#!/bin/bash
# (c) SC Teletrans SA http://www.teletrans.ro
PATH=/sbin:/usr/sbin:/bin:/usr/bin

UP_IF="eth0"    # interfata externa
LAN_IF="eth1"   # interfata interna
NAT="192.168.13.150"    # ip-ul pe care se face NAT
INT="10.0.0.0/24"       # reteaua interna

function start() {
        echo "Starting firewall..."

        # incarcam modulele esentiale
        modprobe ip_conntrack
        modprobe ip_conntrack_ftp
        modprobe ip_conntrack_irc

        # setam politica implicita de acceptare
        iptables -P INPUT ACCEPT
        iptables -P FORWARD ACCEPT
        iptables -P OUTPUT ACCEPT


        ##### Reguli pe lantul INPUT, toate interfetele #####

        # permitem ICMP
        for tip_icmp in echo-request echo-reply destination-unreachable time-exceeded parameter-problem
                do
                        iptables -A INPUT -p icmp --icmp-type ${tip_icmp} -j ACCEPT
                done

        # Interfata LOOPBACK
        # acceptam orice trafic pe loopback
        iptables -A INPUT -i lo -j ACCEPT

        # Interfata externa UP_IF
        # permitem servicii publice TCP
        for port in domain ftp ftp-data http https smtp pop3s
                do
                        iptables -A INPUT -p tcp -i ${UP_IF} --dport ${port} -m state --state NEW -j ACCEPT
                done

        # permitem servicii publice UDP
        for port in domain
                do
                        iptables -A INPUT -p udp -i ${UP_IF} --dport ${port} -m state --state NEW -j ACCEPT
                done


        ##### Reguli NAT #####
        iptables -t nat -A POSTROUTING -s $INT -d ! $INT -j SNAT --to $NAT

        # Interfata internata LAN_IF
        iptables -A INPUT -i ${LAN_IF} -j ACCEPT


        # INPUT - refuzam restul pachetelor
        iptables -A INPUT -j DROP


        #### Reguli pe lantul FORWARD

        # permitem conexiunile deja initiate, le respingem pe cele invalide
        iptables -A FORWARD -m state --state INVALID -j DROP
        iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

        # permitem ICMP
        for tip_icmp in echo-request echo-reply destination-unreachable time-exceeded parameter-problem
                do
                        iptables -A FORWARD -p icmp --icmp-type ${tip_icmp} -j ACCEPT
                done

        # permitem orice conexiuni din reteaua interna
        iptables -A FORWARD -i $LAN_IF -o $UP_IF -j ACCEPT

        # orice alta conexiune in lant este respinsa
        iptables -A FORWARD -j DROP

}

function stop() {
        echo "Stopping firewall..."
        iptables -P INPUT ACCEPT
        iptables -F
        iptables -t nat -F
}

# main
case "$1" in
        start)
                stop; start
                ;;
        stop)
                stop
                ;;
        restart)
esac
exit 0