit 2/minute --limit-burst 1 -j LOG --log-prefix "LIMITED " --log-level 4

# Allow loopback traffic.
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Switch the current language for a moment
GUARDDOG_BACKUP_LANG=$LANG
GUARDDOG_BACKUP_LC_ALL=$LC_ALL
LANG=US
LC_ALL=US
export LANG
export LC_ALL
# Accept broadcasts from ourself.
IP_BCAST_PAIRS="`ifconfig | gawk '/^\w/ { nic = gensub(/^(.*):.*/,\"\\\\1\",\"g\",$1)}
/inet addr:.*Bcast/ {match($0,/inet addr:[[:digit:]\\.]+/)
ip=substr($0,RSTART+10,RLENGTH-10)
match($0,/Bcast:[[:digit:]\\.]+/)
bcast = substr($0,RSTART+6,RLENGTH-6)
printf \"%s_%s_%s\\n\",nic,ip,bcast }'`"
# Restore the language setting
LANG=$GUARDDOG_BACKUP_LANG
LC_ALL=$GUARDDOG_BACKUP_LC_ALL
export LANG
export LC_ALL
for X in $IP_BCAST_PAIRS ; do
  NIC="`echo \"$X\" | cut -f 1 -d _`"
  IP="`echo \"$X\" | cut -f 2 -d _`"
  BCAST="`echo \"$X\" | cut -f 3 -d _`"
  iptables -A INPUT -i $NIC -s $IP -d $BCAST -j ACCEPT
done

# Detect aborted TCP connections.
iptables -A INPUT -m state --state ESTABLISHED,RELATED -p tcp --tcp-flags RST RST -j logaborted
# Quickly allow anything that belongs to an already established connection.
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow certain critical ICMP types
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT  # Dest unreachable
iptables -A OUTPUT -p icmp --icmp-type destination-unreachable -j ACCEPT # Dest unreachable
iptables -A FORWARD -p icmp --icmp-type destination-unreachable -j ACCEPT &> /dev/null  # Dest unreachable
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT            # Time exceeded
iptables -A OUTPUT -p icmp --icmp-type time-exceeded -j ACCEPT           # Time exceeded
iptables -A FORWARD -p icmp --icmp-type time-exceeded -j ACCEPT &> /dev/null # Time exceeded
iptables -A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT        # Parameter Problem
iptables -A OUTPUT -p icmp --icmp-type parameter-problem -j ACCEPT       # Parameter Problem
iptables -A FORWARD -p icmp --icmp-type parameter-problem -j ACCEPT &> /dev/null # Parameter Problem

# Switch the current language for a moment
GUARDDOG_BACKUP_LANG=$LANG
GUARDDOG_BACKUP_LC_ALL=$LC_ALL
LANG=US
LC_ALL=US
export LANG
export LC_ALL
# Work out our local IPs.
NIC_IP="`ifconfig | gawk '/^\w/ { nic = gensub(/^(.*):.*/,\"\\\\1\",\"g\",\$1)}
/inet addr:/ { match(\$0,/inet addr:[[:digit:]\\.]+/)
printf \"%s_%s\\n\",nic,substr(\$0,RSTART+10,RLENGTH-10) }
/Bcast/ { match(\$0,/Bcast:[[:digit:]\\.]+/)
printf \"%s_%s\\n\",nic,substr(\$0,RSTART+6,RLENGTH-6) }'`"
# Restore the language setting
LANG=$GUARDDOG_BACKUP_LANG
LC_ALL=$GUARDDOG_BACKUP_LC_ALL
export LANG
export LC_ALL
# Create the nicfilt chain
iptables -N nicfilt
GOT_LO= 0 
NIC_COUNT= 0 
for X in $NIC_IP ; do
    NIC="`echo \"$X\" | cut -f 1 -d _`"
    iptables -A nicfilt -i $NIC -j RETURN
    # We also take this opportunity to see if we only have a lo interface.
    if [ $NIC == "lo" ]; then
        GOT_LO= 1 
    fi
    let NIC_COUNT=$NIC_COUNT+ 1 
done
IPS="`echo \"$NIC_IP\" | cut -f 2 -d _`"
iptables -A nicfilt -j logdrop
# Do we have just a lo interface?
if [ $GOT_LO -eq  1  ] && [ $NIC_COUNT -eq  1  ] ; then
  MIN_MODE= 1 
else
  MIN_MODE= 0 
fi
# Are there *any* interfaces?
if [ $NIC_COUNT -eq  0  ] ; then
  MIN_MODE= 1 
fi
# If we only have a lo interface or no interfaces then we assume that DNS
# is not going to work and just skip any iptables calls that need DNS.

# Create the filter chains
# Create chain to filter traffic going from 'Internet' to 'Local'
iptables -N f0to1
# Create chain to filter traffic going from 'Local' to 'Internet'
iptables -N f1to0
# Add rules to the filter chains

# Traffic from 'Internet' to 'Local'

# Rejected traffic from 'Internet' to 'Local'

# Traffic from 'Local' to 'Internet'

# Rejected traffic from 'Local' to 'Internet'

# Place DROP and log rules at the end of our filter chains.
# Failing all the rules above, we log and DROP the packet.
iptables -A f0to1 -j logdrop
# Failing all the rules above, we log and DROP the packet.
iptables -A f1to0 -j logdrop

# Add some temp DNS accept rules to the input and output chains.
# This is so that we can pass domain names to ipchains and have iptables be
# able to look it up without being blocked by the our half-complete firewall.
if [ $MIN_MODE -eq  0  ] ; then
  iptables -A OUTPUT -p tcp --sport 0:65535 --dport 53:53 -j ACCEPT
  iptables -A INPUT -p tcp ! --syn --sport 53:53 --dport 0:65535 -j ACCEPT
  iptables -A OUTPUT -p udp --sport 0:65535 --dport 53:53 -j ACCEPT
  iptables -A INPUT -p udp --sport 53:53 --dport 0:65535 -j ACCEPT
fi

# Chain to split traffic coming from zone 'Internet' by dest zone
iptables -N s0
for X in $IPS ; do
    iptables -A s0 -d $X -j f0to1
done
if [ $MIN_MODE -eq  0  ] ; then
    true # make sure this if [] has at least something in it.
fi
iptables -A s0 -j logdrop

# Chain to split traffic coming from zone 'Local' by dest zone
iptables -N s1
if [ $MIN_MODE -eq  0  ] ; then
    true # make sure this if [] has at least something in it.
fi
iptables -A s1 -j f1to0
# Create the srcfilt chain
iptables -N srcfilt
if [ $MIN_MODE -eq  0  ] ; then
    true # make sure this if [] has at least something in it.
fi
# Assume internet default rule
iptables -A srcfilt -j s0

if [ $MIN_MODE -eq  0  ] ; then
  # Remove the temp DNS accept rules
  iptables -D OUTPUT -p tcp --sport 0:65535 --dport 53:53 -j ACCEPT
  iptables -D INPUT -p tcp ! --syn --sport 53:53 --dport 0:65535 -j ACCEPT
  iptables -D OUTPUT -p udp --sport 0:65535 --dport 53:53 -j ACCEPT
  iptables -D INPUT -p udp --sport 53:53 --dport 0:65535 -j ACCEPT
fi

# The output chain is very simple. We direct everything to the
# 'source is local' split chain.
iptables -A OUTPUT -j s1

iptables -A INPUT -j nicfilt
iptables -A INPUT -j srcfilt

# All traffic on the forward chains goes to the srcfilt chain.
iptables -A FORWARD -j srcfilt &> /dev/null

logger -p auth.info -t guarddog Finished configuring firewall
[ $GUARDDOG_VERBOSE -eq  1  ] && echo "Finished."
fi;
fi;
true