#!/bin/bash

IPT=/sbin/iptables

UPLINK="eth2"


# start bash script 
start_firewall() {


	chains=`cat /proc/net/ip_tables_names`
	for i in $chains; do
    	$IPT -t $i -F
	$IPT -t $i -X
	$IPT -t $i -Z
	done
              
        $IPT -P INPUT DROP
       	$IPT -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 
	$IPT -P OUTPUT ACCEPT
	$IPT -P NAT ACCEPT
	$IPT -P FORWARD ACCEPT
	$IPT -P POSTROUTING ACCEPT
	

	#share the internet
	$IPT -t nat -I POSTROUTING -o ${UPLINK} -j MASQUERADE


INTERFACES="lo br0"
for x in ${INTERFACES}
	do $IPT -I INPUT -i ${x} -j ACCEPT
done


SERVICES="21 22 6667 10000"
for x in ${SERVICES}
    do $IPT -A INPUT -p tcp --dport ${x} -i ${UPLINK} -j ACCEPT
done


# log ssh attempts
$IPT -I INPUT -p tcp --dport 22 -m state --state NEW -j LOG --log-prefix "IPT:SSH: "
$IPT -I INPUT -p tcp --dport 22 -i eth2 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP


}


stop_firewall() {
	

  chains=`cat /proc/net/ip_tables_names`
  for i in $chains; do
    $IPT -t $i -F
    $IPT -t $i -X
    $IPT -t $i -Z
  done

  $IPT -P INPUT ACCEPT
  $IPT -P OUTPUT ACCEPT
  $IPT -P FORWARD ACCEPT
  $IPT -I INPUT -i eth2 -j ACCEPT
  $IPT -I OUTPUT -o eth2 -j ACCEPT
  $IPT -I INPUT -i br0 -j ACCEPT
  $IPT -I OUTPUT -o br0 -j ACCEPT
  $IPT -t nat -I POSTROUTING -o eth2 -j MASQUERADE

  echo -e "\n******************** Firewall stopped *********************\n"	
}

case "$1" in

    start)
    start_firewall

echo "************************************************************"
echo "****************** Starting the firewall *******************"
echo "************************************************************"


# Turn on IP Spoof protection by using IP Source Address Verification

if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then
   echo -n "Setting up IP spoofing protection..."
   for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f
   done
   echo "done."
else
   echo PROBLEMS SETTING UP IP SPOOFING PROTECTION.  BE WORRIED.
fi

# Activate the forwarding!

if [ -e /proc/sys/net/ipv4/ip_forward ]; then
  echo -n "Turning on forwarding..."
  echo 1 >/proc/sys/net/ipv4/ip_forward
  echo "done."
else
  echo "Forwarding not turned on!  Be worried."
fi

# Enable bad error message protection

if [ -e /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses ] ; then
  echo -n "Turning on bad error message protection..."
  echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
  echo "done."
else
  echo "Problem turing on bad error message protection.  Be worried."
fi

# Don't respond to broadcast pings.

if [ -e /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts ]; then
  echo -n "Stopping broadcast pings..."
  echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
  echo "done."
else
  echo "Problem stopping broadcast pings.  Be worried."
fi
echo -e "\n******************************************************************"

   ;;
 
    stop)
    stop_firewall
    ;;
    
   *)
    echo "Usage: $0 {start|stop}"
    exit 1
    ;;

esac