#!/bin/bash

iptables=/usr/sbin/iptables




# Localização do comando ip
IP=/sbin/ip
# Interface Externa 1 - Speedy
NET_EXT_INT0=eth1
# IP Speedy
NET_EXT_IP0=200.161.130.69
# Default Gateway Speedy
NET_EXT_GW0=200.161.130.65

# Interface interna
NET_INT_INT1=eth0
# IP interno
NET_INT_IP1=192.168.0.1
# Subnet interna
NET_INT_SUB1=24
# Rede interna
NET_INT_NET1=192.168.0.0

# Interface externa 2 - Virtua
NET_EXT_INT2=eth2
# IP Virtua
NET_EXT_IP2=201.37.144.181
# Default Gateway Virtua
NET_EXT_GW2=201.37.144.1


fw_start() {

$iptables -F
$iptables -F -t nat
$iptables -F -t mangle
$iptables -X -t nat
$iptables -X -t mangle
$iptables -X

iptables -A INPUT -s 0/0 -p icmp -j ACCEPT
iptables -A INPUT -s 0/0 -p tcp --dport 60000:65535 -j ACCEPT
iptables -A INPUT -s 0/0 -p udp --dport 20 -j ACCEPT
iptables -A INPUT -s 0/0 -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -s 0/0 -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -s 0/0 -p udp --dport 21 -j ACCEPT
iptables -A INPUT -s 0/0 -p tcp --dport 2121 -j ACCEPT
iptables -A INPUT -s 0/0 -p udp --dport 2121 -j ACCEPT
iptables -A INPUT -s 0/0 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -s 0/0 -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -s 0/0 -p tcp --dport 1863 -j ACCEPT
iptables -A INPUT -s 0/0 -p tcp --dport 2222 -j ACCEPT
iptables -A INPUT -s 0/0 -p tcp --dport 4662 -j ACCEPT
iptables -A INPUT -s 0/0 -p udp --dport 4672 -j ACCEPT
iptables -A INPUT -s 0/0 -p udp --dport 5190 -j ACCEPT
iptables -A INPUT -s 0/0 -p tcp --dport 8080 -j ACCEPT

echo "Configurando tabela Mangle para eth1..."
$iptables -t mangle -N ETH1
$iptables -t mangle -F ETH1
$iptables -t mangle -A ETH1 -p tcp -j LOG -log-prefix MANGLE_TCP_ETH1
$iptables -t mangle -A ETH1 -p icmp -j LOG -log-prefix MANGLE_ICMP_ETH1
$iptables -t mangle -A ETH1 -j MARK --set-mark 1

echo "Configurando tabela Nat para eth1..."
$iptables -t nat -N SPOOF_ETH1
$iptables -t nat -F SPOOF_ETH1
$iptables -t nat -A SPOOF_ETH1 -j LOG -log-prefix SPOOF_ETH1
$iptables -t nat -A SPOOF_ETH1 -j SNAT --to ${NET_EXT_IP0}            
echo "Configurando tabela Mangle para eth2..."
$iptables -t mangle -N ETH2
$iptables -t mangle -F ETH2
$iptables -t mangle -A ETH0 -p tcp -j LOG -log-prefix MANGLE_TCP_ETH2
$iptables -t mangle -A ETH0 -p icmp -j LOG -log-prefix MANGLE_ICMP_ETH2
$iptables -t mangle -A ETH2 -j MARK --set-mark 2

echo "Configurando tabela Nat para eth2..."
$iptables -t nat -N SPOOF_ETH2
$iptables -t nat -F SPOOF_ETH2
$iptables -t nat -A SPOOF_ETH2 -j LOG -log-prefix SPOOF_ETH2
$iptables -t nat -A SPOOF_ETH2 -j SNAT --to ${NET_EXT_IP2}

echo "Configurando regras de Mangle para eth1..."
$IP ru add from ${NET_EXT_IP0} lookup 1
$IP ro add table 10 default via ${NET_EXT_GW0} dev ${NET_EXT_INT0}
$IP ru add fwmark 1 table 10
$IP ro fl ca

