#!/bin/sh
#
# /etc/init.d/firewall
#
# Firewall Scandium
#

###################################
# Configuratie
###################################

NAME=$0

INET_IP="192.168.1.200"
INET_NET="192.168.1.0/24"
INET_IFACE="eth0"
INET_BROADCAST="192.168.1.255"

#LAN_IP="10.1.1.1"
#LAN_NET="10.1.1.0/24"
#LAN_IFACE="eth1"
#LAN_BROADCAST="10.1.1.255"

LAN_IP="192.168.1.240"
LAN_NET="192.168.1.0/24"
LAN_IFACE="eth1"
LAN_BROADCAST="192.168.1.255"


LO_IP="127.0.0.1"
LO_IFACE="lo"

IPTABLES="/sbin/iptables"
MODPROBE="/sbin/modprobe"

case "$1" in

###################################
#     ---    START    ---
###################################

start)
echo -n "Starting firewall... "

####################################
# Modules en Proc-dingen
####################################


#/sbin/depmod -a

$MODPROBE ip_tables
$MODPROBE ip_conntrack
$MODPROBE iptable_filter
$MODPROBE iptable_mangle
$MODPROBE iptable_nat
$MODPROBE ipt_LOG
$MODPROBE ipt_limit
$MODPROBE ipt_state

#$MODPROBE ipt_owner
$MODPROBE ipt_REJECT
#$MODPROBE ipt_MASQUERADE
$MODPROBE ip_conntrack_ftp
#$MODPROBE ip_conntrack_irc
$MODPROBE ip_nat_ftp
#$MODPROBE ip_nat_irc

# http://www.tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.kernel.obscure.html

# If the kernel should attempt to forward packets. Off by default.

echo "1" > /proc/sys/net/ipv4/ip_forward

####################################
# Default Policies
####################################

$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT

$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT

###################################
# INPUT chain
###################################

# Log weird packets that don't match the above.
$IPTABLES -A INPUT -m limit --limit 100/minute --limit-burst 100 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "

###################################
# FORWARD CHAIN
###################################


$IPTABLES -A POSTROUTING -t nat -o $INET_IFACE -s $INET_NET -j MASQUERADE

$IPTABLES -A FORWARD -p ALL -i $LAN_IFACE -o $INET_IFACE -s $LAN_NET -j ACCEPT
$IPTABLES -A FORWARD -p ALL -i $INET_IFACE -o $LAN_IFACE -d $LAN_NET -j ACCEPT
;;

###################################
#     ---    STOP    ---
###################################

stop)
echo -n "Stopping firewall... "

# reset the default policies in the filter table.
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT

# reset the default policies in the nat table.
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT

# reset the default policies in the mangle table.
$IPTABLES -t mangle -P PREROUTING ACCEPT
$IPTABLES -t mangle -P OUTPUT ACCEPT

# flush all the rules in the filter and nat tables.
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F

# erase all chains that's not default in filter and nat table.
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X

# Stop packet forwarding
echo "0" > /proc/sys/net/ipv4/ip_forward

echo "Done."
;;


###################################
#     ---    RESTART    ---
###################################

restart|force-reload)
$0 stop
$0 start
;;

*)
echo "Usage: /etc/init.d/$NAME {start|stop|restart|force-reload}"
exit 1
;;

esac

exit 0