# Initialize
$IPT -N OUTBOUND 2> /dev/null
$IPT -F OUTBOUND

# Allow ICMP packets out
$IPT -A OUTBOUND -p icmp -j ACCEPT

# Temoporarily set the field separator for CSV format
OLDIFS=$IFS
IFS=','

# Allow response traffic
$IPT -A OUTBOUND -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTBOUND -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT

if [ "$OUTBOUND_POLICY" == "permissive" ]; then
	# Hosts to which traffic is denied
	while read host garbage
		do
			$IPT -A OUTBOUND -d $host -j LSO
		done < /etc/firestarter/outbound/deny-to

	# Hosts from which traffic is denied
	while read host garbage
		do
			$IPT -A OUTBOUND -s $host -j LSO
		done < /etc/firestarter/outbound/deny-from

	# Services denied
	while read service ports target garbage
		do
			IFS=' '
			for port in `echo $ports`; do
				scrub_parameters
				$IPT -A OUTBOUND -p tcp -s $target --dport $port -j LSO
				$IPT -A OUTBOUND -p udp -s $target --dport $port -j LSO
			done
			IFS=','
		done < /etc/firestarter/outbound/deny-service

	$IPT -A OUTBOUND -j ACCEPT # Default permissive policy 
else
	# Hosts to which traffic is allowed
	while read host garbage
		do
			$IPT -A OUTBOUND -d $host -j ACCEPT
		done < /etc/firestarter/outbound/allow-to

	# Hosts from which traffic is allowed
	while read host garbage
		do
			$IPT -A OUTBOUND -s $host -j ACCEPT
		done < /etc/firestarter/outbound/allow-from

	# Services allowed
	while read service ports target garbage
		do
			IFS=' '
			for port in `echo $ports`; do
				scrub_parameters
				$IPT -A OUTBOUND -p tcp -s $target --dport $port -j ACCEPT
				$IPT -A OUTBOUND -p udp -s $target --dport $port -j ACCEPT
			done
			IFS=','
		done < /etc/firestarter/outbound/allow-service

	$IPT -A OUTBOUND -j LSO # Default restrictive policy
fi

# Restore system field separator
IFS=$OLDIFS

