#!/bin/bash
INTIF="eth0"
INTIP="192.168.1.1"
INTNET="192.168.1.0/24"
LOIF="lo"
LOIP="127.0.0.1"
EXTIF="eth1"
EXTIP="172.16.1.1"
EXTINET="172.16.1.0/24"
TCP_PORTS="80"
HI_PORTS="1024:65535"
IPT="/sbin/iptables"

$IPT -F
$IPT -F -t nat
$IPT -F -t mangle
$IPT -F -t filter
$IPT -t mangle -X
$IPT -t nat -X
$IPT -X
$IPT -P INTPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP
$IPT -A INPUT -i $INTIF -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -o $INTIF -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$IPT -A FORWARD -p tcp -o $INTIF -i $EXTIF -d $INTNET -s $EXTNET --dport $TCP_PORTS -j ACCEPT
$IPT -A FORWARD -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

[color=orange]$IPS  -A  FORWARD  -p  tcp  --tcp-flags  SYN,ACK,FIN,RST  RST  -m limit --limit 1/s -j ACCEPT[/color]