#!/bin/sh


#GET THE EXTERNAL IP
EXTIP="`/sbin/ifconfig eth0 | grep 'inet addr' | awk '{print $2}' | sed -e 's/.*://'`"
EXTNIC="eth0"
INTNIC="eth1"
TCATIP="192.168.10.101"					#tomcat ip

# IPTables Location - adjust if needed
IPT="/sbin/iptables"


echo "Loading required stateful/NAT kernel modules..."

/sbin/depmod -a
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
/sbin/modprobe iptable_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc
/sbin/modprobe ipt_MASQUERADE				# masquerade target module

echo "    Enabling IP forwarding..."
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr

echo "    External interface: $EXTNIC"
echo "       External interface IP address is: $EXTIP"

echo "    Loading proxy server rules..."

###############################################################################
#
# Flush Any Existing Rules or Chains
#

echo "*************************" 
echo "Flushing Tables ..."

# Reset Default Policies
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT

# Flush all rules
$IPT -F
$IPT -t nat -F
$IPT -t mangle -F

# Erase all non-default chains
$IPT -X
$IPT -t nat -X
$IPT -t mangle -X

if [ "$1" = "stop" ]
then
	echo "Firewall completely flushed!  Now running with no firewall."
	exit 0
fi


## Set Policies ##

$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP



# allow all packets on the loopback interface
$IPT -A INPUT  -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT




#Allow established connections:
$IPT -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT


#Drop packets with an unknown state like tcp ack with no connection
$IPT -A FORWARD -m state --state INVALID -j DROP

echo "Allow SSH "
#allow ssh to firewall box from internal lan
$IPT -A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT


echo "Allow all out connections"
# FWD: Allow all connections OUT and only existing and related ones IN
$IPT -A FORWARD -i $EXTNIC -o $INTNIC -m state --state ESTABLISHED,RELATED -j ACCEPT	#direct related traffic from the outside in
$IPT -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT    		# Allow packets to the firewall itself
$IPT -A FORWARD -i $INTNIC -o $EXTNIC -j ACCEPT						#forward traffic from the inside out
$IPT -A OUTPUT  -m state  --state NEW -j ACCEPT 




echo "Masquerade the parade"
# Enabling SNAT (MASQUERADE) functionality on $EXTNIC   ---  POST ROUTING
$IPT -t nat -A POSTROUTING -o $EXTNIC -j MASQUERADE


echo "Postrouting, change internal ip to external ip"
#http://www.linux.com/article.pl?sid=04/11/23/2022252
# Stuff the packet with external ip to go out instead of having the lan ip
$IPT -t nat -A POSTROUTING -o $EXTNIC -s 192.168.0.0/16 -j SNAT --to $EXTIP  #207.166.198.1



############## ASTERISK ###########################################################################
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT	#keep an already established state
$IPT -A INPUT -p udp --dport 5060 -j ACCEPT			#need this or the audio is choppy

#$IPT -A FORWARD -o eth0 -p udp --dport 5060 -j ACCEPT		#not needed so commented out
#$IPT -t nat -A POSTROUTING -o eth0 -j SNAT --to-source $EXTIP	#not needed so commented out

$IPT -A INPUT -p udp -m udp --dport 5004:5082 -j ACCEPT		# SIP on UDP port 5060. Other SIP servers may need TCP port 5060 as well
#$IPT -A INPUT -p udp -m udp --dport 4569 -j ACCEPT			# IAX2- the IAX protocol
#$IPT -A INPUT -p udp -m udp --dport 5036 -j ACCEPT			# IAX - most have switched to IAX v2, or ought to
$IPT -A INPUT -p udp -m udp --dport 10000:15000 -j ACCEPT		# RTP - the media stream, NEEDED FOR AUDIO
#$IPT -A INPUT -p udp -m udp --dport 2727 -j ACCEPT	 		# MGCP - if you use media gateway control protocol

$IPT -A INPUT -i eth1 -p tcp --dport 5038 -j ACCEPT			# allow the asterisk call manager to connect

#$IPT -A INPUT -i eth1 -p udp --dport 5038 -j ACCEPT			#need this or the audio is choppy
#$IPT -A INPUT -i ech1 -p tcp --dport 5038 -j ACCEPT			#need this or the audio is choppy



################### LIME WIRE ####################################
#$IPT -A INPUT -p tcp --destination-port 6346 -j ACCEPT


$IPT -A FORWARD -p tcp -i $EXTNIC --dport 6346 -o $INTNIC -j ACCEPT
$IPT -A FORWARD -p udp -i $EXTNIC --dport 6346 -o $INTNIC -j ACCEPT



echo "Web server that goes meow"
# Let the outside world reach the internal lan for a web server
#$IPT -t nat -A PREROUTING --dst $EXTIP -p tcp --dport 8080 -j DNAT --to-destination $TCATIP		#to tomcate from web user
#$IPT -t nat -A POSTROUTING -p tcp --dst $TCATIP --dport 8080 -j SNAT --to-source 192.168.10.20	#returned to web user from tomcat
#$IPT -t nat -A OUTPUT --dst $EXTIP -p tcp --dport 8080 -j DNAT --to-destination $TCATIP		#firewall tries to connect to tomcat


# Allow forwarding of incoming Port 8080 traffic to DMZ Web server
iptables -A FORWARD -i $EXTNIC -o $INTNIC -d 192.168.10.101 -p tcp --dport 8080 -j ACCEPT

# Enable DNAT port translation to DMZ Web server
iptables -t nat -A PREROUTING -i $EXTNIC -d $EXTIP -p tcp --dport 8080 -j DNAT --to 192.168.10.101





# drop all other packets
echo "	applying default drop policies"
echo ""
$IPT -A INPUT -i eth0 -p tcp --dport 0:65535 -j DROP
$IPT -A INPUT -i eth0 -p udp --dport 0:65535 -j DROP
# Catch all rule, all other forwarding is denied and logged. 
#$IPT -A FORWARD -j drop-and-log-it								#doesn't work as is




echo "All done"