#!/bin/bash

#  IPTABLES  FIREWALL  script for the Linux 2.6 Kernel
#  by wireddd

# How much detail do you want in the log?
# 0 - errors only
# 9 - everything
LogLevel=9

# log file for the script to place error/status messages
ScriptLogFile="/var/log/firewall_test.log"

# location of various binaries
IPTABLES=/sbin/iptables
LSMOD=/sbin/lsmod
DEPMOD=/sbin/depmod
MODPROBE=/sbin/modprobe
GREP=/bin/grep
AWK=/usr/bin/awk
SED=/bin/sed
IFCONFIG=/sbin/ifconfig
DATE=/bin/date
PS=/bin/ps

# Internal Network Interface
INTIF="eth0"

# External Network Interface
EXTIF="eth1"

# how to display the date in the logfile
dateformat="+%Y.%m.%d_%T"



# Internal Network
INTNET="192.168.10.0/24"

# Internal Interface IP address
INTIP="`/sbin/ifconfig $INTIF | $GREP 'inet addr' | $AWK '{print $2}' | $SED -e 's/.*://'`"

# external interface and IP
EXTIP="`/sbin/ifconfig $EXTIF | $GREP 'inet addr' | $AWK '{print $2}' | $SED -e 's/.*://'`"


UNIVERSE="0.0.0.0/0"

arrBlockedIPs+=("222.62.149.99")
arrBlockedIPs+=("63.86.79.37")
arrBlockedIPs+=("218.5.4.236")
arrBlockedIPs+=("218.1.74.179")
arrBlockedIPs+=("150.140.140.91")
arrBlockedIPs+=("62.75.221.159")
arrBlockedIPs+=("61.157.58.251")

arrBlockedExtIPPorts+=("788")
arrBlockedExtIPPorts+=("847")
arrBlockedExtIPPorts+=("2049")
arrBlockedExtIPPorts+=("111")
arrBlockedExtIPPorts+=("80")
arrBlockedExtIPPorts+=("445")

arrBlockedVpnPorts+=("21")
arrBlockedVpnPorts+=("80")
arrBlockedVpnPorts+=("445")
arrBlockedVpnPorts+=("135")
arrBlockedVpnPorts+=("137")
arrBlockedVpnPorts+=("138")
arrBlockedVpnPorts+=("139")
arrBlockedVpnPorts+=("2049")

arrPortsToForward+=("192.168.10.38 tcp 7878")

# array of kernel modules to load
KernelModules+=("ip_tables")
KernelModules+=("ip_conntrack")
KernelModules+=("ip_conntrack_ftp")
KernelModules+=("ip_conntrack_irc")
KernelModules+=("iptable_nat")
KernelModules+=("ip_nat_ftp")
KernelModules+=("ip_nat_irc")

addtolog ()
{
    if [ -z $2 ] || [ $2 -le $LogLevel ]
    then
        echo "`$DATE $dateformat`: firewall script: $1" >> $ScriptLogFile
    fi
}


loadKernelModules ()
{
    addtolog "Loading Kernel Modules" 2
    # probe all modules
    /sbin/depmod -a
        if [ $? -ne 0 ]
        then
            addtolog "Command Failed: /sbin/depmod -a"
            exit 1
        fi
    for ModuleToLoad in "${KernelModules[@]}"
    do
        if [ -z "` $LSMOD | $GREP $ModuleToLoad | $AWK {'print $1'} `" ]
        then
            if [ -z "`$MODPROBE -l $ModuleToLoad`" ]
            then
                addtolog "FATAL ERROR: Module Not Found: $ModuleToLoad"
                exit 1
            fi
            $MODPROBE -q $ModuleToLoad
            if [ $? -ne 0 ]
            then
                addtolog "FATAL ERROR: Module Failed To Load: $ModuleToLoad"
                exit 1
            fi
        fi
    done
}

enableIpForwarding ()
{
    addtolog "Enabling IP forwarding" 2
    echo "1" > /proc/sys/net/ipv4/ip_forward
    echo "1" > /proc/sys/net/ipv4/ip_dynaddr
}

buildIpTablesRules ()
{
    addtolog "Building iptables Rules" 2
    
    # Clear any existing rules and setting default policy to DROP
    arrIpTablesArg+=("-P INPUT DROP")
    arrIpTablesArg+=("-P OUTPUT DROP")
    arrIpTablesArg+=("-P FORWARD DROP")
    arrIpTablesArg+=("-F INPUT ")
    arrIpTablesArg+=("-F OUTPUT ")
    arrIpTablesArg+=("-F FORWARD ")
    arrIpTablesArg+=("-F -t nat")
    
