#!/bin/bash

IPT=/sbin/iptables

UPLINK="eth2"


# start bash script 
start_firewall() {

	#Reset the iptable first
	chains=`cat /proc/net/ip_tables_names`
	for i in $chains; do
    	$IPT -t $i -F
	$IPT -t $i -X
	$IPT -t $i -Z
	done

#Add the new rules
$IPT -P INPUT DROP
$IPT -I INPUT 1 -i ${UPLINK} -m state --state INVALID -j DROP
$IPT -I INPUT -i ${UPLINK} -m state --state ESTABLISHED,RELATED -j ACCEPT 
	

$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT

#share the internet
$IPT -t nat -I POSTROUTING -o ${UPLINK} -j MASQUERADE

$IPT -N syn-flood
$IPT -I INPUT -i ${UPLINK} -p tcp --tcp-flags SYN,ACK,FIN,RST RST -j syn-flood
$IPT -I syn-flood -i ${UPLINK} -m limit --limit 4/s --limit-burst 16 -j RETURN
$IPT -I syn-flood -i ${UPLINK} -m limit --limit 75/s --limit-burst 100 -j RETURN
$IPT -I syn-flood -i ${UPLINK} -j LOG --log-prefix "SYN FLOOD " --log-tcp-sequence  --log-tcp-options  --log-ip-options -m limit --limit 1/second
$IPT -I syn-flood -i ${UPLINK} -j DROP


## I use a script to send droped ips to my workstation in a popup format ;) for ssh, ftp, pop3 and webmin.. 
## Insert the rules early so we are sure they get DROP'ed :)
sshweb=/sshweb.sh 
exec $sshweb start &



INTERFACES="lo br0"
for x in ${INTERFACES}
	do $IPT -A INPUT -i ${x} -j ACCEPT
done


# 21=ftp 22=ssh 25=postfix 110=pop3 6881=torrent 10000=webmin
SERVICES="21 22 25 81 110 6881 10000"

for x in ${SERVICES}
    do $IPT -A INPUT -p tcp -i ${UPLINK} --dport ${x} -j ACCEPT
done

# log ftp attempts
$IPT -A INPUT -p tcp -i ${UPLINK} --dport 21 -m state --state NEW -j LOG --log-prefix "IPT:FTP: "
$IPT -A INPUT -p tcp -i ${UPLINK} --dport 21 -m state --state NEW -m recent --update --seconds 45 --hitcount 4 -j DROP


# log ssh attempts
$IPT -A INPUT -p tcp -i ${UPLINK} --dport 22 -m state --state NEW -j LOG --log-prefix "IPT:SSH: "
$IPT -A INPUT -p tcp -i ${UPLINK} --dport 22 -m state --state NEW -m recent --update --seconds 45 --hitcount 4 -j DROP

# log pop3 attempts
$IPT -A INPUT -p tcp -i ${UPLINK} --dport 110 -m state --state NEW -j LOG --log-prefix "IPT:POP3: "
$IPT -A INPUT -p tcp -i ${UPLINK} --dport 110 -m state --state NEW -m recent --update --seconds 45 --hitcount 4 -j DROP

# log webmin attempts
$IPT -A INPUT -p tcp -i ${UPLINK} --dport 10000 -m state --state NEW -j LOG --log-prefix "IPT:WEBMIN: "
$IPT -A INPUT -p tcp -i ${UPLINK} --dport 10000 -m state --state NEW -m recent --update --seconds 30 --hitcount 4 -j DROP
}

stop_firewall() {
  sshweb=/sshweb.sh 
  exec $sshweb stop &

  chains=`cat /proc/net/ip_tables_names`
  for i in $chains; do
    $IPT -t $i -F
    $IPT -t $i -X
    $IPT -t $i -Z
  done

  $IPT -P INPUT ACCEPT
  $IPT -P OUTPUT ACCEPT
  $IPT -P FORWARD ACCEPT
  $IPT -I INPUT -i eth2 -j ACCEPT
  $IPT -I OUTPUT -o eth2 -j ACCEPT
  $IPT -I INPUT -i br0 -j ACCEPT
  $IPT -I OUTPUT -o br0 -j ACCEPT
  $IPT -t nat -I POSTROUTING -o eth2 -j MASQUERADE

  echo -e "\n******************** Firewall stopped *********************\n"	
}

case "$1" in

    start)
    start_firewall
echo "****************** Starting the firewall *******************"


# Turn on IP Spoof protection by using IP Source Address Verification

if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then
   echo -n "Setting up IP spoofing protection..."
   for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f
   done
   echo "done."
else
   echo "PROBLEMS SETTING UP IP SPOOFING PROTECTION."
fi

# Activate the forwarding!

if [ -e /proc/sys/net/ipv4/ip_forward ]; then
  echo -n "Turning on forwarding..."
  echo 1 >/proc/sys/net/ipv4/ip_forward
  echo "done."
else
  echo "Forwarding not turned on!"
fi

# Enable bad error message protection

if [ -e /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses ] ; then
  echo -n "Turning on bad error message protection..."
  echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
  echo "done."
else
  echo "Problem turing on bad error message protection."
fi

# Don't respond to broadcast pings.

if [ -e /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts ]; then
  echo -n "Stopping broadcast pings..."
  echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
  echo "done."
else
  echo "Problem stopping broadcast pings."
fi
echo -e "\n******************************************************************"

   ;;
 
    stop)
    stop_firewall
    ;;
    
   *)
    echo "Usage: $0 {start|stop}"
    exit 1
    ;;

esac