#!/bin/sh

# Variables
INTIF="br0"
EXTIF="ppp0"
MASQUNET="192.168.8.0/24"
IPT="/sbin/iptables"

dmesg -n2 
start() {
echo -n "Starting Firewall:	"
# erst mal alles lschen
$IPT -F
$IPT -X
$IPT -t nat -F

#default policies
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

#$IPT -A INPUT -s 00:03:0D:1D:18:07 -j LOG
#$IPT -A INPUT -s 00:03:0D:1D:18:07 -j DROP

#Masquerading
$IPT -t nat -A POSTROUTING -s $MASQUNET -o $EXTIF -j MASQUERADE
echo 1 >> /proc/sys/net/ipv4/ip_forward

# Create chain which blocks new connections, except if coming from inside
$IPT -N block
#$IPT -A block -o $EXTIF -j LOG
$IPT -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A block -m state --state NEW -i ! $EXTIF -j ACCEPT
$IPT -A block -j LOG
$IPT -A block -j DROP

#Create chain that blocks incoming traffic from outside, if it comes from a local IP
$IPT -N inet
# disable local nets incomming from outside
 $IPT -A inet -s $MASQUNET -j LOG
 $IPT -A inet -s $MASQUNET -j DROP
 $IPT -A inet -s 192.168.0.0/16 -j LOG
 $IPT -A inet -s 192.168.0.0/16 -j DROP 
 $IPT -A inet -s 10.0.0.0/8 -j LOG
 $IPT -A inet -s 10.0.0.0/8 -j DROP
 $IPT -A inet -s 172.16.1.0/16 -j LOG
 $IPT -A inet -s 172.16.1.0/16 -j DROP

# allow ssh
$IPT -A inet -p tcp --dport 22 -j ACCEPT 
#allow smtp
#$IPT -A inet -p tcp --dport 25 -j ACCEPT 
#allow openvpn 5000
#$IPT -A inet -p tcp --dport 80 -j ACCEPT 

#$IPT -A inet -p udp --dport 5000 -j ACCEPT
#allow openvpn 5000
#$IPT -A inet -p udp --dport 5001 -j ACCEPT
#allow openvpn 5000
#$IPT -A inet -p udp --dport 5002 -j ACCEPT
#$IPT -A inet -p udp --dport 5003 -j ACCEPT
#$IPT -A inet -p udp --dport 5004 -j ACCEPT

# allow http
$IPT -A inet -p tcp --dport 80 -j ACCEPT 
# allow TS2
#$IPT -A inet -p udp --dport 8767 -j ACCEPT 

#allow mangos
$IPT -A inet -p tcp --dport 3724  -j ACCEPT
$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 3724 -j DNAT --to-destination 192.168.8.2
$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.8.2 --dport 3724 -j ACCEPT

$IPT -A inet -p tcp --dport 8085  -j ACCEPT
$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 8085 -j DNAT --to-destination 192.168.8.2
$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.8.2 --dport 8085 -j ACCEPT

#bittorent
$IPT -A inet -p tcp --dport 53924  -j ACCEPT
$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 53924 -j DNAT --to-destination 192.168.8.18
$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.8.18 --dport 53924 -j ACCEPT

# allow https
# $IPT -A inet -p tcp --dport 443 -j ACCEPT 

#allow neverwinther nights
#$IPT -A inet -p udp --dport 5121 -j ACCEPT
#$IPT -t nat -A PREROUTING -i $EXTIF -p udp -m udp --dport 5121 -j DNAT --to-destination 192.168.8.2
#$IPT -A FORWARD -i $EXTIF -o $INTIF -p udp -d 192.168.8.2 --dport 5121 -j ACCEPT



#allow mysql
# $IPT -A inet -p tcp --dport 3306 -j ACCEPT
#allow apache
#$IPT -A inet -p tcp --dport 80 -j ACCEPT
#allow https
# $IPT -A inet -p tcp --dport 443 -j ACCEPT
#allow POP3 from outside
#IPT -A inet -p tcp --dport 110 -j ACCEPT