    # Flush the user chain.. if it exists
    if [ "`iptables -L | $GREP drop-and-log-it`" ]; then
        arrIpTablesArg+=("-F drop-and-log-it")
    fi
    
    # Delete all User-specified chains
    arrIpTablesArg+=("-X")
    
    # Reset all IPTABLES counters
    arrIpTablesArg+=("-Z")
    
    # Creating a DROP chain
    arrIpTablesArg+=("-N drop-and-log-it")
    arrIpTablesArg+=("-A drop-and-log-it -j LOG --log-level info ")
    arrIpTablesArg+=("-A drop-and-log-it -j REJECT")
    
    
    addtolog "Building iptables Rules: INPUT rulesets" 4
    
    ######### INPUT CHAIN ############
  
    # add rules to block ip addresses from array
    for BlockedIP in "${arrBlockedIPs[@]}"
    do
        arrIpTablesArg+=(" -A INPUT -s $BlockedIP -j drop-and-log-it")
    done
    
    # add rules to block Incoming connections to ports on the EXternal Ip address
    for BlockedExtIPPort in "${arrBlockedExtIPPorts[@]}"
    do
        arrIpTablesArg+=("-A INPUT -d $EXTIP -p TCP --dport $BlockedExtIPPort -j drop-and-log-it")
    done
    
    # loopback interfaces are valid.
    arrIpTablesArg+=("-A INPUT -i lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT")
    ##-----------------------------------------------------------------
    #iptables -A INPUT -i eth0 -s 192.168.10.121 -j drop-and-log-it 
    
    # build rules for blocking vpn ports
    for BlockedPort in "${arrBlockedVpnPorts[@]}"
    do
        arrIpTablesArg+=("-A INPUT -i tun+ -p TCP --dport $BlockedPort -j REJECT")
    done
    
    arrIpTablesArg+=("-A INPUT -i tun+ -d 192.168.10.38 -j ACCEPT")
    
    #iptables -A FORWARD -i tun+ -j ACCEPT
    
    # local interface, local machines, going anywhere is valid
    arrIpTablesArg+=("-A INPUT -i $INTIF -s $INTNET -d $UNIVERSE -j ACCEPT")
    
    # remote interface, claiming to be local machines, IP spoofing, get lost
    arrIpTablesArg+=("-A INPUT -i $EXTIF -s $INTNET -d $UNIVERSE -j drop-and-log-it")
    
    # remote interface, any source, going to permanent PPP address is valid
    arrIpTablesArg+=("-A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -j ACCEPT")
    
    # Allow any related traffic coming back to the MASQ server in
    arrIpTablesArg+=("-A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -m state --state ESTABLISHED,RELATED -j ACCEPT")
    
    
    #  OPTIONAL:  Uncomment the following two commands if plan on running
    #             an Apache Web site on the firewall server itself
    #
    #echo -e "      - Allowing EXTERNAL access to the WWW server"
    #iptables -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 80 -j ACCEPT
    
    #iptables -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -s $UNIVERSE -d 192.168.10.12 -p tcp --dport 80 -j ACCEPT
    
    arrIpTablesArg+=("-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT")
    arrIpTablesArg+=("-A INPUT -m state --state NEW -i ! $EXTIF -j ACCEPT")
    
    arrIpTablesArg+=("-A INPUT -i $EXTIF -d 255.255.255.255 -p udp --dport 68 -j ACCEPT")
    
    # Catch all rule, all other incoming is denied and logged. 
    arrIpTablesArg+=("-A INPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it")
    
    
    addtolog "Building iptables Rules: OUTPUT rulesets" 4
    
    ########## OUTPUT CHAIN ###############
    
    # loopback interface is valid.
    arrIpTablesArg+=("-A OUTPUT -o lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT")
    
    arrIpTablesArg+=("-A OUTPUT -o tun+ -s 192.168.10.38 -j ACCEPT")
    
