iptables prob

[elite_syntax]

#!/bin/sh
#
# The location of the IPTables binary file on your
system.
IPT="/sbin/iptables"

# The Internet interface.For ADSLor Dial-up users,this
should be "ppp0".
# For a cable modem connection,this probably be
"eth0".
INT="ppp0"


# Out with the old stuff
$IPT -F
$IPT -F INPUT
$IPT -F OUTPUT
$IPT -F FORWARD
$IPT -F -t mangle
$IPT -F -t nat
$IPT -X

# These will setu our policies.
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT

#Use this for NAT or IP Masquerading.
echo 1>/proc/sys/net/ipv4/ip_forward
$IPT -t nat -A POSTROUTING -o $INT -j MASQUERADE


# This for DOS flooding

echo 1>/proc/sys/net/ipv4/tcp_syn_cookies


# This for packet spoofing

echo 1>/proc/sys/net/conf/all/rp_filter


# This rule will accept connection from local
machines.
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -s 192.168.1.0/24 -d 0/0 -p all -j
ACCEPT


#drop bad packets.

$IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j
DROP
$IPT -A INPUT -P tcp --tcp-flags ALL ALL -j DROP
$IPT -A INPUT -P tcp --tcp-flags ALL
SYN,RST,ACK,FIN,URG -j DROP
$IPT -A INPUT -P tcp --tcp-flags ALL NONE -j DROP
$IPT -A INPUT -P tcp --tcp-flags SYN,RST SYN,RST -j
DROP
$IPT -A INPUT -P tcp --tcp-flags SYN,FIN SYN,FIN -j
DROP


#Drop icmp,but only after letting certain types
through.

$IPT -A INPUT -p icmp --icmp-type 0 -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type 3 -j ACCEPT
$IPT -A INPUT -P icmp --icmp-type 11 -j ACCEPT
$IPT -A INPUT -P icmp --icmp-type 8 -m limit 1/second
-j ACCEPT
$IPT -A INPUT -P icmp -j DROP






Why is my firewall script slow me down when i want to surf the net?Did i put something in my script that would of done it?

Can anyone tell me what wroug with my firewall script?:confused:

[phlipant]

in your bad packets section, you can not use -P with -A.
i suspect the entire section can be replaced with

iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG,PSH -j DROP


otherwise, i can not see any reason why it would slow your computer.

[phlipant]

in your icmp section change -P to -p, in addition your match statement needs to use -m limit --limit


iptables -A INPUT -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT

[elite_syntax]

I have probs with my internet shareing now working on my other pc for some reason.:confused: