用Guarddog配置iptables后网速变慢

小楼东风

有没有解决办法。配置后的rc.firewall。

###############################
###### iptables firewall ######
###############################
logger -p auth.info -t guarddog Configuring iptables firewall now.
[ $GUARDDOG_VERBOSE -eq 1 ] && echo "Using iptables."
[ $GUARDDOG_VERBOSE -eq 1 ] && echo "Resetting firewall rules."
# Shut down all traffic
iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -P OUTPUT DROP

# Delete any existing chains
iptables -F
iptables -X

# Load any special kernel modules.
[ $GUARDDOG_VERBOSE -eq 1 ] && echo "Loading kernel modules."
modprobe ip_conntrack_irc
modprobe ip_conntrack_ftp

[ $GUARDDOG_VERBOSE -eq 1 ] && echo "Setting kernel parameters."
# Turn on kernel IP spoof protection
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts 2> /dev/null
# Set the TCP timestamps config
echo 0 > /proc/sys/net/ipv4/tcp_timestamps 2> /dev/null
# Enable TCP SYN Cookie Protection if available
test -e /proc/sys/net/ipv4/tcp_syncookies && echo 1 > /proc/sys/net/ipv4/tcp_syncookies 2> /dev/null
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route 2> /dev/null
echo 0 > /proc/sys/net/ipv4/conf/default/accept_source_route 2> /dev/null
# Log truly weird packets.
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians 2> /dev/null
echo 1 > /proc/sys/net/ipv4/conf/default/log_martians 2> /dev/null
# Switch the current language for a moment
GUARDDOG_BACKUP_LANG=$LANG
GUARDDOG_BACKUP_LC_ALL=$LC_ALL
LANG=US
LC_ALL=US
export LANG
export LC_ALL
# Set kernel rp_filter. NICs used for IPSEC should not have rp_fitler turned on.
# Find the IPs of any ipsecX NICs
IPSEC_IPS="`ifconfig | gawk '/^ipsec\w/ { grabip = 1}
/inet addr:[[:digit:]\\.]+/ { if(grabip==1) printf \"%s \",gensub(/^.*inet addr[[:digit:]\\.]+).*$/,\"\\\\1\",\"g\",$0)
grabip = 0}'`"
# Build a list of NIC names and metching IPs
IP_NIC_PAIRS="`ifconfig | gawk '/^\w/ { nic = gensub(/^(.*):.*/,\"\\\\1\",\"g\",$1)}
/inet addr:.*/ {match($0,/inet addr:[[:digit:]\.]+/)
ip=substr($0,RSTART+10,RLENGTH-10)
printf \"%s_%s\\n\",nic,ip }'`"

# Restore the language setting
LANG=$GUARDDOG_BACKUP_LANG
LC_ALL=$GUARDDOG_BACKUP_LC_ALL
export LANG
export LC_ALL

# Activate rp_filter for each NIC, except for NICs that are using
# an IP that is involved with IPSEC.
for X in $IP_NIC_PAIRS ; do
  NIC="`echo \"$X\" | cut -f 1 -d _`"
  IP="`echo \"$X\" | cut -f 2 -d _`"
  RPF="1"
  for SEC_IP in $IPSEC_IPS ; do
    if [[ $SEC_IP == $IP ]]; then
      RPF="0"
    fi
  done
  echo $RPF > /proc/sys/net/ipv4/conf/$NIC/rp_filter 2> /dev/null
done

echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter 2> /dev/null
echo "1024 5999" > /proc/sys/net/ipv4/ip_local_port_range 2> /dev/null

