# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [146450:27908421]
:LOGDROP - [0:0]

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT

### IP blacklisting
<% @blacklist_ips.each do |blacklist_ip| -%>
-A INPUT -m state --state NEW -m tcp -p tcp -s <%= blacklist_ip %> -j DROP
<% end -%>
### End IP blacklisting

### Open up public ports
<% @public_ports.each do |port| -%>

<% if port == '22' -%>
# Drop repeated ssh connection attempts within 10 seconds interval
  <% @ssh_source_ips.each do |ssh_src_ip| -%>
-A INPUT -p tcp -m tcp -m state -m recent -s <%= ssh_src_ip %> --dport 22 --state NEW -j LOGDROP --rcheck --seconds 10 --name THROTTLE --rsource
  <% end -%>

# Accept ssh connection if not attempted within past 10 sec.
  <% @ssh_source_ips.each do |ssh_src_ip| -%>
-A INPUT -p tcp -m tcp -m state -m recent -s <%= ssh_src_ip %> --dport 22 --state NEW -j ACCEPT --set --name THROTTLE --rsource
  <% end -%>

# Drop ssh connection attempts from every other ips
-A INPUT -p tcp -s 0.0.0.0/0 --dport 22 -j LOGDROP
<% else -%>
-A INPUT -p tcp -m tcp -m state --state NEW --dport <%= port %> -j ACCEPT
<% end -%>
<% end -%>
### End Open up public ports

### Private ports
<% @private_ports.each do |port| -%>
    -A INPUT -s <%= port[:source] %> -p tcp --dport <%= port[:port] %> -m comment --comment <%= port[:comment] %> -m state --state NEW -j ACCEPT
<% end -%>
### End private ports

# Drop all other connections
-A INPUT -j DROP

<% @ip_blacklists_blocks.each do |ip_blacklists_block| -%>
### External Blacklist block
<%= ip_blacklists_block %>
### End External Blacklist block
<% end -%>

-A LOGDROP -j LOG --log-prefix "RATE LIMIT: " --log-level 6
-A FORWARD -j DROP
-A LOGDROP -j DROP

COMMIT
