#!/bin/sh
#
###
#
# Firewall & Compartir Internet
# Autor: Alex Barrios 
#	 alex@alexertech.com 
#
# Ultima Revision: 28/08/2006
# 
### 

###
# Localhost
#

LO_IFACE="lo"
LO_IP="127.0.0.1"

###
# Red Local
#

LAN_IP="192.168.2.1"
LAN_IP_RANGE="192.168.2.0/16"
LAN_BCAST="192.168.2.255"
LAN_IFACE="eth0"

###
# Internet 1
#

INET_IP="10.140.20.17"
INET_IFACE="eth1"

###
# Internet 2
#

INET_IP_2="200.84.176.122"
INET_IFACE_2="eth2"

###
# Servicios a Permitir
#
SERV_TCP="22 7822 80 6667 5222 7880 8080 imap https ftp ftp-data smtp rsync"
SERV_UDP="53"

###
# Localizacion de iptables.
#

IPTABLES="/sbin/iptables"


###
# Borra las reglas anteriores
#

echo "Borrando reglas anteriores ..."

$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z
$IPTABLES -t nat -F


###
# Politicas Predeterminadas de INPUT, FORWARD y OUTPUT
#

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP


###
# NAT enmascarado
#

$IPTABLES -t nat -A POSTROUTING -j MASQUERADE

###
# Activa forwarding de paquetes (Linux no lo hace por default)
#

echo "1" > /proc/sys/net/ipv4/ip_forward


###
# Redireccionamiento de paquetes
#

$IPTABLES -t nat -A PREROUTING -p tcp -m tcp --dport 22000 -j REDIRECT --to-ports 22
$IPTABLES -t nat -A PREROUTING -s 192.168.2.0 -d ! $LAN_IP_RANGE -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 
$IPTABLES -t nat -A PREROUTING -p tcp -i $INET_IFACE_2 --dport 7880 -j DNAT --to 192.168.2.6:80
$IPTABLES -t nat -A PREROUTING -p tcp -i $INET_IFACE_2 --dport 8780 -j DNAT --to 192.168.2.10:80
$IPTABLES -t nat -A PREROUTING -p tcp -i $INET_IFACE_2 --dport 7822 -j DNAT --to 192.168.2.10:7822

###
# ICMP (pings) - Regla icmp_packets
#

$IPTABLES -N icmp_packets
$IPTABLES -A icmp_packets -p ICMP --icmp-type echo-request -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type time-exceeded -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP --icmp-type echo-reply -j ACCEPT


###
# Reglas INPUT
#

## Permitir
# Entrar
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A INPUT -s $LAN_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT            # SSH
# Salir
for i in $SERV_TCP
do
$IPTABLES -A INPUT -p tcp --sport ${i} -j ACCEPT
done
for i in $SERV_UDP
do
$IPTABLES -A INPUT -p udp -m udp --sport ${i} -j ACCEPT
done
$IPTABLES -A INPUT -p ICMP -j icmp_packets                # Pings
$IPTABLES -A INPUT -p tcp -m tcp --sport 80 -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -s 200.35.66.83 -j ACCEPT 
$IPTABLES -A INPUT -s 200.41.117.248 -j ACCEPT 

## Denegar
$IPTABLES -A INPUT -p tcp --dport 1:1024 -j DROP
$IPTABLES -A INPUT -p udp --dport 1:1024 -j DROP
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "


###
# Reglas del renvio de paquetes
#
$IPTABLES -A FORWARD -p all -m state --state ESTABLISHED,RELATED -j ACCEPT
for i in $SERV_TCP
do
$IPTABLES -A FORWARD -p tcp -s $LAN_IP_RANGE --dport ${i} -j ACCEPT
done
$IPTABLES -A FORWARD -p tcp -s $LAN_IP_RANGE -j ACCEPT
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "


###
# Reglas OUTPUT
#
$IPTABLES -A OUTPUT -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -s $LAN_IP_RANGE -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -m tcp --sport 80 -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "

###
# Imprime que arranco el script
#

echo "Iptfwall -> by alex... done"