#!/bin/sh

INET_IF="eth1"
INET_IP="10.0.0.7"

LAN_IP="192.168.1.21"
LAN_IP_RANGE="192.168.1.0/24"
LAN_IF="eth0"

LAN2_IP="192.168.2.5"
LAN2_IP_RANGE="192.168.2.0/24"

CLIENT_IP="192.168.1.6"
CLIENT_IP_TMG="192.168.1.251"
CLIENT_IP_NTP="192.168.1.250"

SPECIAL_IP="192.168.0.5"
SPECIAL_IP1="192.168.0.1"
SPECIAL_IP2="192.168.0.2"
SPECIAL_IP3="192.168.0.201"
SPECIAL_IP4="192.168.0.202"
SPECIAL_IP5="192.168.0.203"
SPECIAL_IF="br0"

IPTABLES="/sbin/iptables"
MODPROBE="/sbin/modprobe"
/sbin/depmod -a

#$MODPROBE ip_conntrack
#$MODPROBE ip_tables
#$MODPROBE iptable_filter
#$MODPROBE iptable_mangle
#$MODPROBE iptable_nat
$MODPROBE ipt_LOG
$MODPROBE ipt_limit
$MODPROBE ipt_state
#$MODPROBE ipt_MASQUERADE
#$MODPROBE ipt_REDIRECT

#$MODPROBE ipt_owner
$MODPROBE ipt_REJECT
$MODPROBE ip_conntrack_ftp
$MODPROBE ip_conntrack_irc
$MODPROBE ip_nat_ftp
$MODPROBE ip_nat_irc

echo "1" > /proc/sys/net/ipv4/ip_forward

echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp
echo "1" > /proc/sys/net/ipv4/ip_dynaddr

#-----------------------------------------------

$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP


$IPTABLES -N icmp_packets

$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m icmp --icmp-type 4 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m icmp --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m state --state ESTABLISHED,RELATED -m icmp --icmp-type 0 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m state --state ESTABLISHED,RELATED -m icmp --icmp-type 3 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m state --state ESTABLISHED,RELATED -m icmp --icmp-type 11 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m state --state ESTABLISHED,RELATED -m icmp --icmp-type 12 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m state --state ESTABLISHED,RELATED -m icmp --icmp-type 14 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m state --state ESTABLISHED,RELATED -m icmp --icmp-type 18 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m state --state ESTABLISHED,RELATED -m icmp --icmp-type 3/2 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m state --state ESTABLISHED,RELATED -m icmp --icmp-type 5 -j ACCEPT

$IPTABLES -N bad_tcp_packets

$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
#$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A bad_tcp_packets -p tcp -m state --state INVALID -j DROP


$IPTABLES -N allowed

$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -j REJECT --reject-with tcp-reset


$IPTABLES -N tcp_ext_input

$IPTABLES -A tcp_ext_input  -p TCP --dport 22 -j allowed
$IPTABLES -A tcp_ext_input  -p TCP --dport 113 -j allowed
$IPTABLES -A tcp_ext_input  -p TCP --dport 3299 -j allowed
$IPTABLES -A tcp_ext_input  -p TCP --dport 3389 -j allowed
$IPTABLES -A tcp_ext_input  -p TCP --dport 6129 -j allowed


$IPTABLES -N tcp_ext_forward

$IPTABLES -A tcp_ext_forward  -p TCP --dport 113 -j allowed


$IPTABLES -N udp_ext_input

$IPTABLES -A udp_ext_input  -p UDP --dport 1194 -j ACCEPT
$IPTABLES -A udp_ext_input  -p UDP --dport 1195 -j ACCEPT
$IPTABLES -A udp_ext_input  -p UDP --dport 113 -j ACCEPT
$IPTABLES -A udp_ext_input  -p UDP --dport 123 -j ACCEPT