[ $GUARDDOG_VERBOSE -eq 1 ] && echo "Configuring firewall rules."
# Set up our logging and packet 'executing' chains
iptables -N logdrop2
iptables -A logdrop2 -j LOG --log-prefix "DROPPED " --log-level 4 --log-ip-options --log-tcp-options --log-tcp-sequence
iptables -A logdrop2 -j DROP
iptables -N logdrop
iptables -A logdrop -m limit --limit 1/second --limit-burst 10 -j logdrop2
iptables -A logdrop -m limit --limit 2/minute --limit-burst 1 -j LOG --log-prefix "LIMITED " --log-level 4
iptables -A logdrop -j DROP
iptables -N logreject2
iptables -A logreject2 -j LOG --log-prefix "REJECTED " --log-level 4 --log-ip-options --log-tcp-options --log-tcp-sequence
iptables -A logreject2 -p tcp -j REJECT --reject-with tcp-reset
iptables -A logreject2 -p udp -j REJECT --reject-with icmp-port-unreachable
iptables -A logreject2 -j DROP
iptables -N logreject
iptables -A logreject -m limit --limit 1/second --limit-burst 10 -j logreject2
iptables -A logreject -m limit --limit 2/minute --limit-burst 1 -j LOG --log-prefix "LIMITED " --log-level 4
iptables -A logreject -p tcp -j REJECT --reject-with tcp-reset
iptables -A logreject -p udp -j REJECT --reject-with icmp-port-unreachable
iptables -A logreject -j DROP
iptables -N logaborted2
iptables -A logaborted2 -j LOG --log-prefix "ABORTED " --log-level 4 --log-ip-options --log-tcp-options --log-tcp-sequence
iptables -A logaborted2 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -N logaborted
iptables -A logaborted -m limit --limit 1/second --limit-burst 10 -j logaborted2
iptables -A logaborted -m limit --limit 2/minute --limit-burst 1 -j LOG --log-prefix "LIMITED " --log-level 4

# Allow loopback traffic.
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Switch the current language for a moment
GUARDDOG_BACKUP_LANG=$LANG
GUARDDOG_BACKUP_LC_ALL=$LC_ALL
LANG=US
LC_ALL=US
export LANG
export LC_ALL
# Accept broadcasts from ourself.
IP_BCAST_PAIRS="`ifconfig | gawk '/^\w/ { nic = gensub(/^(.*):.*/,\"\\\\1\",\"g\",$1)}
/inet addr:.*Bcast/ {match($0,/inet addr:[[:digit:]\\.]+/)
ip=substr($0,RSTART+10,RLENGTH-10)
match($0,/Bcast:[[:digit:]\\.]+/)
bcast = substr($0,RSTART+6,RLENGTH-6)
printf \"%s_%s_%s\\n\",nic,ip,bcast }'`"
# Restore the language setting
LANG=$GUARDDOG_BACKUP_LANG
LC_ALL=$GUARDDOG_BACKUP_LC_ALL
export LANG
export LC_ALL
for X in $IP_BCAST_PAIRS ; do
  NIC="`echo \"$X\" | cut -f 1 -d _`"
  IP="`echo \"$X\" | cut -f 2 -d _`"
  BCAST="`echo \"$X\" | cut -f 3 -d _`"
  iptables -A INPUT -i $NIC -s $IP -d $BCAST -j ACCEPT
done

# Detect aborted TCP connections.
iptables -A INPUT -m state --state ESTABLISHED,RELATED -p tcp --tcp-flags RST RST -j logaborted
# Quickly allow anything that belongs to an already established connection.
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow certain critical ICMP types
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT  # Dest unreachable
iptables -A OUTPUT -p icmp --icmp-type destination-unreachable -j ACCEPT # Dest unreachable
iptables -A FORWARD -p icmp --icmp-type destination-unreachable -j ACCEPT &> /dev/null  # Dest unreachable
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT            # Time exceeded
iptables -A OUTPUT -p icmp --icmp-type time-exceeded -j ACCEPT           # Time exceeded
iptables -A FORWARD -p icmp --icmp-type time-exceeded -j ACCEPT &> /dev/null # Time exceeded
iptables -A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT        # Parameter Problem
iptables -A OUTPUT -p icmp --icmp-type parameter-problem -j ACCEPT       # Parameter Problem
iptables -A FORWARD -p icmp --icmp-type parameter-problem -j ACCEPT &> /dev/null # Parameter Problem