#allow bittorrent
$IPT -A inet -p tcp --dport 3724 -j ACCEPT
$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 3724 -j DNAT --to-destination 192.168.8.11
$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.8.11 --dport 3742 -j ACCEPT

$IPT -A inet -p tcp --dport 6881:6999 -j ACCEPT
$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 6881:6999 -j DNAT --to-destination 192.168.8.11
$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.8.11 --dport 6881:6999 -j ACCEPT


$IPT -A inet -p tcp --dport 6112 -j ACCEPT
$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 6112 -j DNAT --to-destination 192.168.8.11
$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.8.11 --dport 6112 -j ACCEPT

#allow JediServer
#$IPT -A inet -p udp --dport 29070 -j ACCEPT
#$IPT -t nat -A PREROUTING -i $EXTIF -p udp -m udp --dport 29070 -j DNAT --to-destination 192.168.8.2
#$IPT -A FORWARD -i $EXTIF -o $INTIF -p udp -d 192.168.8.2 --dport 29070 -j ACCEPT

#civilisation (dx8)
$IPT -A inet -p udp --dport 2302:2400 -j ACCEPT
$IPT -t nat -A PREROUTING -i $EXTIF -p udp -m udp --dport 2302 -j DNAT --to-destination 192.168.8.18
$IPT -A FORWARD -i $EXTIF -o $INTIF -p udp -d 192.168.8.18 --dport 2302:2400 -j ACCEPT

#allow empire earth
#$IPT -A inet -p tcp --dport 33335 -j ACCEPT
#$IPT -A inet -p tcp --dport 33336 -j ACCEPT
#$IPT -A inet -p udp --dport 33334 -j ACCEPT
#$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 33335 -j DNAT --to-destination 192.168.9.18
#$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 33336 -j DNAT --to-destination 192.168.9.18
#$IPT -t nat -A PREROUTING -i $EXTIF -p udp -m udp --dport 33334 -j DNAT --to-destination 192.168.9.18
#$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.9.18 --dport 33335 -j ACCEPT
#$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.9.18 --dport 33336 -j ACCEPT
#$IPT -A FORWARD -i $EXTIF -o $INTIF -p udp -d 192.168.9.18 --dport 33334 -j ACCEPT

#allow edonkey
#$IPT -A inet -p tcp --dport 4661 -j ACCEPT
#$IPT -A inet -p tcp --dport 4662 -j ACCEPT
#$IPT -A inet -p udp --dport 3271 -j ACCEPT
#$IPT -A inet -p udp --dport 4665 -j ACCEPT
#port forwarding edonkey
#$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 4662 -j DNAT --to-destination 192.168.8.2
#$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.8.2 --dport 4662 -j ACCEPT
#$IPT -t nat -A PREROUTING -i $EXTIF -p udp -m udp --dport 3271 -j DNAT --to-destination 192.168.8.2
#$IPT -A FORWARD -i $EXTIF -o $INTIF -p udp -d 192.168.8.2 --dport 3271 -j ACCEPT


#allow Jedi Academy Server
#$IPT -A inet -p udp --dport 29070 -j ACCEPT
#port forwarding Jedi Academy Server
#$IPT -t nat -A PREROUTING -i $EXTIF -p udp -m udp --dport 29070 -j DNAT --to-destination 192.168.11.2
#$IPT -A FORWARD -i $EXTIF -o $INTIF -p udp -d 192.168.11.2 --dport 29070 -j ACCEPT

#allow Siedler 4
#$IPT -A inet -p tcp --dport 3000  -j ACCEPT
#$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 3000 -j DNAT --to-destination 192.168.11.15
#$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.11.15 --dport 3000 -j ACCEPT
#$IPT -A inet -p tcp --dport 3105  -j ACCEPT
#$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 3105 -j DNAT --to-destination 192.168.11.15
#$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.11.15 --dport 3105 -j ACCEPT

