#!/bin/sh

. /lib/lsb/init-functions

iptables()
{
   log_daemon_msg "iptables $*"
   /sbin/iptables $*  && log_end_msg 0 || log_end_msg 1
}

ip6tables()
{
   log_daemon_msg "ip6tables $*"
   /sbin/ip6tables $*  && log_end_msg 0 || log_end_msg 1
}

ipXtables()
{
   iptables $*
   ip6tables $*
}

case $1 in

   start|restart|reload)
   
      $0 stop

      # General -----------------------------------
      ipXtables -P INPUT DROP
      ipXtables -P FORWARD DROP
      ipXtables -A INPUT -i lo -j ACCEPT
      ipXtables -A INPUT -p icmp -j ACCEPT
      ipXtables -A INPUT -p icmpv6 -j ACCEPT
      ipXtables -A INPUT -p all -m state --state ESTABLISHED,RELATED -j ACCEPT

      
      # paquets inutiles
      ipXtables -A INPUT -p tcp --tcp-flags FIN,URG,PSH FIN,URG,PSH -j DROP
      ipXtables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
      ipXtables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
      ipXtables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
      ipXtables -A INPUT -m pkttype --pkt-type broadcast -j DROP
      
   ;;
   
   stop)

      ipXtables -P INPUT ACCEPT
      ipXtables -P FORWARD ACCEPT
      ipXtables -P OUTPUT ACCEPT

      ipXtables -F
      ipXtables -X
      
      iptables -t nat -F
      iptables -t nat -X
      
   ;;
   
esac