ferm.conf

@def $PORT_SSH = 1234;

@def $PORTS_OPEN = (
	$PORT_SSH
	http
	https
	smtp
	465 # the unofficial ssl smtp port
	submission # the official ssl smtp port
	imaps
);

table filter {
	chain INPUT {
		policy DROP;

		# connection tracking
		mod state state INVALID DROP;
		mod state state (ESTABLISHED RELATED) ACCEPT;

		# allow local connections
		interface lo ACCEPT;

		# respond to ping
		proto icmp icmp-type echo-request ACCEPT;

		# our services to the world
		proto tcp dport $PORTS_OPEN ACCEPT;

		# the rest is dropped by the above policy
	}

	# outgoing connections are not limited
	chain OUTPUT policy ACCEPT;

	# this is not a router
	chain FORWARD policy DROP;
}

domain ip6 table filter {
	chain INPUT {
		policy DROP;

		# connection tracking
		mod state state INVALID DROP;
		mod state state (ESTABLISHED RELATED) ACCEPT;

		# allow local connections
		interface lo ACCEPT;

		# allow ICMP (for neighbor solicitation, like ARP for IPv4)
		proto ipv6-icmp ACCEPT;

		# our services to the world
		proto tcp dport $PORTS_OPEN ACCEPT;

		# the rest is dropped by the above policy
	}

	# outgoing connections are not limited
	chain OUTPUT policy ACCEPT;

	# this is not a router
	chain FORWARD policy DROP;
}