#firewall 
#!/bin/bash
INET_IFACE="ppp0"
LAN_IFACE="eth1"
LO_IFACE="lo"
LO_IP="127.0.0.1"
LAN_IP_RANGE="192.168.0.0/24"
IPTABLES="/sbin/iptables"
modules2load="ip_tables iptable_filter ip_conntrack iptable_nat ip_nat_ftp ip_nat_irc ipt_MASQUERADE ipt_state"
echo 0 > /proc/sys/net/ipv4/ip_forward
 if [ -a / ]; then
 for i in $modules2load; do
 echo -en " =>  $i, "
  if [ -z "`/sbin/lsmod | grep $i | awk '{print $1}'`" ];then
/sbin/modprobe $i
else
echo "El modulo $i ya estaba cargado"
fi
done
fi
echo "1">/proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
for file in /proc/sys/net/ipv4/conf/*/accept_redirects; do
echo "0" > $file
done
echo 1 > /proc/sys/net/ipv4/ip_forward

echo "Conectando...."
$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z
$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -t nat -F
echo -n "Politicas...."
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
echo -n "Nueva Regala...."
$IPTABLES -N FLOOD
$IPTABLES -A FLOOD -m limit --limit 2/s --limit-burst 5 -j RETURN
$IPTABLES -A FLOOD -j DROP
echo -n "PREROUTING....."

$IPTABLES -t nat -A POSTROUTING -s $LAN_IP_RANGE -o $INET_IFACE -j MASQUERADE
echo -n "FORWARD...."
$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -s $LAN_IP_RANGE -i eth1 -j ACCEPT
$IPTABLES -A FORWARD -i $INET_IFACE -o $LAN_IFACE -p ALL -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INET_IFACE -j ACCEPT
echo -n "OUTPUT....."
$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP_RANGE -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT
echo -n "INPUT......"
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -j ACCEPT
$IPTABLES -A INPUT -i $INET_IFACE -p TCP -m state --state NEW --dport 80 -j FLOOD
$IPTABLES -A INPUT -i $INET_IFACE -p TCP -m state --state NEW --dport 80 -j ACCEPT
$IPTABLES -A INPUT -i $INET_IFACE -p TCP -m state --state NEW --dport 21 -j FLOOD
$IPTABLES -A INPUT -i $INET_IFACE -p TCP -m state --state NEW --dport 21 -j ACCEPT
$IPTABLES -A INPUT -i $INET_IFACE -p TCP -m state --state NEW --dport 3400 -j FLOOD
$IPTABLES -A INPUT -i $INET_IFACE -p TCP -m state --state NEW --dport 3400 -j ACCEPT
$IPTABLES -A INPUT -i $INET_IFACE -p TCP -m state --state NEW --dport 20000:20005 -j FLOOD
$IPTABLES -A INPUT -i $INET_IFACE -p TCP -m state --state NEW --dport 20000:20005 -j ACCEPT


$IPTABLES -A INPUT -i $INET_IFACE -p tcp -j REJECT --reject-with tcp-reset
$IPTABLES -A INPUT -i $INET_IFACE -p udp -j REJECT --reject-with icmp-port-unreachable
echo "Sensation ONLINE"