#!/bin/bash

#Establenciendo Políticas por defecto, eliminando reglas (si es que existen) y reseteado contadores
/sbin/iptables -F INPUT && /sbin/iptables -F OUTPUT && /sbin/iptables -F FORWARD && /sbin/iptables -F -t nat
/sbin/iptables -Z
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -A INPUT -i lo -j ACCEPT

/sbin/iptables -t filter -A FORWARD -p tcp -j LOG --log-level debug
# Todo lo que pase por "lo" es válido
/sbin/iptables -t filter -A INPUT -i lo -j ACCEPT
/sbin/iptables -t filter -A OUTPUT -o lo -j ACCEPT

#Permitiendo los Pings
/sbin/iptables -t filter -A INPUT -p icmp --icmp-type 0 -j ACCEPT
/sbin/iptables -t filter -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT
/sbin/iptables -t filter -A INPUT -p icmp --icmp-type 8 -j ACCEPT
/sbin/iptables -t filter -A OUTPUT -p icmp --icmp-type 0 -j ACCEPT

#permitiendo que los los resolves hacia los DNS de cantv (eso es para que pueda usar URL)
/sbin/iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
/sbin/iptables -t filter -A INPUT -p udp --sport 53 -j ACCEPT

#Permitiendo la navegación web
/sbin/iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
/sbin/iptables -t filter -A INPUT -p tcp --sport 80 -j ACCEPT

#Permitiendo entrar a sitios "seguros"
/sbin/iptables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT
/sbin/iptables -t filter -A INPUT -p tcp --sport 443 -j ACCEPT

# IRC
#/sbin/iptables -t filter -A OUTPUT -p tcp --dport 6667 -j ACCEPT
#/sbin/iptables -t filter -A INPUT -p tcp --sport 6667 -j ACCEPT

# SSH
/sbin/iptables -t filter -A INPUT -s 192.168.1.3 -m mac --mac-source 00:09:6B:60:23:E7 -p tcp -j ACCEPT
/sbin/iptables -t filter -A OUTPUT -d 192.168.1.3 -p tcp -j ACCEPT

#webmin

/sbin/iptables -t filter -A INPUT -s 192.168.1.3 -m mac --mac-source 00:09:6B:60:23:E7 -p tcp -j ACCEPT
/sbin/iptables -t filter -A INPUT -p tcp -i eth0 -m mac --mac-source  00:09:6B:60:23:E7 --dport 10000 -j ACCEPT
/sbin/iptables -t filter -A OUTPUT -p tcp -o eth0 --sport 10000 -j ACCEPT

# A PARTIR DE AQUÍ NO PUEDO HACER FUNCIONAR LA BIEN EL FIREWALL
## REGLAS FORWARD

/sbin/iptables -t filter -A FORWARD -s 192.168.1.0/24 -i eth1 -p tcp --dport 80 -j ACCEPT
/sbin/iptables -t filter -A FORWARD -s 192.168.1.0/24 -i eth1 -p tcp --dport 443 -j ACCEPT

# Aceptamos que consulten los DNS
/sbin/iptables -t filter -A FORWARD -s 192.168.1.0/24 -i eth1 -p tcp --dport 53 -j ACCEPT
/sbin/iptables -t filter -A FORWARD -s 192.168.1.0/24 -i eth1 -p udp --dport 53 -j ACCEPT


#Enmascarar

/sbin/iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward

echo "Hecho"



------------------------

LA COMPUTADORA CLIENTE AQUE NO HACE UN COÑO

rodilla @ root -> /home/agm # ifconfig
eth0      Link encap:Ethernet  HWaddr 00:E0:7D:F9:EA:6D
          inet addr:192.168.1.2  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::2e0:7dff:fef9:ea6d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:259268 errors:0 dropped:1376235 overruns:0 frame:1376235
          TX packets:207465 errors:0 dropped:0 overruns:0 carrier:0
          collisions:27885 txqueuelen:1000
          RX bytes:96405707 (91.9 MiB)  TX bytes:167486436 (159.7 MiB)
          Interrupt:11 Base address:0xec00

rodilla @ root -> /home/agm # route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 eth0
rodilla @ root -> /home/agm # ping google.com

rodilla @ root -> /home/agm # ping 192.168.1.1 (FIREWALL)
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=1.09 ms

--- 192.168.1.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.096/1.096/1.096/0.000 ms