### FILTER RULES ###

*filter

:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p icmp --icmp-type 3/4 -j ACCEPT
-A INPUT -p icmp --icmp-type 3/3 -j ACCEPT
-A INPUT -p icmp --icmp-type 3/1 -j ACCEPT
-A INPUT -p icmp --icmp-type 4 -j ACCEPT
-A INPUT -p icmp --icmp-type 11 -j ACCEPT
-A INPUT -p icmp --icmp-type 12 -j ACCEPT

-A INPUT -i lo -j ACCEPT

<%= yield :iptables_filter %>

-A INPUT -j LOG --log-prefix "Firewall INPUT: "
-A INPUT -j DROP
-A FORWARD -j LOG --log-prefix "Firewall FORWARD: "
-A FORWARD -j DROP

COMMIT


### NAT Rules ###

*nat

<%= yield :iptables_nat %>

COMMIT