#!/bin/sh


#GET THE EXTERNAL IP
EXTIP="`/sbin/ifconfig eth0 | grep 'inet addr' | awk '{print $2}' | sed -e 's/.*://'`"
EXTNIC="eth0"
INTNIC="eth1"

# IPTables Location - adjust if needed
IPT="/sbin/iptables"


echo "Loading required stateful/NAT kernel modules..."

/sbin/depmod -a
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
/sbin/modprobe iptable_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc
/sbin/modprobe ipt_MASQUERADE				# masquerade target module

echo "    Enabling IP forwarding..."
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr

echo "    External interface: $EXTNIC"
echo "       External interface IP address is: $EXTIP"

echo "    Loading proxy server rules..."

###############################################################################
#
# Flush Any Existing Rules or Chains
#


echo "Flushing Tables ..."

# Reset Default Policies
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT

# Flush all rules
$IPT -F
$IPT -t nat -F
$IPT -t mangle -F

# Erase all non-default chains
$IPT -X
$IPT -t nat -X
$IPT -t mangle -X

if [ "$1" = "stop" ]
then
	echo "Firewall completely flushed!  Now running with no firewall."
	exit 0
fi


## Set Policies ##

$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP



# allow all packets on the loopback interface
$IPT -A INPUT  -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT




#Allow established connections:
$IPT -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT


# FWD: Allow all connections OUT and only existing and related ones IN
$IPT -A FORWARD -i $EXTNIC -o $INTNIC -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $INTNIC -o $EXTNIC -j ACCEPT
$IPT -A OUTPUT  -m state  --state NEW -j ACCEPT 

# Enabling SNAT (MASQUERADE) functionality on $EXTNIC   ---  POST ROUTING
$IPT -t nat -A POSTROUTING -o $EXTNIC -j MASQUERADE