firewall.sh

File Location And Role

The following paths are searched, in this order: /etc/firewall.sh, /data/etc/firewall.sh and /boot/firewall.sh. Files that are present are run in order to set up the firewall.

No firewall files are present by default and should be created by the user, if a firewall is needed.

File Format

The file is a shell script that should contain iptables commands. There's no need for executable flag.

Example

The following firewall script blocks access to the system on all ports except 22 and 80, as well as ping:

# default policies
iptables -t filter -P INPUT DROP
iptables -t filter -P OUTPUT ACCEPT
iptables -t filter -P FORWARD ACCEPT

# locally originating
iptables -t filter -A INPUT -i lo -j ACCEPT

# established
iptables -t filter -A INPUT -m state --state established,related -j ACCEPT

# inbound traffic
iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A INPUT -p icmp -j ACCEPT