    # local interfaces, any source going to local net is valid
    arrIpTablesArg+=("-A OUTPUT -o $INTIF -s $EXTIP -d $INTNET -j ACCEPT")
    
    # local interface, any source going to local net is valid
    arrIpTablesArg+=("-A OUTPUT -o $INTIF -s $INTIP -d $INTNET -j ACCEPT")
    
    # outgoing to local net on remote interface, stuffed routing, deny
    arrIpTablesArg+=("-A OUTPUT -o $EXTIF -s $UNIVERSE -d $INTNET -j drop-and-log-it")
    
    # anything else outgoing on remote interface is valid
    arrIpTablesArg+=("-A OUTPUT -o $EXTIF -s $EXTIP -d $UNIVERSE -j ACCEPT")
    
    # Catch all rule, all other outgoing is denied and logged. 
    arrIpTablesArg+=("-A OUTPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it")
    
    
    addtolog "Building iptables Rules: FORWARD rulesets" 4
    
    ############# FORWARD CHAIN ##############
    
    # build rules for port forwarding
    for PortToForward in "${arrPortsToForward[@]}";
    do 
        read host proto port <<< "$PortToForward"
        arrIpTablesArg+=("-A FORWARD -i $EXTIF -o $INTIF -m state --state NEW,ESTABLISHED,RELATED -s $UNIVERSE -d $host -p $proto --dport $port -j ACCEPT")
    done
    for PortToForward in "${arrPortsToForward[@]}";
    do 
        read host proto port <<< "$PortToForward"
    arrIpTablesArg+=("-t nat -A PREROUTING -p $proto --dport $port -i $EXTIF -j DNAT --to $host")
    done
    
    # forwarding rules for vpn route
    
    arrIpTablesArg+=("-A FORWARD -i tun+ -o $INTIF -j ACCEPT")
    arrIpTablesArg+=("-A FORWARD -i $INTIF -o tun+ -j ACCEPT")
    arrIpTablesArg+=("-A FORWARD -i tun+ -o $EXTIF -j drop-and-log-it")
    
    arrIpTablesArg+=("-A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT")
    arrIpTablesArg+=("-A FORWARD -i $INTIF -o $EXTIF -j ACCEPT")
    
    # Catch all rule, all other forwarding is denied and logged. 
    arrIpTablesArg+=("-A FORWARD -j drop-and-log-it")
    
    # Enable SNAT (MASQUERADE) functionality on $EXTIF
    arrIpTablesArg+=("-t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP")
    
    #limit upload speed
    #iptables -t mangle -A FORWARD -s 192.168.10.0/24 -j MARK --set-mark 3
    #iptables -t mangle -A FORWARD -s $EXTIP -j MARK --set-mark 3
    
    #limit download speed
    #iptables -t mangle -A FORWARD -s ! 192.168.10.0/24 -d 192.168.1.0/24 -j MARK --set-mark 4
    #iptables -t mangle -A FORWARD -s ! 192.168.10.0/24 -d $EXTIP -j MARK --set-mark 4
    
    addtolog "Building iptables Rules: Complete" 3
}

loadIpTablesRules ()
{
    addtolog "Loading iptables rules" 2
    for IpTablesArg in "${arrIpTablesArg[@]}"
    do
        $IPTABLES $IpTablesArg
        if [ $? -ne 0 ]
        then
            addtolog "Command Failed: $IPTABLES $IpTablesArg"
            exit 1
        fi
    done
    addtolog "Loading iptables Rules: Complete" 3
}

loadNoip2 ()
{
    if [ ! "`$PS aux | $GREP noip2 | $GREP -v grep`" ]
    then
        /usr/local/bin/noip2
        if [ $? -ne 0 ]
        then
            addtolog "Failed to load noip2"
        else
            addtolog "noip2 Loaded" 2
        fi
    else
        addtolog "noip2 is allready running" 4
    fi
}

#------- INIT --------
addtolog "Running" 1
buildIpTablesRules
loadKernelModules
enableIpForwarding
loadIpTablesRules
loadNoip2
addtolog "Complete" 1
exit 0