#!/bin/bash

. /etc/rc.conf
. /etc/rc.d/functions

INTERNET="eth0"
SERVICII="http ssh auth 16980"        # servicii (porturi) care pot fi accesate din interneti


case "$1" in
start)
        #echo "Porneste firewallu"
        echo "Starting Firewall"
        iptables -P INPUT DROP                          # blocheaza tot
        iptables -A INPUT -i ! ${INTERNET} -j ACCEPT
        iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # permite pachetele din conexiuni deja stabilite

        # accepta conexiuni noi pe porturile din $SERVICII
        for i in ${SERVICII}; do
        iptables -A INPUT -p tcp --dport ${i} -m state --state NEW -j ACCEPT
        done

        # NAT, daca nu aveti nevoie, stergeti linia
        iptables -t nat -A POSTROUTING -o ${INTERNET} -j MASQUERADE
        echo 1 > /proc/sys/net/ipv4/ip_forward

        #Deschid port pentru torrent
        iptables -t nat -I PREROUTING -p tcp --dport 22769 -i ${INTERNET} -j DNAT --to 192.168.0.2
;;
stop)
        echo "Stopping Firewall"
        iptables -F INPUT
        iptables -P INPUT ACCEPT
        # opreste NAT, daca nu aveti nevoie, stergeti linia
        iptables -t nat -F POSTROUTING
;;
restart)
    $0 stop
    sleep 1
    $0 start
;;
*)
    echo "usage: $0 {start|stop|restart}"  
esac
exit 0