sovereign/roles/common/files/etc_ferm_ferm.conf

# Firewall configuration for a web and SMTP server.
# See http://ferm.foo-projects.org/

table filter {
    chain INPUT {
        policy DROP;

        # connection tracking
        mod state state INVALID DROP;
        mod state state (ESTABLISHED RELATED) ACCEPT;

        # allow local connections
        interface lo ACCEPT;

        # respond to ping
        proto icmp icmp-type echo-request ACCEPT;

        # expose our services to the world:
        # dns, web, ssh, imap + ssl, smtp + ssl, znc
        proto tcp dport (25 53 http https ssh 993 465 6697) ACCEPT;

        # openvpn
        proto udp dport 1194 ACCEPT;

        # mosh port range
        proto udp dport 60000:61000 ACCEPT;

        # the rest is dropped by the above policy
    }

    # outgoing connections are not limited
    chain OUTPUT policy ACCEPT;

    # this is not a router
    chain FORWARD policy DROP;
}