Setting up a linux firewall with Ubuntu

The most important lines are:

:INPUT DROP     [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT  [0:0]

# SECTION THAT DEALS WITH NAT/MASQ

*nat 

:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

-A POSTROUTING -o eth2 -j MASQUERADE

It's that simple!
Of course, this is a pretty open config, and you'll need to beef up the security.
assuming eth0 is your internal (LAN) interface and eth2 you external (WAN) interface.

The INPUT DROP basically uses the DROP rule for all input to the firewall. This is an important distinction between INPUT and FORWARD.
INPUT is trafficwhich ultimate destination is the firewall itself (inlcudes traffic destined to another device e.g. apache server behind the firewall). FORWARD is for traffic that will pass though the traffic via the firewall.

Also if you do a lot of torrenting, you'll nee to increase the max connections in sysctl.conf

net.ipv4.netfilter.ip_conntrack_max = 262144

Otherwise 10 or so torrents will totally max out your firewall, and you won't be able to make outgoing connections anymore!

I won't go further into it, but there are more articles on this to get the best out of your firewall

Port knocking

Port knocking is a very handy way of opening ports in your firewall e.g. You want to run SSH on the standard port 22, but you don't want this open all the time.

So...
your basic iptables input rule is DENY
Sample iptables.rules file for use with iptables-restore < iptables.rules
:INPUT DROP     [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT  [0:0]

.
To open this port, you can use a specially sequenced TCP SYN on certain ports to open the SSH port.

e.g. sync connect on ports 1000,2000,3000 and 4000 then your system will open port 22

[options]
        logfile = /var/log/knockd.log

[openSSH]
        sequence    = 1000,2000,3000,4000
        seq_timeout = 5
        command     = iptables -A INPUT -p tcp --dport 22 - j ACCEPT

       tcpflags    = syn


similarly, you can use another sequence to close port 22