#
#!/bin/bash
#
# Script de Firewall
#
IPT=/sbin/iptables
PPPIF="ppp0"
EXTIF="eth1"
INTIF="eth0"
EMULE="192.168.1.21"
 
#####################################
#
### Passo 1: Primeiro vamos arrumar a casa :) ###
#
#####################################
#
# Limpando as Regras
#
$IPT -F INPUT
$IPT -F OUTPUT
$IPT -F FORWARD
$IPT -F
$IPT -t nat -F
#
# Definindo a Politica Default das Cadeias
#
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD DROP
#
######################################
#
### Passo 2: Antes de Servir, vamos nos proteger ! ###
#
######################################
#
# Desabilitando o trafego IP Entre as Placas de Rede
#
echo "0" > /proc/sys/net/ipv4/ip_forward
#
# Configurando a Protecao anti-spoofing
#
echo "Setting anti-spoofing .....[ OK ]"
for spoofing in /proc/sys/net/ipv4/conf/*/rp_filter; do
        echo "1" > $spoofing
done
#
#######################################
#
### Passo 3: Carregando os modulos do iptables ###
#
#######################################
#
/sbin/depmod -a
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_MASQUERADE
echo "Setting rules .............[ OK ]"
#
#######################################
#
### Passo 4: Agora, vamos definir o que pode passar e o que nao ###
#
#######################################
#
# Qualquer pacote IP que venha do localhost, Ok.
#
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
#
# REDE INTERNA LIBERADA
#
$IPT -A INPUT -i $INTIF -j ACCEPT
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#
#LIBERANDO PORTAS
$IPT -A INPUT -i $INTIF -p udp -m udp --dport 137 -j ACCEPT
$IPT -A INPUT -i $INTIF -p udp -m udp --dport 138 -j ACCEPT
$IPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
$IPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
$IPT -A INPUT -p tcp -m tcp --dport 1023:65535 -j ACCEPT
$IPT -A INPUT -p udp -m udp --dport 1023:65535 -j ACCEPT
# No iptables, temos de dizer quais sockets sao validos em uma conexao
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -o $PPPIF -p udp --destination-port 53 -m state --state NEW -j ACCEPT
$IPT -A OUTPUT -o $PPPIF -p tcp --destination-port 53 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -p udp --dport 53 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -p tcp --dport 53 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -p tcp -i $INTIF -o $PPPIF --dport 4662:4670 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A FORWARD -p udp -i $PPPIF -o $INTIF -d $EMULE --dport 4672 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -p tcp -i $PPPIF -o $INTIF -d $EMULE --dport 4662:4670 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
$IPT -A FORWARD -p tcp -m limit --limit 1/s -j ACCEPT
$IPT -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
$IPT -A FORWARD -p tcp --tcp-flags ALL SYN,ACK -j DROP
 
#
# Primeiro, ativar o mascaramento (nat).
#
$IPT -t nat -F POSTROUTING
$IPT -t nat -A POSTROUTING -o $PPPIF -j MASQUERADE
#
#libera email para os computadores
#
$IPT -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp --dport 25 -j ACCEPT
$IPT -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp --dport 110 -j ACCEPT
#
#libera emule
$IPT -t nat -A PREROUTING -i $PPPIF -p udp --sport 4672 -j DNAT --to $EMULE
$IPT -t nat -A PREROUTING -i $PPPIF -p udp --dport 4672 -j DNAT --to $EMULE
$IPT -t nat -A PREROUTING -i $PPPIF -p tcp --sport 4242:9999 -j DNAT --to $EMULE
$IPT -t nat -A PREROUTING -i $PPPIF -p tcp --dport 4242:4670 -j DNAT --to $EMULE
#
#LIBERA TORRENT
$IPT -t nat -A PREROUTING -i $PPPIF -p tcp --dport 55638 -j DNAT --to 192.168.1.21
#
#BLOQUEIA/LIBERA O MSN
#
#iptables -A FORWARD -s 192.168.1.0 -p tcp --dport 1863 -j DROP
#iptables -A FORWARD -s 192.168.1.0 -d loginnet.passport.com -j DROP
$IPT -A FORWARD -s 192.168.1.0/24 -d messenger.hotmail.com -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -s 192.168.1.0/24 -p tcp --dport 1863 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -s 192.168.1.0/24 -p udp --dport 1503 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -s 192.168.1.0/24 -p udp --dport 3389 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -s 192.168.1.0/24 -p tcp --dport 443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -s messenger.hotmail.com -d 192.168.1.0/24 -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -s 192.168.1.21 -d messenger.hotmail.com -j DROP
$IPT -A FORWARD -s 192.168.1.21 -p tcp --dport 1863 -j DROP
$IPT -A FORWARD -s 192.168.1.21 -p tcp --dport 443 -j DROP
#
#Libera o Remote Desktop
$IPT -t nat -A PREROUTING -i $PPPIF -p tcp --sport 3389 -j DNAT --to 192.168.1.21
$IPT -t nat -A PREROUTING -i $PPPIF -p tcp --dport 3389 -j DNAT --to 192.168.1.21
#
# Redireciona porta 80 para 3128 (squid)
#
$IPT -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128
#
########################################
#
### Finalmente, podemos "Ligar" o foward (clientes) :) ###
#
########################################
#
# Habilitando o trafego Ip, entre as Interfaces de rede
#
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "Firewall OK ...............[ OK ]"