#!/bin/bash

# Define interfaces and subnets
WAN="eth0"
LAN="eth1"
LOCAL="192.168.1.0/24"
TRUSTED="192.168.1.0/25"
UNTRUSTED="192.168.1.128/25"
ROUTER="192.168.0.1"

# Define individual hosts (grab IPs from DNS)
LITHIUM=$(host -t A lithium | grep address | awk '{ print $NF }')
EAGLE=$(host -t A eagle | grep address | awk '{ print $NF }')
DEEPTHOUGHT=$(host -t A deepthought | grep address | awk '{ print $NF }')
DRIFTER=$(host -t A drifter | grep address | awk '{ print $NF }')
SERVER1=$(host -t A server1 | grep address | awk '{ print $NF }')

# Flush tables
iptables -F
iptables -t nat -F

# Set policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Set general rules
iptables -A INPUT -i lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT             # Allow everything from localhost to localhost
iptables -A INPUT -i ${LAN} -s ${TRUSTED} -j ACCEPT                     # Allow all packets from trusted LAN
iptables -A FORWARD -i ${LAN} -s ${LOCAL} -d ! ${LOCAL} -j ACCEPT       # Prevent bouncing packets from broken hosts, and allow outgoing
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT        # Allow all established connections
iptables -A FORWARD -i ${WAN} -d ${LOCAL} -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s ${ROUTER} -j ACCEPT                                # Allow communication with router
iptables -A FORWARD -s ${ROUTER} -j ACCEPT
iptables -A INPUT -i ${WAN} -s 192.168.0.0/16 -j DROP                   # Stop spoofed packets from the net :)
iptables -A INPUT -i ${WAN} -s 10.0.0.0/8 -j DROP
iptables -A INPUT -i ${WAN} -s 172.16.0.0/12 -j DROP

# Protect from untrusted LAN
iptables -A INPUT -i ${LAN} -s ${UNTRUSTED} -p tcp --dport 53 -j ACCEPT         # Allow DNS
iptables -A INPUT -i ${LAN} -s ${UNTRUSTED} -p udp --dport 53 -j ACCEPT
iptables -A INPUT -i ${LAN} -s ${UNTRUSTED} -p tcp --dport 22 -j ACCEPT         # Allow SSH
iptables -A INPUT -i ${LAN} -s ${UNTRUSTED} -p all -j DROP                      # Drop everything else

# Port forwarding for servers
#iptables -A FORWARD -i ${WAN} -p tcp --dport 22 -j ACCEPT                                      # SSH (shell server)
#iptables -t nat -A PREROUTING -p tcp --dport 22 -i ${WAN} -j DNAT --to ${EAGLE}
iptables -A FORWARD -i ${WAN} -p tcp --dport 25 -j ACCEPT                                       # SMTP
iptables -t nat -A PREROUTING -p tcp --dport 25 -i ${WAN} -j DNAT --to ${SERVER1}
iptables -A FORWARD -i ${WAN} -p tcp --dport 80 -j ACCEPT                                       # Apache webserver
iptables -t nat -A PREROUTING -p tcp --dport 80 -i ${WAN} -j DNAT --to ${LITHIUM}
iptables -A FORWARD -i ${WAN} -p tcp --dport 110 -j ACCEPT                                      # POP3
iptables -t nat -A PREROUTING -p tcp --dport 110 -i ${WAN} -j DNAT --to ${SERVER1}
iptables -A FORWARD -i ${WAN} -p tcp --dport 143 -j ACCEPT                                      # IMAP
iptables -t nat -A PREROUTING -p tcp --dport 143 -i ${WAN} -j DNAT --to ${SERVER1}
iptables -A FORWARD -i ${WAN} -p tcp --dport 993 -j ACCEPT                                      # IMAP-SSL
iptables -t nat -A PREROUTING -p tcp --dport 993 -i ${WAN} -j DNAT --to ${SERVER1}
iptables -A FORWARD -i ${WAN} -p tcp --dport 995 -j ACCEPT                                      # POP3-SSL
iptables -t nat -A PREROUTING -p tcp --dport 995 -i ${WAN} -j DNAT --to ${SERVER1}
iptables -A FORWARD -i ${WAN} -p tcp --dport 8767 -j ACCEPT                                     # TeamSpeak
iptables -t nat -A PREROUTING -p tcp --dport 8767 -i ${WAN} -j DNAT --to ${LITHIUM}
iptables -A FORWARD -i ${WAN} -p udp --dport 8767 -j ACCEPT                                     # TeamSpeak
iptables -t nat -A PREROUTING -p udp --dport 8767 -i ${WAN} -j DNAT --to ${LITHIUM}
iptables -A FORWARD -i ${WAN} -p tcp --dport 6667:6669 -j ACCEPT                                # IRCd
iptables -t nat -A PREROUTING -p tcp --dport 6667:6669 -i ${WAN} -j DNAT --to ${LITHIUM}
iptables -A FORWARD -i ${WAN} -p tcp --dport 6690:6699 -j ACCEPT                                # IRCd-SSL
iptables -t nat -A PREROUTING -p tcp --dport 6690:6699 -i ${WAN} -j DNAT --to ${LITHIUM}

# Port forwarding for other things
iptables -A FORWARD -i ${WAN} -p tcp --dport 6881:6889 -j ACCEPT                                        # BitTorrent
iptables -t nat -A PREROUTING -p tcp --dport 6881:6889 -i ${WAN} -j DNAT --to ${DEEPTHOUGHT}
iptables -A FORWARD -i ${WAN} -p udp --dport 6881:6889 -j ACCEPT                                        # BitTorrent
iptables -t nat -A PREROUTING -p udp --dport 6881:6889 -i ${WAN} -j DNAT --to ${DEEPTHOUGHT}
iptables -A FORWARD -i ${WAN} -p tcp --dport 7777:7778 -j ACCEPT                                # UT2004
iptables -t nat -A PREROUTING -p tcp --dport 7777:7778 -i ${WAN} -j DNAT --to ${DEEPTHOUGHT}
iptables -A FORWARD -i ${WAN} -p udp --dport 7777:7778 -j ACCEPT                                # UT2004
iptables -t nat -A PREROUTING -p udp --dport 7777:7778 -i ${WAN} -j DNAT --to ${DEEPTHOUGHT}
iptables -A FORWARD -i ${WAN} -p tcp --dport 10777 -j ACCEPT                                    # UT2004
iptables -t nat -A PREROUTING -p tcp --dport 10777 -i ${WAN} -j DNAT --to ${DEEPTHOUGHT}
iptables -A FORWARD -i ${WAN} -p udp --dport 10777 -j ACCEPT                                    # UT2004
iptables -t nat -A PREROUTING -p udp --dport 10777 -i ${WAN} -j DNAT --to ${DEEPTHOUGHT}

# Enable DNAT (outgoing)
iptables -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE

# Log all dropped packets
iptables -A INPUT -i ${WAN} -j LOG --log-level info --log-prefix "iptables:INPUT:DROP:"         # Log dropping connection attempts
iptables -A FORWARD -i ${WAN} -j LOG --log-level info --log-prefix "iptables:FORWARD:DROP:"     # Log failed forwarding attempts