Forum Debian Users Gang

#!/bin/sh

IPT=/sbin/iptables

case "$1" in
start)
###
#firewall flush:
iptables -F
iptables -X
iptables -Z
###
#default policy:
iptables -P INPUT       ACCEPT
iptables -P OUTPUT      ACCEPT
iptables -P FORWARD     ACCEPT
###
#ping switching off:
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all
iptables -A INPUT -i venet0 -s 0/0 -p icmp --icmp-type ping -j DROP

###
$IPT -A INPUT -i venet0 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -i venet0 -p tcp --dport 20 -j ACCEPT
$IPT -A INPUT -i venet0 -p tcp --dport 21 -j ACCEPT
$IPT -A INPUT -i venet0 -p tcp --dport 80 -j ACCEPT
$IPT -A INPUT -i venet0 -p tcp --dport 53 -j ACCEPT
$IPT -A INPUT -i venet0 -p tcp --dport 22 -j ACCEPT #ssh
$IPT -A INPUT -i venet0 -p tcp --dport 6665:6669 -j ACCEPT #irc
###cs
#$IPT -A INPUT -p udp -s 0/0 --dport 1200 -j ACCEPT #cs
#$IPT -A INPUT -p udp -s 0/0 --dport 27015 -j ACCEPT #cs
#$IPT -A INPUT -p tcp -s 0/0 --dport 27015 -j ACCEPT #cs
###
$IPT -A INPUT -i venet0 -p tcp --dport 45000:65000 -j ACCEPT
$IPT -A INPUT -i venet0 -p tcp --dport 60000:64000 -j ACCEPT
###

###
$IPT -A INPUT -i venet0 -j REJECT
#
exit 0
;;

stop)
#firewall flush:
$IPT -F
$IPT -X
$IPT -Z
##
#default policy:
$IPT -P INPUT       ACCEPT
$IPT -P OUTPUT      ACCEPT
$IPT -P FORWARD     ACCEPT
exit 0
;;
*)
echo "Usage: /etc/init.d/firewall {start|stop}"
exit 1
;;
esac

iptables: No chain/target/match by that name.

$IPT -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# lsmod
Module                  Size  Used by

# uname -a
Linux deb 2.6.32-4-pve #1 SMP Tue Mar 8 06:49:04 CET 2011 i686 GNU/Linux