echo "------------------ iptables firewall seting ------------------";
echo "old settings are:"
iptables -L -n

echo "seting now..."
iptables -F     # delete filters in input,output,forward
iptables -X     # delete filter in user's chain

iptables -P INPUT DROP  # INPUT 's default to DROP
iptables -P FORWARD DROP # FORWARD 's default to DROP
iptables -P OUTPUT ACCEPT # OUTPUT 's default to ACCEPT

# this host as server
iptables -A INPUT -p tcp --dport 22 -j ACCEPT   # sshd service
iptables -A INPUT -p tcp --dport 3306 -j ACCEPT # mysqld service
iptables -A INPUT -p tcp --dport 80 -j ACCEPT   # httpd service

# this host as client
iptables -A INPUT -p icmp -j ACCEPT             # ping
iptables -A INPUT -p udp --sport 53 -j ACCEPT   # dns
iptables -A INPUT -p tcp --sport 80 -j ACCEPT   # web

echo "setting over, new settings are:"
iptables -L -n

echo "save new settings to /etc/sysconfig/iptables."
service iptables save