$IPTABLES -N udp_ext_forward

$IPTABLES -A udp_ext_forward  -p UDP --dport 113 -j ACCEPT

#-----------------------------------------------------


$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT

$IPTABLES -A INPUT -p ICMP -i lo -s 127.0.0.1 -j ACCEPT
$IPTABLES -A INPUT -p ICMP -i eth+ -j icmp_packets
$IPTABLES -A FORWARD -p ICMP -i eth+ -j icmp_packets
$IPTABLES -A OUTPUT -p ICMP -o lo -j ACCEPT
$IPTABLES -A OUTPUT -p ICMP -o eth+ -j ACCEPT

$IPTABLES -A INPUT -p TCP -j bad_tcp_packets
$IPTABLES -A FORWARD -p TCP -j bad_tcp_packets
$IPTABLES -A OUTPUT -p TCP -j bad_tcp_packets

$IPTABLES -A INPUT -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p UDP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -p UDP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -p UDP -m state --state ESTABLISHED,RELATED -j ACCEPT



$IPTABLES -A INPUT -i $LAN_IF -s $CLIENT_IP -d 224.0.0.0/8 -j DROP
$IPTABLES -A FORWARD -i $LAN_IF -s $CLIENT_IP -d 224.0.0.0/8 -j DROP

$IPTABLES -A INPUT -i $LAN_IF -s $CLIENT_IP_TMG -d 224.0.0.0/8 -j DROP
$IPTABLES -A FORWARD -i $LAN_IF -s $CLIENT_IP_TMG -d 224.0.0.0/8 -j DROP

$IPTABLES -A INPUT -i $LAN_IF -s $CLIENT_IP_NTP -d 224.0.0.0/8 -j DROP
$IPTABLES -A FORWARD -i $LAN_IF -s $CLIENT_IP_NTP -d 224.0.0.0/8 -j DROP



$IPTABLES -A INPUT -p TCP -i $LAN_IF -s $CLIENT_IP -j ACCEPT
$IPTABLES -A FORWARD -p TCP -i $LAN_IF -s $CLIENT_IP -j ACCEPT

$IPTABLES -A FORWARD -p TCP -o $LAN_IF -d $CLIENT_IP -j ACCEPT
$IPTABLES -A OUTPUT -p TCP -o $LAN_IF -d $CLIENT_IP -j ACCEPT




$IPTABLES -A INPUT -p UDP -i $LAN_IF -s $CLIENT_IP_TMG -j ACCEPT
$IPTABLES -A FORWARD -p UDP -i $LAN_IF -s $CLIENT_IP_TMG -j ACCEPT

$IPTABLES -A FORWARD -p UDP -o $LAN_IF -d $CLIENT_IP_TMG -j ACCEPT
$IPTABLES -A OUTPUT -p UDP -o $LAN_IF -d $CLIENT_IP_TMG -j ACCEPT

$IPTABLES -A INPUT -p UDP -i $LAN_IF -s $CLIENT_IP_NTP -j ACCEPT
$IPTABLES -A FORWARD -p UDP -i $LAN_IF -s $CLIENT_IP_NTP -j ACCEPT

$IPTABLES -A FORWARD -p UDP -o $LAN_IF -d $CLIENT_IP_NTP -j ACCEPT
$IPTABLES -A OUTPUT -p UDP -o $LAN_IF -d $CLIENT_IP_NTP -j ACCEPT



$IPTABLES -A INPUT -p TCP -i $INET_IF -j tcp_ext_input
$IPTABLES -A FORWARD -p TCP -i $INET_IF -j tcp_ext_forward
$IPTABLES -A OUTPUT -p TCP -o $INET_IF -j ACCEPT


$IPTABLES -A INPUT -p UDP -i $LAN_IF -s $CLIENT_IP -j ACCEPT
$IPTABLES -A FORWARD -p UDP -i $LAN_IF -s $CLIENT_IP -j ACCEPT
$IPTABLES -A FORWARD -p UDP -o $LAN_IF -d $CLIENT_IP -j ACCEPT
$IPTABLES -A OUTPUT -p UDP -o $LAN_IF -d $CLIENT_IP -j ACCEPT

