linux firewall - not flawless

Code:

#Set variable
IPT=/sbin/iptables
MAILSER=192.168.1.1
#Load module
modprobe ip_conntrack
modprobe ip_conntrack_ftp
#clear and flush rule
$IPT -F
$IPT -X
#Set default policy
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP
#Set input chain
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -p tcp --dport 22 -j LOG --log-level 5 --log-prefix "IPTABLES:"
$IPT -A INPUT -p tcp -d $MAILSER --dport 22 -j ACCEPT
$IPT -A INPUT -p tcp -d $MAILSER --dport 80 -j ACCEPT
$IPT -A INPUT -p udp --dport 53 -j ACCEPT
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -p tcp -d $MAILSER --dport 25 -j ACCEPT
$IPT -A INPUT -p tcp -d $MAILSER --dport 110 -j ACCEPT
$IPT -A INPUT -p tcp -d $MAILSER --dport 143 -j ACCEPT
#Set output chain
$IPT -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -p udp --sport 53 -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
$IPT -A OUTPUT -p tcp --sport 25 -j ACCEPT
$IPT -A OUTPUT -p tcp --sport 110 -j ACCEPT
$IPT -A OUTPUT -p tcp --sport 143 -j ACCEPT
#Set forward chain
$IPT -A POSTROUTING -t nat -s 192.168.0.0/24 -o eth0 -j MASQUERADE
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -s 192.168.0.0/24 -j ACCEPT
#4444/445/69/135/139
iptables -A FORWARD -p tcp --dport 4444 -j DROP
iptables -A FORWARD -p udp --dport 4444 -j DROP
#
iptables -A FORWARD -p tcp --dport 445 -j DROP
iptables -A FORWARD -p udp --dport 445 -j DROP
#
iptables -A FORWARD -p tcp --dport 69 -j DROP
iptables -A FORWARD -p udp --dport 69 -j DROP
#
iptables -A FORWARD -p tcp --dport 135 -j DROP
iptables -A FORWARD -p udp --dport 135 -j DROP
#
iptables -A FORWARD -p tcp --dport 139 -j DROP
iptables -A FORWARD -p udp --dport 139 -j DROP
#
echo 1 > /proc/sys/net/ipv4/ip_forward

me and a friend made this a while back, i kind of abandoned him while he finished it but he messed up so bad on it i pretty much had to re-do the whole thing, it hasn't been tested so anyone with linux who want's to try go ahead and you can pm me with the flaws so i can fix them.

 

Maybe post some more info about it

 

If you have Linux, you know how to use this. If you don't have Linux, your not going to use this anyways. Linux user's will know where it goes. If it's imperative i post more information about it, I will, but I don't see any reason to for Xp and Vista user's.

 

Some of us Linux users aren't that advanced. He means "what exactly does this do before I go and stick it in my config file?"