echo "Configurando regras de Mangle para eth2..."
$IP ru add from ${NET_EXT_IP2} lookup 2
$IP ro add table 20 default via ${NET_EXT_GW2} dev ${NET_EXT_INT2}
$IP ru add fwmark 2 table 20
$IP ro fl ca

echo "Configurando regras de spoofing..."
$iptables -t nat -A POSTROUTING -o ${NET_EXT_INT2} -j SPOOF_ETH2
$iptables -t nat -A POSTROUTING -o ${NET_EXT_INT0} -j SPOOF_ETH1

echo "Adicionando rota default..."
$IP ro add default equalize nexthop via ${NET_EXT_GW2} dev \
${NET_EXT_INT2} weight 1 nexthop via ${NET_EXT_GW0} dev \
${NET_EXT_INT0} weight 2

echo "Desabilitando filtro de caminho reverso..."
echo 0 > /proc/sys/net/ipv4/conf/eth2/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter

echo "Habilitando redirecionamento de pacotes..."
echo 1 > /proc/sys/net/ipv4/ip_forward

#nat
#$iptables -t nat -A POSTROUTING -s 0/0 -o eth2 -j MASQUERADE
#$iptables -t nat -A POSTROUTING -o eth0:1 -j SNAT --to 201.37.144.181
#$iptables -t nat -A POSTROUTING -s 10.0.0.0/255.0.0.0 -d 0/0 -j SNAT --to 200.161.130.69

#bloqueia tudo
#iptables -A INPUT -s 192.168.0.0/24 -j ACCEPT
iptables -A INPUT -s ! 127.0.0.1 -m state --state ! ESTABLISHED,RELATED -j REJECT
iptables -A INPUT -p tcp -m multiport --dport 5901,5902,5903,5904,8080 -j ACCEPT

#forward
iptables -A FORWARD -p tcp -s 0/0 -i eth0 -o eth2 --dport 1863 -j ACCEPT
iptables -A FORWARD -p tcp -s 0/0 -i eth0 -o eth2 --dport 5190 -j ACCEPT

#port forward
iptables -t nat -A PREROUTING -p tcp -i eth2 --dport 2121 -j DNAT --to-dest 10.0.0.20
iptables -t nat -A PREROUTING -p tcp -i eth2 --dport 60000:65535 -j DNAT --to-dest 10.0.0.20
iptables -t nat -A PREROUTING -p udp -i eth2 --dport 2121 -j DNAT --to-dest 10.0.0.20
#iptables -t nat -A PREROUTING -p udp -i eth2 --dport 20 -j DNAT --to-dest 10.0.0.20

#iptables -t nat -A PREROUTING -p tcp -i eth1 --dport 20 -j DNAT --to-dest 10.0.0.4
iptables -t nat -A PREROUTING -p tcp -i eth1 --dport 21 -j DNAT --to-dest 10.0.0.4



iptables -t nat -A PREROUTING -p tcp -i eth2 --dport 5901 -j DNAT --to-dest 10.0.0.20
iptables -t nat -A PREROUTING -p tcp -i eth2 --dport 5902 -j DNAT --to-dest 10.0.0.20
iptables -t nat -A PREROUTING -p tcp -i eth2 --dport 5903 -j DNAT --to-dest 10.0.0.20
iptables -t nat -A PREROUTING -p tcp -i eth2 --dport 5904 -j DNAT --to-dest 10.0.0.20

iptables -t nat -A PREROUTING -p tcp -i eth2 --dport 5904 -j DNAT --to-dest 10.0.0.20
iptables -t nat -A PREROUTING -p tcp -i eth2 --dport 8080 -j DNAT --to-dest 10.0.0.20


iptables -t nat -A PREROUTING -p tcp -i eth2 --dport 4662 -j DNAT --to-dest 10.0.0.80
iptables -t nat -A PREROUTING -p udp -i eth2 --dport 4672 -j DNAT --to-dest 10.0.0.80

}

fw_stop() {
$iptables -F
$iptables -t nat -F
}

fw_restart() {
/etc/rc.d/rc.firewall stop
/etc/rc.d/rc.firewall start
}
case "$1" in
'start')
  fw_start
  ;;
'stop')
  fw_stop
  ;;
'restart')
  fw_restart
  ;;
*)
  echo "usage $0 start|restart|stop"
esac