#!/bin/sh
#/
#/ \file
#/
#/ \brief       setup firewall
#/
#/ \author      Arthur
#/
#/ \date        unknown
#/
#/ \version     N/A
#/
#/ \todo
#/
#/ * Rewrite to gomtuu-rc style.
#/


EXTIP=192.168.1.11
EXTNET=192.168.1.0/24
EXTIF=eth1

INTIP=192.168.0.1
INTNET=192.168.0.0/24
INTIF=eth0

IPTABLES="/usr/sbin/iptables"
BLACKLIST="/var/state/iptables/blacklist"

[ -f $IPTABLES ] || exit 1

case "$1" in
S)

echo 0 > /proc/sys/net/ipv4/ip_forward

modprobe ip_conntrack_ftp
modprobe ip_nat_ftp

# Create blacklist chain (referenced from the PREROUTING chain).
$IPTABLES -t nat -N blacklist

$IPTABLES -N sshguard

$IPTABLES -t mangle -F
$IPTABLES -t filter -F
$IPTABLES -t nat    -F

# Set default chain policies.
$IPTABLES -t mangle -P PREROUTING  ACCEPT
$IPTABLES -t mangle -P INPUT       ACCEPT
$IPTABLES -t mangle -P FORWARD     ACCEPT
$IPTABLES -t mangle -P OUTPUT      ACCEPT
$IPTABLES -t mangle -P POSTROUTING ACCEPT

$IPTABLES -P INPUT   ACCEPT
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT  ACCEPT

$IPTABLES -t nat -P PREROUTING  ACCEPT
$IPTABLES -t nat -P OUTPUT      ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT

# Block all incoming external traffic to/from private networks, the loopback
# and "members" of the blacklist.
$IPTABLES -t nat -A PREROUTING  -i $EXTIF -s 10.0.0.0/8     -j DROP
$IPTABLES -t nat -A PREROUTING  -i $EXTIF -s 172.16.0.0/12  -j DROP
$IPTABLES -t nat -A PREROUTING  -i $EXTIF -s 192.168.0.0/24 -j DROP
$IPTABLES -t nat -A PREROUTING  -i $EXTIF -s 240.0.0.0/5    -j DROP
$IPTABLES -t nat -A PREROUTING  -i $EXTIF -s 127.0.0.1/8    -j DROP
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -d 10.0.0.0/8     -j DROP
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -d 172.16.0.0/12  -j DROP
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -d 192.168.0.0/24 -j DROP
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -d 240.0.0.0/5    -j DROP
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -d 127.0.0.1/8    -j DROP
$IPTABLES -t nat -A PREROUTING  -i $EXTIF                   -j blacklist

$IPTABLES -A INPUT -p TCP           --dport ftp:ssh                -j sshguard
$IPTABLES -A INPUT -p TCP           --dport ftp-data:ftp           -j ACCEPT
$IPTABLES -A INPUT -p UDP           --dport ftp-data:ftp           -j ACCEPT
$IPTABLES -A INPUT -p TCP           --dport ssh                    -j ACCEPT
$IPTABLES -A INPUT -p TCP           --dport smtp                   -j ACCEPT
$IPTABLES -A INPUT -p UDP           --dport smtp                   -j ACCEPT
$IPTABLES -A INPUT -p TCP           --dport www-http               -j ACCEPT
$IPTABLES -A INPUT -p UDP           --dport www-http               -j ACCEPT
$IPTABLES -A INPUT -p TCP           --dport netbios-ns:netbios-ssn -j ACCEPT
$IPTABLES -A INPUT -p UDP           --dport netbios-ns:netbios-ssn -j ACCEPT
$IPTABLES -A INPUT -p TCP           --dport microsoft-ds           -j ACCEPT
$IPTABLES -A INPUT -p UDP           --dport microsoft-ds           -j ACCEPT
$IPTABLES -A INPUT -p UDP           --dport who                    -j ACCEPT
$IPTABLES -A INPUT -p TCP           --dport printer                -j ACCEPT
$IPTABLES -A INPUT -p UDP           --dport printer                -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $EXTIF --dport :1023                  -j DROP
$IPTABLES -A INPUT -p UDP -i $EXTIF --dport :1023                  -j DROP
$IPTABLES -A INPUT -p TCP -i '!' lo --dport 3306                   -j DROP
$IPTABLES -A INPUT -p UDP -i '!' lo --dport 3306                   -j DROP
$IPTABLES -A INPUT -p TCP -i $EXTIF --dport 5900:5906              -j DROP
$IPTABLES -A INPUT -p UDP -i $EXTIF --dport 5900:5906              -j DROP
$IPTABLES -A INPUT -p TCP -i $EXTIF --dport 6000:6023              -j DROP
$IPTABLES -A INPUT -p UDP -i $EXTIF --dport 6000:6023              -j DROP

$IPTABLES -A OUTPUT -p TCP -o '!' lo --dport 3306 -j DROP
$IPTABLES -A OUTPUT -p UDP -o '!' lo --dport 3306 -j DROP

# Allow (de)SNAT'ed traffic to/from backend.
$IPTABLES -A FORWARD -i $INTIF -s $INTNET -j ACCEPT
$IPTABLES -A FORWARD -o $INTIF -d $INTNET -j ACCEPT

# SNATing the internal net.
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP

if [ -f $BLACKLIST ]; then
  cat $BLACKLIST | ${IPTABLES}-restore
fi

echo 1 > /proc/sys/net/ipv4/ip_forward
;;

K)

${IPTABLES}-save --table nat > $BLACKLIST

$IPTABLES -t mangle -F
$IPTABLES -t filter -F
$IPTABLES -t nat    -F

$IPTABLES -X sshguard
$IPTABLES -t nat -X blacklist

echo 0 > /proc/sys/net/ipv4/ip_forward

rmmod ip_nat_ftp
#rmmod ip_conntrack_ftp
;;

esac

exit 0
