#!/bin/bash -x

FW='iptables'
IF='eth0'

#RESET
$FW -X
$FW -F
$FW -t nat -F
$FW -t mangle -F
$FW -t raw -F

#DEFAULT
$FW -P INPUT DROP
$FW -P OUTPUT DROP
$FW -P FORWARD DROP

$FW -t mangle -P INPUT ACCEPT
$FW -t mangle -P OUTPUT ACCEPT
$FW -t mangle -P FORWARD ACCEPT

$FW -A INPUT -i lo -j ACCEPT
$FW -A OUTPUT -o lo -j ACCEPT

#DNS
$FW -A INPUT -i $IF -p udp --sport 53 --dport 1024: -j ACCEPT
$FW -A OUTPUT -o $IF -p udp --sport 1024: --dport 53 -j ACCEPT

#ICMP
$FW -A INPUT -i $IF -p icmp -m state --state RELATED,ESTABLISHED -j ACCEPT
$FW -A OUTPUT -o $IF -p icmp -m state --state NEW,RELATED,ESTABLISHED  -j ACCEPT

#PORT ALLOWED
TCP_PORT_ALLOWED="20 21 22 53 80 8001 5222 587 443 1863 995 7777"
for port in $TCP_PORT_ALLOWED ; do
	$FW -A INPUT -i $IF -p tcp --sport $port --dport 1024: -m state --state RELATED,ESTABLISHED -j ACCEPT
	$FW -A OUTPUT -o $IF -p tcp --sport 1024: --dport $port -m state --state NEW,RELATED,ESTABLISHED  -j ACCEPT
done
UDP_PORT_ALLOWED=""
for port in $UDP_PORT_ALLOWED ; do
        $FW -A INPUT -i $IF -p tcp --sport $port --dport 1024: -m state --state RELATED,ESTABLISHED -j ACCEPT
        $FW -A OUTPUT -o $IF -p tcp --sport 1024: --dport $port -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
done

#CAS PAR CAS
FILE='/etc/iptables/scripts/allowed.txt'
if [ -f $FILE ] ; then
	IFS='
	'
	for ligne in `cat $FILE` ; do
		host=`echo $ligne | cut -d' ' -f 1`
		if echo $host | grep -G '^[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}$' ; then
			ip=$host
		else
			ip=`host $host | grep 'has address' | cut -d' ' -f 4`
		fi
		port=`echo $ligne | cut -d' ' -f 2`
		proto=`echo $ligne | cut -d' ' -f 3`
		$FW -A INPUT -i $IF -p $proto --sport $port --dport 1024: --source $ip -m state --state RELATED,ESTABLISHED -j ACCEPT
	        $FW -A OUTPUT -o $IF -p $proto --sport 1024: --dport $port --destination $ip -m state --state NEW,RELATED,ESTABLISHED  -j ACCEPT	
	done
fi

#LOG
$FW -A INPUT -i $IF -j LOG
$FW -A OUTPUT -o $IF -j LOG