| # Copyright (c) 2011 The Chromium OS Authors. All rights reserved. |
| # Use of this source code is governed by a BSD-style license that can be |
| # found in the LICENSE file. |
| |
| description "Set iptables policies and add rules" |
| author "chromium-os-dev@chromium.org" |
| |
| # We must run eventually even if the UI doesn't come up correctly, |
| # because the Open SSH server depends on us. |
| start on starting failsafe |
| |
| script |
| iptables -P INPUT DROP |
| iptables -P FORWARD DROP |
| iptables -P OUTPUT DROP |
| |
| # Accept everything on the loopback |
| iptables -I INPUT -i lo -j ACCEPT |
| iptables -I OUTPUT -o lo -j ACCEPT |
| |
| # Accept return traffic inbound |
| iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT |
| |
| # Accept icmp echo (NB: icmp echo ratelimiting is done by the kernel) |
| iptables -A INPUT -p icmp -j ACCEPT |
| |
| # Accept new and return traffic outbound |
| iptables -I OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT |
| end script |
