#!/bin/sh
#
###
#
# Firewall & Compartir Internet
# Autor: Alex Barrios 
#	 alex@alexertech.com 
#
# Ultima Revision: 30/08/2006
# 
### 


###
# Localhost
#

LO_IFACE="lo"
LO_IP="127.0.0.1"


###
# Red Local
#

LAN_IP="192.168.2.1"
LAN_IP_RANGE="192.168.2.0/24"
LAN_BCAST="192.168.2.255"
LAN_IFACE="eth0"


###
# Internet 1
#

INET_IP="10.00.00.00"
INET_IFACE="eth1"


###
# Internet 2
#

INET_IP_2="200.11.11.111"
INET_IFACE_2="eth2"


###
# Localizacion de iptables.
#

IPTABLES="/sbin/iptables"


###
# Borra las reglas anteriores
#

echo "Borrando reglas anteriores ..."

$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z
$IPTABLES -t nat -F

###
# Cargando modulos necesarios
#

modprobe ip_conntrack_irc
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ip_nat_irc


###
# Politicas Predeterminadas de INPUT, FORWARD y OUTPUT
#

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT


###
# NAT enmascarado, para compartir internet y redireccion interna
#

$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -s $LAN_IP_RANGE -j MASQUERADE
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE_2 -s $LAN_IP_RANGE -j MASQUERADE


###
# Activa forwarding de paquetes (Linux no lo hace por default)
#

echo "1" > /proc/sys/net/ipv4/ip_forward


###
# Redireccionamiento de paquetes
#

$IPTABLES -t nat -A PREROUTING -p tcp -i $LAN_IFACE --dport 80 -j REDIRECT --to-ports 8080
$IPTABLES -t nat -A PREROUTING -p tcp -i $INET_IFACE_2 --dport 7880 -j DNAT --to 192.168.2.6:80
$IPTABLES -t nat -A PREROUTING -p tcp -i $INET_IFACE_2 --dport 8780 -j DNAT --to 192.168.2.10:80
$IPTABLES -t nat -A PREROUTING -p tcp -i $INET_IFACE_2 --dport 7822 -j DNAT --to 192.168.2.10:7822


###
# ICMP (pings) - Regla icmp_packets
#

$IPTABLES -N icmp_packets
$IPTABLES -A icmp_packets -p ICMP --icmp-type echo-request -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP --icmp-type time-exceeded -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP --icmp-type echo-reply -j ACCEPT


###
# Reglas INPUT
#

$IPTABLES -A INPUT -i $LO_IFACE -j ACCEPT
$IPTABLES -A INPUT -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -i $INET_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -i $INET_IFACE_2 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p ICMP -j icmp_packets
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "


###
# Reglas del renvio de paquetes
#

$IPTABLES -A FORWARD -i $LAN_IFACE -s $LAN_IP_RANGE -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INET_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INET_IFACE_2 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "


###
# Reglas OUTPUT
#

$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "


###
# Imprime que arranco el script
#

echo "Iptfwall -> by alex... done"