#!/bin/bash
# Do iptables based masquerading and firewalling.
# ~spot, 09/01/2002

# You don't need to see these ;)
set SSHPORT = ""
set FTPPOST = ""

# Set default PATH
export PATH=/sbin:/usr/sbin:/bin:/usr/bin

# Load NAT modules
modprobe iptable_nat
modprobe ip_nat_ftp
modprobe ip_nat_irc

# Load connection-tracking modules
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_conntrack_irc

# Flush old iptables rules 
iptables -F 
iptables -X 
iptables -Z

# Start APF
#/etc/init.d/apf start
# APF sets some system values and iptable rules already for us, so we'll have our rules be applied after starting it...

sysctl -e -q -w net.ipv4.icmp_echo_ignore_broadcasts=1
sysctl -e -q -w net.ipv4.icmp_ignore_bogus_error_responses=1
sysctl -e -q -w net.ipv4.conf.all.accept_redirects=0
sysctl -e -q -w net.ipv6.conf.all.accept_redirects=0
sysctl -e -q -w net.ipv4.conf.all.send_redirects=0
sysctl -e -q -w net.ipv6.conf.all.send_redirects=0
sysctl -e -q -w net.ipv4.conf.all.accept_source_route=0
sysctl -e -q -w net.ipv4.conf.all.forwarding=0
#sysctl -e -q -w net.ipv4.conf.all.mc_forwarding=0
sysctl -e -q -w net.ipv4.conf.all.rp_filter=1
sysctl -e -q -w net.ipv4.conf.all.log_martians=1
sysctl -e -q -w net.ipv4.tcp_max_syn_backlog=1280
sysctl -e -q -w net.ipv4.tcp_syncookies=1
sysctl -e -q -w net.ipv4.tcp_synack_retries=2
sysctl -e -q -w net.ipv4.ip_forward=1

# Allow forwarding through the internal interface
iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -o eth1 -j ACCEPT 
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT 

# Default forward policy to DROP
iptables -P FORWARD DROP

# Do masquerading through eth0
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Port Forwarding
#iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 2222 -j DNAT --to-destination 192.128.100.2:22

# Firewall Rules

# Loopback - Allow unlimited traffic
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# SYN-Flooding Protection
#iptables -N syn-flood
#iptables -A INPUT -i eth0 -p tcp --syn -j syn-flood
#iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
#iptables -A syn-flood -j DROP

# Make sure that new TCP connections are SYN packets
iptables -A INPUT -i eth0 -p tcp ! --syn -m state --state NEW -j DROP

# Fragments: Don't trust the little buggers. Send 'em to hell.
iptables -A INPUT -i eth0 -f -j DROP

# Refuse spoofed packets
#  Broadcast Ips
iptables -A INPUT -i eth0 -d 0.0.0.0/8 -j DROP
iptables -A INPUT -i eth0 -d 255.255.255.255 -j DROP
#  Loopback Ip
iptables -A INPUT -i eth0 -d 127.0.0.0/8 -j DROP
#  Multicast Ips
iptables -A INPUT -i eth0 -d 224.0.0.0/4 -j DROP
iptables -A INPUT -i eth0 -d 240.0.0.0/5 -j DROP
#  Reserved by IANA
iptables -A INPUT -i eth0 -d 169.254.0.0/16 -j DROP
iptables -A INPUT -i eth0 -d 192.0.34.0/24 -j DROP
iptables -A INPUT -i eth0 -d 192.0.0.0/24 -j DROP
#  RFC 1918
iptables -A INPUT -i eth0 -d 10.0.0.0/8 -j DROP
iptables -A INPUT -i eth0 -d 172.16.0.0/12 -j DROP
iptables -A INPUT -i eth0 -d 192.168.0.0/16 -j DROP

# Allow BootP/DHCP UDP requests
iptables -A INPUT -i eth0 -p udp -d 0/0 --dport 67:68 -j ACCEPT

# DNS: Allow UDP packets in for DNS client from nameservers
iptables -A INPUT -i eth0 -p udp -s 0/0 --sport 53 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p udp -d 0/0 --dport 53 -j ACCEPT

# SSH: allow all sshd incoming connections (including the port fw)
#iptables -A INPUT -i eth0 -p tcp -d 0/0 --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -d 0/0 --dport $SSHPORT -j ACCEPT

# HTTP: allow all http/https incoming/return connections
iptables -A INPUT -i eth0 -p tcp -s 0/0 --sport 80 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 0/0 --sport 443 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -d 0/0 --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -d 0/0 --dport 443 -j ACCEPT

# FTP: allow all ftpd incoming connections
#iptables -A INPUT -i eth0 -p tcp -d 0/0 --dport 21 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -d 0/0 --dport $FTPPORT -j ACCEPT
# Enable active ftp transfers
iptables -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
# Enable passive ftp transfers
iptables -A INPUT  -i eth0 -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT

# Enable ident probes (IRC)
iptables -t filter -A INPUT -i eth0 -p tcp -d 0/0 --dport 113 -j ACCEPT

# Allow ICMP in if it is related to other connections
iptables -A INPUT -i eth0 -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow bot traffic through
iptables -A INPUT -i eth0 -p tcp -d 0/0 --dport 8676 -j ACCEPT

# Enable dcc
iptables -A INPUT -i eth0 -p tcp -m state --state RELATED -j ACCEPT  

# Drop UDP
iptables -A INPUT -i eth0 -p udp -j DROP

# Drop ICMP
iptables -A INPUT -i eth0 -p icmp -j DROP

# Drop Windows NetBIOS noise
iptables -A INPUT -i eth0 -p tcp -s 0/0 --sport 137:139 -j DROP

# Drop IGMP noise
iptables -A INPUT -i eth0 -p 2 -j DROP

# Drop TCP
iptables -A INPUT -i eth0 -p tcp -j DROP

# Drop Anything else not allowed
#iptables -A INPUT -i eth0 -j DROP