# Firehol Configuration which implement masquerading and firewalling by Cougar
#
version 5
# Path to ipTables and other binaries
GREP="/bin/grep"
CUT="/usr/bin/cut"
AWK="/usr/bin/awk"
SED="/bin/sed"
CAT="/bin/cat"
IFCONFIG="/sbin/ifconfig"

INTERFACE_LAN="eth0"
INTERFACE_WAN="eth1"
FIREHOL_LOG_MODE="ULOG"
# Custom BitTorrent Service
server_bt1_ports="tcp/49752:49800 udp/49752:49800"
client_bt1_ports="any"
client_bt2_ports="any"

# Initialize IPTables
echo " "
# Begin network interface IP retrieval
LAN_IP=$($IFCONFIG $INTERFACE_LAN | $GREP inet\ addr | $CUT -f 2 -d \: | $CUT -f 1 -d " ")
WAN_IP=$($IFCONFIG $INTERFACE_WAN | $GREP inet\ addr | $CUT -f 2 -d \: | $CUT -f 1 -d " ")
# Confirmation
echo "Using $INTERFACE_LAN as LAN network interface with IP address of $LAN_IP"
echo "Using $INTERFACE_WAN as WAN network interface with IP address of $WAN_IP"
# End network interface IP retrieval

# Port Forwarding Configuration
echo -n "Configuring port forwarding: "
        #dnat to 10.1.3.1 inface ${INTERFACE_WAN} proto tcp dport 6881:6999
        #dnat to 10.1.3.1 inface ${INTERFACE_WAN} proto udp dport 6881:6999
echo "done." || echo "FAILED."

# PeerGuardian Configuration (Must be in place for PeerGuardian to receive packets)
iptables --new PEERGUARDIAN 
iptables -A PEERGUARDIAN -j QUEUE

# Set up IP Blocks (Must be set before any interfaces are declared)
blacklist 73.182.176.1

# Firewall for traffic hitting mercury from the Internet
echo -n "Configuring $INTERFACE_WAN: "
interface ${INTERFACE_WAN} world
        policy reject
        protection full
        server ping PEERGUARDIAN
        server ssh PEERGUARDIAN
        server bt1 PEERGUARDIAN
        server dhcp drop
        client all PEERGUARDIAN
echo "done." || echo "FAILED."

# Firewall for traffic hitting mercury from the LAN
echo -n "Configuring $INTERFACE_LAN: "
interface ${INTERFACE_LAN} lan
        policy reject
        protection full
        server dhcp PEERGUARDIAN
        server dns PEERGUARDIAN
        server ssh PEERGUARDIAN
        server samba PEERGUARDIAN
        server ntp PEERGUARDIAN
        server cups drop
        server ping PEERGUARDIAN
        client all PEERGUARDIAN
echo "done." || echo "FAILED."
         
# Router for masquerading traffic from the LAN to the Internet
echo -n "Configuring router for masquerading traffic from $INTERFACE_LAN to $INTERFACE_WAN: "
router masq inface ${INTERFACE_LAN} outface ${INTERFACE_WAN}
        protection full
        masquerade
        server all PEERGUARDIAN # Allows LAN clients access to services on the Internet
echo "done." || echo "FAILED."

# Router for port-forwarded traffic coming from the Internet
echo -n "Configuring router for port forwarding traffic from $INTERFACE_WAN: "
router services inface ${INTERFACE_WAN} outface ${INTERFACE_LAN}
        protection full
        server all PEERGUARDIAN #Accept all services matched against those being forwarded
echo "done." || echo "FAILED."