# Switch the current language for a moment
GUARDDOG_BACKUP_LANG=$LANG
GUARDDOG_BACKUP_LC_ALL=$LC_ALL
LANG=US
LC_ALL=US
export LANG
export LC_ALL
# Work out our local IPs.
NIC_IP="`ifconfig | gawk '/^\w/ { nic = gensub(/^(.*):.*/,\"\\\\1\",\"g\",\$1)}
/inet addr:/ { match(\$0,/inet addr:[[:digit:]\\.]+/)
printf \"%s_%s\\n\",nic,substr(\$0,RSTART+10,RLENGTH-10) }
/Bcast/ { match(\$0,/Bcast:[[:digit:]\\.]+/)
printf \"%s_%s\\n\",nic,substr(\$0,RSTART+6,RLENGTH-6) }'`"
# Restore the language setting
LANG=$GUARDDOG_BACKUP_LANG
LC_ALL=$GUARDDOG_BACKUP_LC_ALL
export LANG
export LC_ALL
# Create the nicfilt chain
iptables -N nicfilt
GOT_LO=0
NIC_COUNT=0
for X in $NIC_IP ; do
    NIC="`echo \"$X\" | cut -f 1 -d _`"
    iptables -A nicfilt -i $NIC -j RETURN
    # We also take this opportunity to see if we only have a lo interface.
    if [ $NIC == "lo" ]; then
        GOT_LO=1
    fi
    let NIC_COUNT=$NIC_COUNT+1
done
IPS="`echo \"$NIC_IP\" | cut -f 2 -d _`"
iptables -A nicfilt -j logdrop
# Do we have just a lo interface?
if [ $GOT_LO -eq 1 ] && [ $NIC_COUNT -eq 1 ] ; then
  MIN_MODE=1
else
  MIN_MODE=0
fi
# Are there *any* interfaces?
if [ $NIC_COUNT -eq 0 ] ; then
  MIN_MODE=1
fi
# If we only have a lo interface or no interfaces then we assume that DNS
# is not going to work and just skip any iptables calls that need DNS.

# Create the filter chains
# Create chain to filter traffic going from 'Internet' to 'Local'
iptables -N f0to1
# Create chain to filter traffic going from 'Local' to 'Internet'
iptables -N f1to0
# Add rules to the filter chains

