#! /bin/sh

# Script for setting up IP Chaining.
# It will work whether or not PPP is actually up.

PATH=/sbin
ANY=0.0.0.0/0
HERE=$ANY
# ^^^ This probably needs to be changed when I get my real addresses.
# ... then again... perhaps not... :-)

# Setup

ipchains -P input DENY
ipchains -P output ACCEPT
ipchains -P forward ACCEPT

ipchains -F
ipchains -X

# PPP input chain
ipchains -N PPP
ipchains -A PPP -s 10.0.0.0/8 -j DENY -l
ipchains -A PPP -d 10.0.0.0/8 -j DENY -l
ipchains -A PPP -s 127.0.0.0/8 -j DENY -l
ipchains -A PPP -p tcp -d $HERE 1024: ! -y -j ACCEPT
ipchains -A PPP -p udp -d $HERE 1024: -j ACCEPT
ipchains -A PPP -p tcp -d $HERE http -j ACCEPT
# ipchains -A PPP -p tcp -d $HERE https -j ACCEPT
# ipchains -A PPP -p tcp -d $HERE ftp -j ACCEPT
ipchains -A PPP -p udp -d $HERE domain -j ACCEPT
ipchains -A PPP -p tcp -d $HERE domain -j ACCEPT
ipchains -A PPP -p tcp -d $HERE smtp -j ACCEPT
ipchains -A PPP -p tcp -d $HERE auth -j REJECT
ipchains -A PPP -p tcp -d $HERE ssh -s $WORK -j ACCEPT
ipchains -A PPP -p tcp -s $ANY ssh -j ACCEPT
ipchains -A PPP -p icmp -s $ANY -j ACCEPT
ipchains -A PPP -p tcp -d $HERE 1024: -s $ANY ftp-data -y -j ACCEPT
ipchains -A PPP -j DENY -l

# input chain
ipchains -A input -i ppp+ -j PPP
ipchains -A input -i eth+ -j ACCEPT
ipchains -A input -i lo -j ACCEPT
ipchains -A input -l

# forwarding
ipchains -A forward -s 10.0.0.0/8 -d 10.0.0.0/8 -j ACCEPT
ipchains -A forward -s 10.0.0.0/8 -i ppp+ -j MASQ

# output
ipchains -A output -i eth+ -j ACCEPT
ipchains -A output -i lo -j ACCEPT
ipchains -A output -i ppp+ -p tcp -d $ANY 137:139 -j DENY

---

This should get you started. I know I'm being somewhat lazy :-) in not just explaining things. You've got the basic idea, but I think the forward chain needs to default to ACCEPT.

As regards saving them, I would actually suggest you tinker with the rules directly with the ipchains command, and then use /etc/init.d/ipchains save to actually save it. Remember to use chkconfig to make sure the IP chains are loaded at bootup!

As regards email, you probably want a combination of fetchmail and something else. Normally I would recommend [link|http://www.courier-mta.org/|Courier], but I've had trouble with Fetchmail delivering to Courier and no-one associated with either product was interested in investigating it. (This is a bit of a shame as Courier includes an IMAP server, a POP3 server and a webmail server.)

Wade.