#!/bin/sh
# Copyright © 2002/6 by ubra of PhY Group. All rights reserved.
# <ubra@phy.corp.org>
# modified by xnull <admin@voidsecurity.org>:
# Ver. BETA
IPTABLES="/sbin/iptables"

EXTIF="eth0"
INTIF="eth1"

z_stop() {
         $IPTABLES -F
         $IPTABLES -Z       
         $IPTABLES -X 
      #  $IPTABLES -t nat -F
      #  $IPTABLES -t nat -Z
      #  $IPTABLES -t nat -X
       $IPTABLES -P INPUT ACCEPT
       $IPTABLES -P FORWARD ACCEPT

}

z_start() {
        $IPTABLES -F
        $IPTABLES -X
        $IPTABLES -Z
        $IPTABLES -P INPUT DROP
        $IPTABLES -P FORWARD DROP
        $IPTABLES -P OUTPUT ACCEPT
        
        $IPTABLES -N LOGDROP       
        $IPTABLES -t filter -A LOGDROP -m limit --limit 20/minute --limit-burst 3 -j LOG --log-level info --log-prefix "[DR] " --log-tcp-sequence --log-tcp-options --log-ip-options 
        $IPTABLES -t filter -A LOGDROP -j DROP
        
        $IPTABLES -N LOGACCEPT
        $IPTABLES -t filter -A LOGACCEPT -m limit --limit 40/minute --limit-burst 3 -j LOG --log-level info --log-prefix "[AC] " --log-tcp-sequence --log-tcp-options --log-ip-options
        $IPTABLES -t filter -A LOGACCEPT -j ACCEPT
        
        $IPTABLES -N TCPINC  
        $IPTABLES -t filter -A TCPINC -p tcp -m state --state ESTABLISHED -j ACCEPT
        $IPTABLES -t filter -A TCPINC -i lo -p tcp -j ACCEPT
        $IPTABLES -t filter -A TCPINC -i ! $EXTIF -p tcp --syn -s 85.186.59.143 --dport 22 -j LOGACCEPT
        $IPTABLES -t filter -A TCPINC -p tcp -j LOGDROP
        
        $IPTABLES  -N UDPINC
        $IPTABLES  -t filter -A UDPINC -i lo -p udp -j ACCEPT
        #$IPTABLES -t filter -A UDPINC -i ! $EXTIF -p udp -s 194.105.25.129 -d 255.255.255.255 -j DROP
        #$IPTABLES -t filter -A UDPINC -i ! $EXTIF -p udp -m unclean -j LOGDROP
       $IPF -t filter -A UDPINC -p udp -m state --state ESTABLISHED --source-port 53 -j ACCEPT
        
        $IPTABLES -N ICMPINC
        $IPTABLES -t filter -A ICMPINC -i lo -p icmp -j ACCEPT
        $IPTABLES -t filter -A ICMPINC -i $EXTIF -p icmp -m unclean -j LOGDROP
        $IPTABLES -t filter -A ICMPINC -i $EXTIF -p icmp --icmp-type echo-reply -m state --state ESTABLISHED -m limit --limit 90/minute --limit-burst 20 -j ACCEPT
        $IPTABLES -t filter -A ICMPINC -i $EXTIF -p icmp --icmp-type timestamp-reply -m state --state ESTABLISHED -m limit --limit 90/minute --limit-burst 20 -j ACCEPT
        $IPTABLES -t filter -A ICMPINC -i $EXTIF -p icmp --icmp-type destination-unreachable -m state --state RELATED -m limit --limit 15/minute --limit-burst 5 -j ACCEPT
        $IPTABLES -t filter -A ICMPINC -i $EXTIF -p icmp --icmp-type time-exceeded -m state --state RELATED -m limit --limit 15/minute --limit-burst 5 -j ACCEPT
        $IPTABLES -t filter -A ICMPINC -p $EXTIF -j LOGDROP
        
        $IPTABLES -t filter -A INPUT -p tcp  -j TCPINC
        $IPTABLES -t filter -A INPUT -p udp  -j UDPINC
        $IPTABLES -t filter -A INPUT -p icmp -j ICMPINC



}

z_restart() {
        firewall_stop
        sleep 1
        firewall_start
}
case "$1" in
        start)
                z_start
                echo "PhiroWall: Started"
                ;;
        stop)
                z_stop
                echo "PhiroWall: Stoped"
                ;;
        restart)
                z_restart
                echo "PhiroWall: Restarted"
                ;;
        *)
                z_restart
esac