#!/bin/sh

localnet="192.168.1.0/24"
wanif=ppp0
lanif=br0

stop() {

# flush all existing chains in all tables (automagically)
cat /proc/net/ip_tables_names | while read table; do
  iptables -t $table -L -n | while read c chain rest; do
      if [ "X$c" = "XChain" ] ; then
        iptables -t $table -F $chain
      fi
  done
  iptables -t $table -X
done

# delete all fw-rules manually (maybe better?!)


# set default policy
iptables -P OUTPUT  ACCEPT
iptables -P INPUT   DROP
iptables -P FORWARD DROP
iptables -I INPUT -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -p tcp --dport 22  -j ACCEPT
# disable forwarding
# echo 0 > /proc/sys/net/ipv4/ip_forward
}

start() {

# set default policy
iptables -D INPUT -p tcp --dport 443 -j ACCEPT 2>/dev/null
iptables -D INPUT -p tcp --dport 22  -j ACCEPT 2>/dev/null
iptables -P OUTPUT  ACCEPT
iptables -P INPUT   DROP
iptables -P FORWARD DROP


# load needed modules
MODULE_DIR="/lib/modules/`uname -r`"
MODULES="ipt_conntrack ip_conntrack_ftp ip_nat_ftp ip_conntrack_irc ip_nat_irc ipt_limit ipt_ttl ipt_pkttype ipt_LOG"
for module in $(echo $MODULES); do
  if [ -e "${MODULE_DIR}/${module}.o" -o -e "${MODULE_DIR}/${module}.o" ]; then
    insmod ${module} >/dev/null 2>/dev/null
  fi
done

# enable proc-stuff (but no forward before filters are implemented) #####################################################
echo 1    > /proc/sys/net/ipv4/ip_dynaddr
echo 1    > /proc/sys/net/ipv4/conf/all/rp_filter
echo 0    > /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0    > /proc/sys/net/ipv4/conf/all/accept_redirects
echo 0    > /proc/sys/net/ipv4/conf/all/log_martians
echo 1    > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 0    > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo 1    > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo 30   > /proc/sys/net/ipv4/tcp_fin_timeout
echo 1    > /proc/sys/net/ipv4/tcp_window_scaling
echo 1    > /proc/sys/net/ipv4/tcp_sack
echo 1    > /proc/sys/net/ipv4/tcp_fack
echo 1    > /proc/sys/net/ipv4/tcp_syncookies
echo 1    > /proc/sys/net/ipv4/tcp_ecn
echo 1    > /proc/sys/net/ipv4/tcp_timestamps

##### anti dos and bullshit rules: ##########################################################
iptables -A INPUT   -m state --state INVALID -j DROP
iptables -A FORWARD -m state --state INVALID -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# on lo everything is allowed
iptables -A INPUT -i lo -j ACCEPT


# Ping echo erlauben, aber max 1/sekundea
iptables -N TOOMUCHPING
# 0/0 is icmp echo-reply
# 8/0 is icmp echo-request
iptables -A INPUT   -p icmp --icmp-type 8/0  -m limit --limit 2/second -j ACCEPT
iptables -A INPUT   -p icmp --icmp-type 8/0  -j TOOMUCHPING
iptables -A TOOMUCHPING -m limit --limit 1/second -j LOG  --log-level debug --log-prefix "(TOOMUCHPING):DROP "
iptables -A TOOMUCHPING -j DROP

# traceroute erlauben (traceroute expects REJECTS)
iptables -A INPUT -p udp --dport 1024: -m ttl --ttl-eq 1 -j REJECT --reject-with icmp-port-unreachable
# explicitly REJECT identd lookups, helps connecting to much services faster (e.g. irc-servers)
iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset

# FORWARDING STUFF ######################################################################################
iptables -t nat -A POSTROUTING -o $wanif -j MASQUERADE

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state NEW -i $lanif -o $lanif -j ACCEPT
iptables -A FORWARD -m state --state NEW -i $lanif -o $wanif -j ACCEPT


####  LAN : #############################################################################################
# ALL LAN
# dhcp

iptables -A INPUT -i $lanif -p udp --dport 67 -m state --state NEW -j ACCEPT
# gkrellmd
iptables -A INPUT -i $lanif -p tcp -s $localnet --dport 19150  -m state --state NEW -j ACCEPT
# dns
iptables -A INPUT -i $lanif -p udp -s $localnet --dport 53 -m state --state NEW -j ACCEPT
# ntp
#iptables -A INPUT -i $lanif -p udp -s $localnet --dport 123 -m state --state NEW -j ACCEPT
# snmp
#iptables -A INPUT -i $lanif -p udp -s $localnet --dport 161 -m state --state NEW -j ACCEPT

# 22 -> kaeptnb (ssh)

iptables -t nat -A PREROUTING -i $wanif -p tcp --dport 22 -j DNAT --to 192.168.1.5:22
iptables        -A FORWARD -i $wanif -p tcp --dport 22  -j ACCEPT

# 443 von extern -> router (ssh)
iptables -t nat -A PREROUTING -i $wanif -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.1.1:22

# www
iptables -t nat -A PREROUTING -i $wanif -p tcp --dport 80 -j DNAT --to 192.168.1.5:80
iptables        -A FORWARD -i $wanif -p tcp --dport 80  -j ACCEPT

# webcam
iptables -t nat -A PREROUTING -i $wanif -p tcp --dport 9192 -j DNAT --to 192.168.1.5:9192

iptables        -A FORWARD -i $wanif -p tcp --dport 9192  -j ACCEPT

##### OTHER  REACHABLE STUFF ################################################################################
#allow bacula-sd acces from vido.info
#iptables -A INPUT -p tcp -s 217.160.172.151 --dport 9103 -m state --state NEW -j ACCEPT

###### WORLD WIDE SERVICES ###################################################################################
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT

###### default policy (verbose) ##############################################################################
iptables -N CATCHALL
iptables -A INPUT -j CATCHALL
iptables -A FORWARD -j CATCHALL
# log everything else which gets dropped, but only 1 logentry/sec max, and no broadcast/multicast stuff (it sucks)
#iptables -A CATCHALL -i ! ppp0 -m limit --limit 1/second -m pkttype --pkt-type unicast -j LOG  --log-level debug --log-prefix "(CATCHALL):REJECT "
iptables -A CATCHALL -m limit --limit 1/second -m pkttype --pkt-type unicast -j LOG  --log-level debug --log-prefix "(CATCHALL):REJECT "
iptables -A CATCHALL -m limit --limit 2/second -j REJECT
iptables -A CATCHALL -j DROP

echo 1 > /proc/sys/net/ipv4/ip_forward

[ -x /etc/init.d/shaper.sh ] && /etc/init.d/shaper.sh restart 2>/dev/null >/dev/null
}

case "$1" in
  autostart)
        start
        ;;
  start)
        start
        ;;
  stop)
        stop
        ;;
  restart)
        stop
        start
        ;;
  *)
        echo $"Usage: $0 {start|stop|stopall|restart}"
        exit 1
esac