#!/bin/bash -x

# safenet = where non-trusted boxes sit - do not trust on local network at all #
# lan = local area (safe) network #
# dmz = server network that cannot touch anything other than wan #
# alp = ayrshire lan party that cannot touch anything other than wan and dmz #
# wan = Internet Connectivity #
# wlan = Wireless network - Secured with WPA Enterprise #

# flush existing settings
iptables -F
iptables -X
iptables -t nat -F

# drop all by default
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# interfaces
wanif="eth0"
wlanif="ath0"
lanif="eth1.2"
dmzif="eth1.3"
safeif="eth1.4"
alpif="eth1.5"

# networks
wannet=""
wlannet="10.0.1.0/24"
lannet="10.0.0.0/24"
dmznet="10.0.2.0/24"
safenet="10.0.3.0/24"
alpnet="10.10.0.0/24"

# ip(s)
lanip="10.0.0.1"
wlanip="10.0.1.1"
dmzip="10.0.2.1"
safeip="10.0.3.1"
alpip="10.10.0.1"

# nat
natextip="82.153.32.153"

# dns
nameserver1="212.104.130.9"
nameserver2="212.104.130.65"


                                        ## LAN ##

## [INPUT] LAN --> GATEWAY ##
iptables -A INPUT -i $lanif -s $lannet -p tcp -d $lanip --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [OUTPUT] GATEWAY --> LAN ##
iptables -A OUTPUT -o $lanif -s $lanip -d $lannet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] LAN --> DMZ ##
iptables -A FORWARD -i $lanif -o $dmzif -s $lannet -d $dmznet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] LAN --> WLAN ##
iptables -A FORWARD -i $lanif -o $wlanif -s $lannet -d $wlannet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] LAN --> ALP ##
iptables -A FORWARD -i $lanif -o $alpif -s $lannet -d $alpnet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] LAN --> WAN ##
iptables -A FORWARD -i $lanif -o $wanif -s $lannet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [NAT] LAN --> INTERNET ##
iptables -t nat -A POSTROUTING -o $wanif -s $lannet -j SNAT --to $natextip

                                        ## DMZ ##
## [FORWARD] DMZ --> LAN ##
iptables -A FORWARD -i $dmzif -o $lanif -s $dmznet -d $lannet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] DMZ --> WLAN ##
iptables -A FORWARD -i $dmzif -o $wlanif -s $dmznet -d $wlannet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] DMZ --> ALP ##
iptables -A FORWARD -i $dmzif -o $alpif -s $dmznet -d $alpnet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] DMZ --> WAN ##
iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p udp -d $nameserver1 --dport 53 -m state --state NEW,ESTABLISHED,RELATE$
iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p udp -d $nameserver2 --dport 53 -m state --state NEW,ESTABLISHED,RELATE$
iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 20 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 6667 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [NAT] DMZ --> INTERNET ##
iptables -t nat -A POSTROUTING -o $wanif -s $dmznet -j SNAT --to $natextip

                                        ## WAN  ##

## [FORWARD] WAN --> LAN ##
iptables -A FORWARD -i $wanif -o $lanif -d $lannet -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $wanif -o $lanif -d $lannet -p tcp --dport 32825 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] WAN --> DMZ ##
iptables -A FORWARD -i $wanif -o $dmzif -d $dmznet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] WAN --> WLAN ##
iptables -A FORWARD -i $wanif -o $wlanif -d $wlannet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] WAN --> SAFENET ##
iptables -A FORWARD -i $wanif -o $safeif -d $safenet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] WAN --> ALP ##
iptables -A FORWARD -i $wanif -o $alpif -d $alpnet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [NAT] WAN --> LAN ##
iptables -t nat -A PREROUTING -i $wanif -p tcp -d $natextip --dport 32825 -j DNAT --to-destination 10.0.0.2

                                        ## WLAN ##

## [FORWARD] WLAN --> LAN ##
iptables -A FORWARD -i $wlanif -o $lanif -s $wlannet -d $lannet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] WLAN --> DMZ ##
iptables -A FORWARD -i $wlanif -o $dmzif -s $wlannet -d $dmznet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] WLAN --> ALP ##
iptables -A FORWARD -i $wlanif -o $alpif -s $wlannet -d $alpnet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] WLAN --> WAN ##
iptables -A FORWARD -i $wlanif -o $wanif -s $wlannet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [NAT] WLAN --> INTERNET ##
iptables -t nat -A POSTROUTING -o $wanif -s $wlannet -j SNAT --to $natextip


                                        ## SAFENET ##

## [FORWARD] SAFENET --> WAN ##
iptables -A FORWARD -i $safeif -o $wanif -s $safenet -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $dmzif -o $wanif -s $safenet -p udp -d $nameserver1 --dport 53 -m state --state NEW,ESTABLISHED,RELAT$
iptables -A FORWARD -i $dmzif -o $wanif -s $safenet -p udp -d $nameserver2 --dport 53 -m state --state NEW,ESTABLISHED,RELAT$

## [NAT] SAFENET --> INTERNET ##
iptables -t nat -A POSTROUTING -o $wanif -s $safenet -j SNAT --to $natextip

                                        ## ALP ##
## [FORWARD] ALP --> LAN ##
iptables -A FORWARD -i $alpif -o $lanif -s $alpnet -d $lannet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] ALP --> DMZ ##
iptables -A FORWARD -i $alpif -o $dmzif -s $alpnet -d $dmznet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] ALP --> WLAN ##
iptables -A FORWARD -i $alpif -o $wlanif -s $alpnet -d $wlannet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] ALP --> WAN ##
iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p tcp --dport 20 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p udp -d $nameserver1 --dport 53 -m state --state NEW,ESTABLISHED,RELATED
iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p udp -d $nameserver2 --dport 53 -m state --state NEW,ESTABLISHED,RELATED

## [NAT] ALP --> INTERNET ##
iptables -t nat -A POSTROUTING -o $wanif -s $alpnet -j SNAT --to $natextip