#!/bin/bash
#----------------------------------------------------------------------
# Description: rc.firewall
# Author: Goten Xiao <gotenxiao@gmail.com>
# Created at: Fri Oct  6 19:57:17 BST 2006
# Computer: r2d3
# System: Linux 2.6.17.13-gx4 on i686
#    
# Copyright (c) 2006   All rights reserved.
#
#----------------------------------------------------------------------
# Configure section:
IPTABLES="/usr/sbin/iptables"
#----------------------------------------------------------------------
#
# main()
function firewall_clear()
{
	$IPTABLES -F
}

function firewall_off()
{
	firewall_clear
}

function firewall_low()
{
	firewall_clear
	$IPTABLES -P INPUT DROP
	$IPTABLES -P FORWARD DROP
	$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
	$IPTABLES -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT
	$IPTABLES -A INPUT -p icmp -j ACCEPT
	$IPTABLES -A INPUT -p tcp --dport 21 -j ACCEPT    #FTP
	$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT    #SSH
	$IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT    #HTTP
	$IPTABLES -A INPUT -p tcp --dport 443 -j ACCEPT   #HTTPS
	$IPTABLES -A INPUT -p tcp --dport 139 -j ACCEPT   #NetBIOS 
	$IPTABLES -A INPUT -p tcp --dport 445 -j ACCEPT   #Samba
	$IPTABLES -A INPUT -p tcp --dport 631 -j ACCEPT   #CUPS
	$IPTABLES -A INPUT -p tcp --dport 901 -j ACCEPT   #Samba SWAT
	$IPTABLES -A INPUT -p tcp --dport 5900 -j ACCEPT  #VNC
	$IPTABLES -A INPUT -p tcp -m multiport --dports 6881-6900 -j ACCEPT #BitTorrent
}

function firewall_medium()
{
	# Only allow ICMP, SSH, HTTP, HTTPS and BitTorrent
	firewall_clear
	$IPTABLES -P INPUT DROP
	$IPTABLES -P FORWARD DROP
	$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
	$IPTABLES -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT
	$IPTABLES -A INPUT -p icmp -j ACCEPT
	$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT    #SSH
	$IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT    #HTTP
	$IPTABLES -A INPUT -p tcp --dport 443 -j ACCEPT   #HTTPS
	$IPTABLES -A INPUT -p tcp --dport 5900 -j ACCEPT  #VNC
	$IPTABLES -A INPUT -p tcp -m multiport --dports 6881-6900 -j ACCEPT #BitTorrent
}

function firewall_high()
{
	#Refuse anything incoming except SSH.
	firewall_clear
	$IPTABLES -P INPUT DROP
	$IPTABLES -P FORWARD DROP
	$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
	$IPTABLES -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT
	$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT    #SSH
}

function firewall_lockdown()
{
	#NOTHING gets in. Total network lockdown.
	firewall_clear
	$IPTABLES -P INPUT DROP
	$IPTABLES -P FORWARD DROP
	$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
	$IPTABLES -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT
}

case $1 in
lockdown)
	firewall_lockdown
	;;
high)
	firewall_high
	;;
medium)
	firewall_medium
	;;
low)
	firewall_low
	;;
off)
	firewall_off
	;;
*) #Default level
	firewall_medium
	;;
esac