# Traffic from 'Internet' to 'Local'

# Rejected traffic from 'Internet' to 'Local'

# Traffic from 'Local' to 'Internet'
# Allow 'irc'
# Server connection
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 6660:6669 -m state --state NEW -j ACCEPT
#  - Handled by netfilter state tracking
# Allow 'jabber'
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 5222:5222 -m state --state NEW -j ACCEPT
# Jabber over Secure Socket Layer
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 5223:5223 -m state --state NEW -j ACCEPT
# Allow 'ymessenger'
# Login to network
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 5050:5050 -m state --state NEW -j ACCEPT
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 23:23 -m state --state NEW -j ACCEPT
# Conference
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 5000:5001 -m state --state NEW -j ACCEPT
# Conference
iptables -A f1to0 -p udp --sport 1024:5999 --dport 5000:5000 -j ACCEPT
# Allow 'bt-tracker'
# BitTorrent Tracker
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 6969:6969 -m state --state NEW -j ACCEPT
# Allow 'coldfusion_standalone'
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 8500:8500 -m state --state NEW -j ACCEPT
# Allow 'gnutella'
iptables -A f1to0 -p tcp --sport 0:65535 --dport 6346:6346 -m state --state NEW -j ACCEPT
# Allow 'nfs'
# RPC port mapper service
iptables -A f1to0 -p tcp --sport 0:65535 --dport 111:111 -m state --state NEW -j ACCEPT
# RPC port mapper service
iptables -A f1to0 -p udp --sport 0:65535 --dport 111:111 -j ACCEPT
# mountd
iptables -A f1to0 -p tcp --sport 0:65535 --dport 1024:65535 -m state --state NEW -j ACCEPT
# mountd
iptables -A f1to0 -p udp --sport 0:65535 --dport 0:65535 -j ACCEPT
# NFS data
iptables -A f1to0 -p tcp --sport 0:65535 --dport 2049:2049 -m state --state NEW -j ACCEPT
# NFS data
iptables -A f1to0 -p udp --sport 0:65535 --dport 2049:2049 -j ACCEPT
# Allow 'smtp'
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 25:25 -m state --state NEW -j ACCEPT
# Allow 'windowsmedia'
# Microsoft Media Server with TCP based transport (MMST)
iptables -A f1to0 -p tcp --sport 0:65535 --dport 1755:1755 -m state --state NEW -j ACCEPT
# Microsoft Media Server with UDP based transport (MMSU)
iptables -A f1to0 -p udp --sport 0:65535 --dport 1755:1755 -j ACCEPT
# Allow 'audiogalaxy'
# Web connection to the Audiogalaxy site.
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 80:80 -m state --state NEW -j ACCEPT
# Download connection.
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 41000:41999 -m state --state NEW -j ACCEPT
# Serving connection.
iptables -A f0to1 -p tcp --sport 1024:65535 --dport 41000:41999 -m state --state NEW -j ACCEPT
# Allow 'blubster'
# Data download
iptables -A f1to0 -p udp --sport 1024:65535 --dport 41170:41170 -j ACCEPT
# Data upload
iptables -A f0to1 -p udp --sport 1024:65535 --dport 41170:41170 -j ACCEPT
# Allow 'ftp'
# Control connection
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 21:21 -m state --state NEW -j ACCEPT
# Data connection
#  - Handled by netfilter state tracking
# Data connection passive mode
#  - Handled by netfilter state tracking
# Allow 'imap'
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 143:143 -m state --state NEW -j ACCEPT
iptables -A f1to0 -p udp --sport 0:65535 --dport 143:143 -j ACCEPT
# Allow 'http'
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 80:80 -m state --state NEW -j ACCEPT
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 8080:8080 -m state --state NEW -j ACCEPT
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 8008:8008 -m state --state NEW -j ACCEPT
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 8000:8000 -m state --state NEW -j ACCEPT
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 8888:8888 -m state --state NEW -j ACCEPT
# Allow 'rsync'
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 873:873 -m state --state NEW -j ACCEPT
# Allow 'aim'
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 5190:5193 -m state --state NEW -j ACCEPT
iptables -A f1to0 -p udp --sport 1024:5999 --dport 5190:5193 -j ACCEPT
# Allow 'cvspserver'
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 2401:2401 -m state --state NEW -j ACCEPT
# Allow 'legatonetworker'
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 7937:9936 -m state --state NEW -j ACCEPT
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 10001:30000 -m state --state NEW -j ACCEPT
iptables -A f1to0 -p udp --sport 1024:5999 --dport 7937:9936 -j ACCEPT
iptables -A f1to0 -p udp --sport 1024:5999 --dport 10001:30000 -j ACCEPT
# Allow 'netmeeting'
# Internet Locator Service (ILS)
iptables -A f1to0 -p tcp --sport 0:65535 --dport 389:389 -m state --state NEW -j ACCEPT
# User Location Service
iptables -A f1to0 -p tcp --sport 0:65535 --dport 522:522 -m state --state NEW -j ACCEPT
# T.120
iptables -A f1to0 -p tcp --sport 0:65535 --dport 1503:1503 -m state --state NEW -j ACCEPT
