#!/bin/sh
#
# Firewall script made by Lars
#


# -------------------------------------------------------------------------------------------
echo "Setting generally settings"
depmod -a
iptables --flush
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_tables
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_MASQUERADE
# -------------------------------------------------------------------------------------------


# DROP RULES
# -------------------------------------------------------------------------------------------
echo "Setting DROP rules"
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# -------------------------------------------------------------------------------------------


# KEEP STATE
# -------------------------------------------------------------------------------------------
echo "Keep state"
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED -j ACCEPT
# -------------------------------------------------------------------------------------------


# NAT
# -------------------------------------------------------------------------------------------
echo "Setting NAT rules"
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE

iptables -A FORWARD -i eth1 -p tcp -m state --state NEW -j ACCEPT
iptables -A FORWARD -i eth1 -p udp -m state --state NEW -j ACCEPT

iptables --table nat -A PREROUTING -p tcp --dport 80 -i eth1 -j REDIRECT --to-port 3128
# -------------------------------------------------------------------------------------------


# OUTPUT
# -------------------------------------------------------------------------------------------
echo "Setting OUTPUT rules"
iptables -A OUTPUT -o eth0 -p tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth1 -p tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
# ---------------------------------------------------------------------------------------------


# INPUT
# -------------------------------------------------------------------------------------------
echo "Setting INPUT rules"
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport 22 -m state --state NEW -j ACCEPT
# -------------------------------------------------------------------------------------------


# Forwarding
# -------------------------------------------------------------------------------------------
echo "Setting forwarding rules"
iptables -A FORWARD -i eth0 -p tcp -d 10.0.0.250 --dport 55555 -m state --state NEW -j ACCEPT
iptables -A PREROUTING --table nat -i eth0 -p tcp -d 192.168.1.100 --dport 55555 -j DNAT --to 10.0.0.250
# -------------------------------------------------------------------------------------------


# Allow ip forwarding
# -------------------------------------------------------------------------------------------
echo "Setting ip forwarding"
echo "1" > /proc/sys/net/ipv4/ip_forward
# -------------------------------------------------------------------------------------------