#!/bin/bash

# iptables configuration script for enhanced security

# Define commonly used ports
SSH_PORT=22
MINECRAFT_PORT=25565
DYNMAP_PORT=8123
#HTTP_PORT=80
#HTTPS_PORT=443
#EXAMPLE_UDP_PORT=5021

# Kernel parameters for network protection
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians

# Flush existing iptables rules
/sbin/iptables --flush

# Accept loopback interface traffic
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT

# Default policies
/sbin/iptables --policy INPUT DROP
/sbin/iptables --policy OUTPUT DROP
/sbin/iptables --policy FORWARD DROP

# Accept established connections
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Rate limit SSH connections to prevent brute-force attacks
/sbin/iptables -A INPUT -p tcp --dport $SSH_PORT -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
/sbin/iptables -A INPUT -p tcp --dport $SSH_PORT -m state --state NEW -m recent --set
/sbin/iptables -A INPUT -p tcp --dport $SSH_PORT -m state --state NEW -j ACCEPT

# Open ports for specific services
/sbin/iptables -A INPUT -p tcp --dport $MINECRAFT_PORT -m state --state NEW -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport $DYNMAP_PORT -m state --state NEW -j ACCEPT

# Examples for other services (uncomment as needed)
#/sbin/iptables -A INPUT -p tcp --dport $HTTP_PORT -m state --state NEW -j ACCEPT
#/sbin/iptables -A INPUT -p tcp --dport $HTTPS_PORT -m state --state NEW -j ACCEPT
#/sbin/iptables -A INPUT -p udp --dport $EXAMPLE_UDP_PORT -m state --state NEW -j ACCEPT

# Allow ICMP ping requests
/sbin/iptables -A INPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Drop all other incoming traffic
/sbin/iptables -A INPUT -j DROP

# Display the active rules
/sbin/iptables -nL

# Uncomment the following line to save iptables rules on systems using iptables-persistent or similar
# This may vary depending on your Linux distribution
# sudo iptables-save > /etc/iptables/rules.v4