# H.323 call set-up
iptables -A f1to0 -p tcp --sport 0:65535 --dport 1720:1720 -m state --state NEW -j ACCEPT
# Audio call control
iptables -A f1to0 -p tcp --sport 0:65535 --dport 1731:1731 -m state --state NEW -j ACCEPT
# H.323 call control
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 1024:65535 -m state --state NEW -j ACCEPT
# H.323 streaming
iptables -A f1to0 -p udp --sport 1024:5999 --dport 1024:65535 -j ACCEPT
# Allow 'powwow'
iptables -A f1to0 -p tcp --sport 0:65535 --dport 13223:13223 -m state --state NEW -j ACCEPT
iptables -A f1to0 -p udp --sport 0:65535 --dport 13223:13223 -j ACCEPT
# Allow 'https'
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 443:443 -m state --state NEW -j ACCEPT
# Allow 'pop3'
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 110:110 -m state --state NEW -j ACCEPT
# Allow 'imaps'
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 993:993 -m state --state NEW -j ACCEPT
# Allow 'ncpfs'
# NCP Requests
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 524:524 -m state --state NEW -j ACCEPT
# NCP for time synchronization
iptables -A f1to0 -p udp --sport 1024:5999 --dport 524:524 -j ACCEPT
# SLP Requests
iptables -A f1to0 -p udp --sport 427:427 --dport 427:427 -j ACCEPT
# SLP Requests
iptables -A f1to0 -p tcp --sport 427:427 --dport 427:427 -m state --state NEW -j ACCEPT
# CMD
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 2303:2303 -m state --state NEW -j ACCEPT
# CMD
iptables -A f1to0 -p udp --sport 2645:2645 --dport 2645:2645 -j ACCEPT
# Allow 'realplayer'
iptables -A f1to0 -p tcp --sport 0:65535 --dport 554:554 -m state --state NEW -j ACCEPT
iptables -A f1to0 -p tcp --sport 0:65535 --dport 7070:7070 -m state --state NEW -j ACCEPT
iptables -A f0to1 -p udp --sport 0:65535 --dport 6970:7170 -j ACCEPT
# Allow 'bt-peer'
# BitTorrent Peer
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 6881:6889 -m state --state NEW -j ACCEPT
iptables -A f0to1 -p tcp --sport 1024:65535 --dport 6881:6889 -m state --state NEW -j ACCEPT
# Allow 'winmx'
iptables -A f0to1 -p tcp --sport 1024:65535 --dport 6699:6699 -m state --state NEW -j ACCEPT
iptables -A f1to0 -p tcp --sport 1024:65535 --dport 6699:6699 -m state --state NEW -j ACCEPT
iptables -A f0to1 -p udp --sport 1024:65535 --dport 6257:6257 -j ACCEPT
iptables -A f1to0 -p udp --sport 6257:6257 --dport 1024:65535 -j ACCEPT
# Outgoing connection to WinMX main server
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 5690:5690 -m state --state NEW -j ACCEPT
# Outgoing connection to WinMX servers
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 7890:7893 -m state --state NEW -j ACCEPT
# Allow 'edonkey2000'
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 4661:4661 -m state --state NEW -j ACCEPT
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 4662:4662 -m state --state NEW -j ACCEPT
iptables -A f0to1 -p tcp --sport 1024:65535 --dport 4662:4662 -m state --state NEW -j ACCEPT
iptables -A f1to0 -p udp --sport 1024:5999 --dport 4665:4665 -j ACCEPT
iptables -A f1to0 -p udp --sport 1024:5999 --dport 4666:4666 -j ACCEPT
iptables -A f0to1 -p udp --sport 1024:65535 --dport 4666:4666 -j ACCEPT
# Allow 'msnmessenger'
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 1863:1863 -m state --state NEW -j ACCEPT
# Allow 'fasttrack'
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 1214:1214 -m state --state NEW -j ACCEPT
iptables -A f1to0 -p udp --sport 1024:5999 --dport 1214:1214 -j ACCEPT
# Allow 'pop2'
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 109:109 -m state --state NEW -j ACCEPT
# Allow 'icq'
iptables -A f1to0 -p udp --sport 0:65535 --dport 4000:4000 -j ACCEPT
iptables -A f1to0 -p tcp --sport 1024:65535 --dport 1024:65535 -m state --state NEW -j ACCEPT
iptables -A f0to1 -p tcp --sport 1024:65535 --dport 1024:65535 -m state --state NEW -j ACCEPT
# Allow 'directconnect'
# This is used for connecting to hubs and other users
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 411:415 -m state --state NEW -j ACCEPT
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 1411:1415 -m state --state NEW -j ACCEPT
# This is used for connecting to hubs and other users
iptables -A f1to0 -p udp --sport 1024:5999 --dport 411:415 -j ACCEPT
iptables -A f1to0 -p udp --sport 1024:5999 --dport 1411:1415 -j ACCEPT
# DC Active mode - usable by an unprivileged user
iptables -A f1to0 -p tcp --sport 1411:1415 --dport 0:65535 -m state --state NEW -j ACCEPT
# DC Active mode - usable by an unprivileged user
iptables -A f1to0 -p udp --sport 1411:1415 --dport 0:65535 -j ACCEPT
# DC Active mode - usable by an unprivileged user
iptables -A f0to1 -p tcp --sport 0:65535 --dport 1411:1415 -m state --state NEW -j ACCEPT
# DC Active mode - usable by an unprivileged user
iptables -A f0to1 -p udp --sport 0:65535 --dport 1411:1415 -j ACCEPT
# Allow 'pop3s'
iptables -A f1to0 -p tcp --sport 1024:5999 --dport 995:995 -m state --state NEW -j ACCEPT