$IPTABLES -A INPUT -p UDP -i $LAN_IF -s $CLIENT_IP_TMG -j ACCEPT
$IPTABLES -A FORWARD -p UDP -i $LAN_IF -s $CLIENT_IP_TMG -j ACCEPT
$IPTABLES -A FORWARD -p UDP -o $LAN_IF -d $CLIENT_IP_TMG -j ACCEPT
$IPTABLES -A OUTPUT -p UDP -o $LAN_IF -d $CLIENT_IP_TMG -j ACCEPT

$IPTABLES -A INPUT -p UDP -i $INET_IF -j udp_ext_input
$IPTABLES -A FORWARD -p UDP -i $INET_IF -j udp_ext_forward
$IPTABLES -A OUTPUT -p UDP -o $INET_IF -j ACCEPT


$IPTABLES -A INPUT -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -d $LAN_IP -j ACCEPT

$IPTABLES -A INPUT -s $LAN2_IP_RANGE -j ACCEPT
$IPTABLES -A FORWARD -s $LAN2_IP_RANGE -j ACCEPT
$IPTABLES -A FORWARD -d $LAN2_IP_RANGE -j ACCEPT
$IPTABLES -A OUTPUT -d $LAN2_IP_RANGE -j ACCEPT

$IPTABLES -t nat -A POSTROUTING -o $INET_IF -j SNAT --to-source $INET_IP


#-------------------------=SPECIAL RULES=-------------------------

$IPTABLES -A INPUT -p icmp -d $SPECIAL_IP -j ACCEPT
$IPTABLES -A INPUT -p tcp  -d $SPECIAL_IP --dport 22 -j ACCEPT
$IPTABLES -A OUTPUT -d 192.168.0.0/24 -j ACCEPT

$IPTABLES -A FORWARD -i br0 -o br0 -s 192.168.0.0/24 -d 192.168.0.0/24 -j ACCEPT

$IPTABLES -A INPUT -p icmp -s 10.2.1.0/24 -j ACCEPT
$IPTABLES -A OUTPUT -p icmp -d 10.2.1.0/24 -j ACCEPT
$IPTABLES -A FORWARD -i tun0 -d 192.6.1.0/24 -j ACCEPT
$IPTABLES -t nat -A POSTROUTING -o eth0 -d 192.6.1.0/24 -j SNAT --to-source 192.6.1.5


#-----------------------<=PRIVATE RULES=>-------------------------

$IPTABLES -A INPUT -p tcp -s 192.168.1.2 --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 192.168.1.202 --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 195.24.145.140 --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 195.24.145.140 --dport 6129 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 195.24.145.140 --dport 3389 -j ACCEPT
$IPTABLES -A INPUT -p udp -s 10.0.0.1 --dport 123 -j ACCEPT
$IPTABLES -A INPUT -p udp -s 192.168.1.250 --dport 123 -j ACCEPT

#-----------------------
$IPTABLES -A INPUT -p tcp -s 217.198.128.99 --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 217.198.128.163 --dport 22 -j ACCEPT
#----------------------

$IPTABLES -A INPUT -p tcp -s 213.154.196.175 --dport 3299 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 213.154.213.169 --dport 3299 -j ACCEPT

#$IPTABLES -A PREROUTING -t nat -p tcp -d 10.0.0.3 --dport 6129 -j DNAT --to-destination 192.168.1.2:6129
#$IPTABLES -A PREROUTING -t nat -p tcp -d 10.0.0.3 --dport 3389 -j DNAT --to-destination 192.168.1.2:3389

#$IPTABLES -A FORWARD -i eth0 -d 192.168.1.2 -p tcp --dport 6129 -j ACCEPT
#$IPTABLES -A FORWARD -i eth0 -d 192.168.1.2 -p tcp --dport 3389 -j ACCEPT

#$IPTABLES -A POSTROUTING -t nat -p tcp -o eth0 -j SNAT --to-source 195.248.163.36