#!/bin/bash
#iptables -V = iptables

#flush everything
#DEPMOD=/sbin/depmod
#MODPROBE=/sbin/modprobe
#$DEPMOD -a
#$MODPROBE ip_conntrack
#$MODPROBE ip_conntrack_ftp
#$MODPROBE ip_conntrack_irc
#$MODPROBE iptable_nat
#$MODPROBE ip_nat_ftp
#$MODPROBE ip_nat_irc
# flushing everything
echo " Flushing everything "
iptables -F
#iptables -X
iptables -t nat -F
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
# deleting chains
echo " Deleting chains "
#iptables -X bad_tcp_packets
iptables -X icmp_allowed
iptables -X allow-ssh-traffic-in
iptables -X check-flags
#iptables -X DropNLog
 #drop everything
echo " Droping everything "
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
#Allow establised connections and progs that use loop-back

echo " Allow establised connections and progs that use loop-back "
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT

# syn protect
#echo " Activating SYN protect with limit = 1/s "

#allowed connections
$IPTABLES -N allowed-connection
$IPTABLES -F allowed-connection
$IPTABLES -A allowed-connection -d $maya -p tcp --dport $ssh -j ACCEPT


 #ICMP traffic
echo "Creating icmp chain"
$IPTABLES -N icmp_allowed
$IPTABLES -F icmp_allowed
$IPTABLES -A icmp_allowed -m state --state NEW -p icmp --icmp-type time-exceeded -j ACCEPT
$IPTABLES -A icmp_allowed -m state --state NEW -p icmp --icmp-type destination-unreachable -j ACCEPT
$IPTABLES -A icmp_allowed -p icmp -j LOG --log-prefix "Bad ICMP traffic:"
$IPTABLES -A icmp_allowed -p icmp -j DROP


#Incoming traffic
echo "Creating incoming ssh traffic chain"
$IPTABLES -N allow-ssh-traffic-in
$IPTABLES -F allow-ssh-traffic-in
#Flood protection
$IPTABLES -A allow-ssh-traffic-in -m limit --limit 1/second -p tcp --tcp-flags ALL RST --dport $ssh -j ACCEPT
$IPTABLES -A allow-ssh-traffic-in -m limit --limit 1/second -p tcp --tcp-flags ALL FIN --dport $ssh -j ACCEPT
$IPTABLES -A allow-ssh-traffic-in -m limit --limit 1/second -p tcp --tcp-flags ALL SYN --dport $ssh -j ACCEPT
$IPTABLES -A allow-ssh-traffic-in -m state --state RELATED,ESTABLISHED -p tcp --dport $ssh -j ACCEPT


 #Catch portscanners
    echo "Creating portscan detection chain"
$IPTABLES -N check-flags
$IPTABLES -F check-flags
$IPTABLES -A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -m limit --limit 5/minute -j LOG --log-level alert --log-prefix "NMAP-XMAS:"
$IPTABLES -A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
$IPTABLES -A check-flags -p tcp --tcp-flags ALL ALL -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "XMAS:"
$IPTABLES -A check-flags -p tcp --tcp-flags ALL ALL -j DROP
$IPTABLES -A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "XMAS-PSH:"
$IPTABLES -A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
$IPTABLES -A check-flags -p tcp --tcp-flags ALL NONE -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "NULL_SCAN:"
$IPTABLES -A check-flags -p tcp --tcp-flags ALL NONE -j DROP
$IPTABLES -A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/RST:"
$IPTABLES -A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPTABLES -A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/FIN:"
$IPTABLES -A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP



# allow connections on ports
echo " Allow connection on ports "
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -p icmp -j icmp_allowed
iptables -A INPUT -j check-flags
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -j allow-ssh-traffic-in
iptables -A INPUT -j allowed-connection



# ipv4_forward
echo " Activating ipv4 forward "
echo 1 > /proc/sys/net/ipv4/ip_forward