Forum Linux.debian/ubuntu parefeu pour linux

bonjour

voilà une idée de parefeu pour init.d
je cherche quelques idées pour l'améliorer
merci

#!/bin/sh

tcp="20,21,22,25,53,80,110,143,443,873,953,993,995,3306,7634" #15 ports max
udp="53" #15 ports max

case $1 in
start | restart)
echo "firewall start restart"

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -F
iptables -X

ip6tables -P INPUT ACCEPT
ip6tables -P FORWARD ACCEPT
ip6tables -P OUTPUT ACCEPT
ip6tables -F
ip6tables -X

iptables -A INPUT -p tcp --match multiport --dport $tcp -j ACCEPT
ip6tables -A INPUT -p tcp --match multiport --dport $tcp -j ACCEPT

iptables -A INPUT -p udp --match multiport --dport $udp -j ACCEPT
ip6tables -A INPUT -p udp --match multiport --dport $udp -j ACCEPT

iptables -A INPUT -p icmp -j ACCEPT
ip6tables -A INPUT -p icmpv6 -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -I INPUT -i lo -j ACCEPT
ip6tables -I INPUT -i lo -j ACCEPT

iptables -P OUTPUT ACCEPT
ip6tables -P OUTPUT ACCEPT

iptables -P FORWARD DROP
ip6tables -P FORWARD DROP

iptables -P INPUT DROP
ip6tables -P INPUT DROP
exit 0
;;
stop)
echo "firewall stop"
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -F
iptables -X

ip6tables -P INPUT ACCEPT
ip6tables -P FORWARD ACCEPT
ip6tables -P OUTPUT ACCEPT
ip6tables -F
ip6tables -X
exit 0
;;
*)
echo "Usage: /etc/init.d/firewall {start|stop|restart}"
exit 1
;;
esac