# Rejected traffic from 'Local' to 'Internet'

# Place DROP and log rules at the end of our filter chains.
# Failing all the rules above, we log and DROP the packet.
iptables -A f0to1 -j logdrop
# Failing all the rules above, we log and DROP the packet.
iptables -A f1to0 -j logdrop

# Add some temp DNS accept rules to the input and output chains.
# This is so that we can pass domain names to ipchains and have iptables be
# able to look it up without being blocked by the our half-complete firewall.
if [ $MIN_MODE -eq 0 ] ; then
  iptables -A OUTPUT -p tcp --sport 0:65535 --dport 53:53 -j ACCEPT
  iptables -A INPUT -p tcp ! --syn --sport 53:53 --dport 0:65535 -j ACCEPT
  iptables -A OUTPUT -p udp --sport 0:65535 --dport 53:53 -j ACCEPT
  iptables -A INPUT -p udp --sport 53:53 --dport 0:65535 -j ACCEPT
fi

# Chain to split traffic coming from zone 'Internet' by dest zone
iptables -N s0
for X in $IPS ; do
    iptables -A s0 -d $X -j f0to1
done
if [ $MIN_MODE -eq 0 ] ; then
    true # make sure this if [] has at least something in it.
fi
iptables -A s0 -j logdrop

# Chain to split traffic coming from zone 'Local' by dest zone
iptables -N s1
if [ $MIN_MODE -eq 0 ] ; then
    true # make sure this if [] has at least something in it.
fi
iptables -A s1 -j f1to0
# Create the srcfilt chain
iptables -N srcfilt
if [ $MIN_MODE -eq 0 ] ; then
    true # make sure this if [] has at least something in it.
fi
# Assume internet default rule
iptables -A srcfilt -j s0

if [ $MIN_MODE -eq 0 ] ; then
  # Remove the temp DNS accept rules
  iptables -D OUTPUT -p tcp --sport 0:65535 --dport 53:53 -j ACCEPT
  iptables -D INPUT -p tcp ! --syn --sport 53:53 --dport 0:65535 -j ACCEPT
  iptables -D OUTPUT -p udp --sport 0:65535 --dport 53:53 -j ACCEPT
  iptables -D INPUT -p udp --sport 53:53 --dport 0:65535 -j ACCEPT
fi

# The output chain is very simple. We direct everything to the
# 'source is local' split chain.
iptables -A OUTPUT -j s1

iptables -A INPUT -j nicfilt
iptables -A INPUT -j srcfilt

# All traffic on the forward chains goes to the srcfilt chain.
iptables -A FORWARD -j srcfilt &> /dev/null

logger -p auth.info -t guarddog Finished configuring firewall
[ $GUARDDOG_VERBOSE -eq 1 ] && echo "Finished."
fi;
fi;
true