#$IPT -A inet -p udp --dport 3000  -j ACCEPT
#$IPT -t nat -A PREROUTING -i $EXTIF -p udp -m udp --dport 3000 -j DNAT --to-destination 192.168.11.15
#$IPT -A FORWARD -i $EXTIF -o $INTIF -p udp -d 192.168.11.15 --dport 3000 -j ACCEPT
#$IPT -A inet -p udp --dport 3105  -j ACCEPT
#$IPT -t nat -A PREROUTING -i $EXTIF -p udp -m udp --dport 3105 -j DNAT --to-destination 192.168.11.15
#$IPT -A FORWARD -i $EXTIF -o $INTIF -p udp -d 192.168.11.15 --dport 3105 -j ACCEPT

#killfucking
$IPT -A INPUT -d 87.248.104.123 -j LOG
$IPT -A INPUT -d 87.248.104.123 -j DROP

#Other
# Jump to that chain from INPUT and FORWARD chains
$IPT -A INPUT -i $EXTIF -j inet
$IPT -A INPUT -j block
$IPT -A FORWARD -j block

#$IPT -A INPUT -i $INTIF -j LOG
#$IPT -A OUTPUT -o $EXTIF -j LOG
$IPT -A OUTPUT -o $EXTIF -d $MASQUNET -j LOG
$IPT -A OUTPUT -o $EXTIF -d $MASQUNET -j DROP
#$IPT -A OUTPUT -o $EXTIF -d $172.16.1.0/24 -j LOG
#$IPT -A OUTPUT -o $EXTIF -d $172.16.1.0/24 -j DROP

touch /var/lock/subsys/iptables

echo "done"
}


stop() {
echo -n stopping firewall...
$IPT -F
$IPT -X
$IPT -P INPUT ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT
echo done.

rm -f /var/lock/subsys/iptables
}


case "$1" in
start)
start
;;

stop)
stop
;;

restart)
# "restart" is really just "start" as this isn't a daemon,
# and "start" clears any pre-defined rules anyway.
# This is really only here to make those who expect it happy
start
;;

condrestart)
[ -e /var/lock/subsys/iptables ] && start
;;

status)
echo $"Table: filter"
$IPT --list -n -v
echo
echo $"Table: nat"
$IPT -t nat --list -n -v
echo
echo $"Table: mangle"
$IPT -t mangle --list -n -v
;;

panic)
echo -n $"Changing target policies to DROP: "
$IPT -P INPUT DROP && \
$IPT -P FORWARD DROP && \
$IPT -P OUTPUT DROP && \
$IPT -t nat -P PREROUTING DROP && \
$IPT -t nat -P POSTROUTING DROP && \
$IPT -t nat -P OUTPUT DROP && \
$IPT -t mangle -P PREROUTING DROP && \
$IPT -t mangle -P OUTPUT DROP && \
success $"Changing target policies to DROP" || \
failure $"Changing target policies to DROP"
echo
$IPT -F INPUT && \
$IPT -F FORWARD && \
$IPT -F OUTPUT && \
$IPT -t nat -F PREROUTING && \
$IPT -t nat -F POSTROUTING && \
$IPT -t nat -F OUTPUT && \
$IPT -t mangle -F PREROUTING && \
$IPT -t mangle -F OUTPUT && \
success $"Flushing all chains:" || \
failure $"Flushing all chains:"
$IPT -X INPUT && \
$IPT -X FORWARD && \
$IPT -X OUTPUT && \
$IPT -t nat -X PREROUTING && \
$IPT -t nat -X POSTROUTING && \
$IPT -t nat -X OUTPUT && \
$IPT -t mangle -X PREROUTING && \
$IPT -t mangle -X OUTPUT && \
success $"Removing user defined chains:" || \
failure $"Removing user defined chains:"
;;

*)
echo $"Usage: $0 {start|stop|restart|condrestart|status|panic|save}"
exit 1
esac

exit 0