#!/bin/sh

#########################
# configuration options #
#########################

INET_IP="201.12.35.51"
INET_IFACE="eth0"

LAN_IP="192.168.1.1"
LAN_IP_RANGE="192.168.1.0/24"
LAN_IFACE="eth1"

LO_IFACE="lo"
LO_IP="127.0.0.1"

IPTABLES=`which iptables`
MODPROBE=`which modprobe`

################
# load modules #
################

#$MODPROBE ip_conntrack_ftp
#$MODPROBE ip_conntrack_irc

#######################
# /proc configuration #
#######################

echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "30" > /proc/sys/net/ipv4/tcp_fin_timeout
echo "1800" > /proc/sys/net/ipv4/tcp_keepalive_time
echo "60" > /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout
echo "32768 61000" > /proc/sys/net/ipv4/ip_local_port_range

###############
# set policie #
###############

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP

#########
# flush #
#########

$IPTABLES -F
$IPTABLES -F -t nat
$IPTABLES -F -t mangle

$IPTABLES -X
$IPTABLES -X -t nat
$IPTABLES -X -t mangle

###############################################################################
#			            Chains				      #
###############################################################################

#################
# create chains #
#################

$IPTABLES -N allowed_packets
$IPTABLES -N denied_packets

$IPTABLES -N tcp_packets
$IPTABLES -N udp_packets
$IPTABLES -N icmp_packets

########################
# chain denied_packets #
########################

$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK \
-m state --state NEW -j DROP
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \
--log-prefix "New not SYN:"
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP

#########################
# chain allowed_packets #
#########################

$IPTABLES -A allowed -p tcp --syn -j ACCEPT
$IPTABLES -A allowed -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p tcp -j DROP

#####################
# chain tcp_packets #
#####################

# accept ftp.
$IPTABLES -A tcp_packets -p tcp -s 0/0 --dport 21 -j allowed

#####################
# chain udp_packets #
#####################

# accept dns.
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 53 -j ACCEPT

# block fucking microsoft boxes requests.
$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d $INET_BROADCAST \
--destination-port 135:139 -j DROP

# block dhcp broadcast too.
$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d 255.255.255.255 \
--destination-port 67:68 -j DROP

######################
# chain icmp_packets #
######################

$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT

###############################################################################
#				Filter Rules				      #
###############################################################################

#####################
# Mangle PREROUTING #
#####################

$IPTABLES -t mangle -A PREROUTING -p tcp --dport 20 -j TOS --set-tos Maximize-Throughput
$IPTABLES -t mangle -A PREROUTING -p tcp --dport 21 -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A PREROUTING -p tcp --dport 22 -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A PREROUTING -p tcp --dport 25 -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A PREROUTING -p udp --dport 53 -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A PREROUTING -p tcp --dport 80 -j TOS --set-tos Maximize-Throughput
$IPTABLES -t mangle -A PREROUTING -p tcp --dport 110 -j TOS --set-tos Maximize-Throughput
$IPTABLES -t mangle -A PREROUTING -p tcp --dport 443 -j TOS --set-tos Maximize-Throughput

###############
# INPUT chain #
###############

# we don't want bad packets.
$IPTABLES -A INPUT -p tcp -j bad_tcp_packets

# special rules not for internet.
$IPTABLES -A INPUT -p all -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p all -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPTABLES -A INPUT -p all -i $LO_IFACE -s $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -p all -i $LO_IFACE -s $INET_IP -j ACCEPT

# accept dhcp.
$IPTABLES -A INPUT -p udp -i $LAN_IFACE --dport 67 --sport 68 -j ACCEPT

# accept incoming packets from the internet.
$IPTABLES -A INPUT -p all -d $INET_IP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p tcp -i $INET_IFACE -j tcp_packets
$IPTABLES -A INPUT -p udp -i $INET_IFACE -j udp_packets
$IPTABLES -A INPUT -p icmp -i $INET_IFACE -j icmp_packets

# accept esp/ike protocols for IPSEC.
iptables -A INPUT  -p udp -i $INET_IP --sport 500 --dport 500 -j ACCEPT
iptables -A INPUT  -p 50 -i $INET_IP -j ACCEPT

# stop multicasts from microsoft.
$IPTABLES -A INPUT -i $INET_IFACE -d 224.0.0.0/8 -j DROP

# log all other packets.
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "INPUT blocked: "

#################
# FORWARD chain #
#################

# we don't want bad packets.
$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets

# accept packets we actually want to forward.
$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# log all other packets.
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "FORWARD blocked: "

#################
# Mangle OUTPUT #
#################

$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p tcp --dport 20 -j TOS --set-tos Maximize-Throughput
$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p tcp --dport 21 -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p tcp --dport 22 -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p tcp --dport 25 -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p udp --dport 53 -j TOS --set-tos Maximize-Throughput
$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p tcp --dport 80 -j TOS --set-tos Maximize-Throughput
$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p tcp --dport 110 -j TOS --set-tos Maximize-Throughput
$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p tcp --dport 443 -j TOS --set-tos Maximize-Throughput
$IPTABLES -t mangle -A OUTPUT -o $INET_IP -p tcp --dport 6000:6063 -j TOS --set-tos Maximize-Throughput

################
# OUTPUT chain #
################

# we don't want bad packets.
$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets

# accept all output packets.
$IPTABLES -A OUTPUT -p all -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p all -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p all -s $INET_IP -j ACCEPT

# log all other packets.
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "OUTPUT blocked: "

###############
# POSTROUTING #
###############

$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP