#!/bin/sh

IPTABLES=/sbin/iptables
INT=eth2
EXT=eth1

case "$1" in
start)
        echo -n "Starting IP Firewall and NAT..."
        echo "1" > /proc/sys/net/ipv4/ip_forward
        echo "1" > /proc/sys/net/ipv4/tcp_syncookies

        # Clear old rules
        $IPTABLES -X
        $IPTABLES -F
        $IPTABLES -Z

        # Create OUTPUT chain

        # INPUT Rules - Add to this section the ports you wish to explicitly allow connections on
        #       Below are some common services that are commonly used
        #       Comment out the lines to disable access to these services
        #       The port numbers for other services you may wish to allow can be found in the /etc/services file

# Input Rules
#Allows connections you start
        $IPTABLES -A INPUT -i $EXT -m state --state ESTABLISHED,RELATED -j ACCEPT
        $IPTABLES -A OUTPUT -o $EXT -m state --state ESTABLISHED,RELATED -j ACCEPT

#Allow Loopback
        $IPTABLES -A INPUT -i lo -j ACCEPT
        $IPTABLES -A OUTPUT -o lo -j ACCEPT

#Allow PPP interfaces
        $IPTABLES -A INPUT -i ppp+ -j ACCEPT
        $IPTABLES -A FORWARD -o ppp+ -j ACCEPT
        $IPTABLES -A OUTPUT -o ppp+ -j ACCEPT

#SSH Connections
        $IPTABLES -A INPUT -i $EXT -p tcp --dport 22 -j ACCEPT
        $IPTABLES -A OUTPUT -o $EXT -p tcp --dport 22 -j ACCEPT

#DNS Connections
        $IPTABLES -A INPUT -i $EXT -p udp --dport 53 -j ACCEPT
        $IPTABLES -A OUTPUT -o $EXT -p udp --dport 53 -j ACCEPT
#SNMP
        $IPTABLES -A INPUT -i $EXT -p udp --dport 161 -j ACCEPT
        $IPTABLES -A OUTPUT -o $EXT -p udp --dport 161 -j ACCEPT

########### EXTERNAL INTERFACE VPN

#L2TPD-FORWARD and MARK
        $IPTABLES -A PREROUTING -t mangle -i $EXT -p esp -j MARK  --set-mark 1
        $IPTABLES -A PREROUTING -t mangle -i $EXT -p udp ---dport 500 --sport 500 j MARK  --set-mark 2
        $IPTABLES -A PREROUTING -t mangle -i $EXT -p udp --dport 4500 --sport 4500 -j MARK  --set-mark 3
        $IPTABLES -A PREROUTING -t mangle -i $EXT -p tcp --dport 500 --sport 500 -j MARK  --set-mark 4
        $IPTABLES -A PREROUTING -t mangle -i $EXT -p tcp --dport 4500 --sport 4500 -j MARK  --set-mark 5
        $IPTABLES -A FORWARD -i $EXT -m mark --mark 1 -j ACCEPT
        $IPTABLES -A FORWARD -i $EXT -m mark --mark 2 -j ACCEPT
        $IPTABLES -A FORWARD -i $EXT -m mark --mark 3 -j ACCEPT
        $IPTABLES -A FORWARD -i $EXT -m mark --mark 4 -j ACCEPT
        $IPTABLES -A FORWARD -i $EXT -m mark --mark 5 -j ACCEPT
        $IPTABLES -A FORWARD -i $INT -j ACCEPT
        $IPTABLES -A FORWARD -i $INT -p udp -m udp --sport 1701 -j ACCEPT

#L2TPD-REJECT
       $IPTABLES -A INPUT -i $EXT -p udp --dport 1701 -j REJECT
       $IPTABLES -A INPUT -i $EXT -p udp --dport 17 -j REJECT
       $IPTABLES -A OUTPUT -o $EXT -p udp --dport 1701 -j REJECT
       $IPTABLES -A OUTPUT -o $EXT -p udp --dport 17 -j REJECT

#ISAKMP
        $IPTABLES -A INPUT -i $EXT -p udp --sport 500 --dport 500 -j ACCEPT
        $IPTABLES -A OUTPUT -o $EXT -p udp --sport 500 --dport 500 -j ACCEPT
        $IPTABLES -A INPUT -i $EXT -p udp --sport 4500 --dport 4500 -j ACCEPT
        $IPTABLES -A OUTPUT -o $EXT -p udp --sport 4500 --dport 4500 -j ACCEPT

#ESP AND AH
        $IPTABLES -A INPUT -i $EXT -p 50 -j ACCEPT
        $IPTABLES -A OUTPUT -o $EXT -p 50 -j ACCEPT
        $IPTABLES -A INPUT -i $EXT -p 51 -j ACCEPT
        $IPTABLES -A OUTPUT -o $EXT -p 51 -j ACCEPT

############### INTERNAL INTERFACE REJECTING

#ISAKMP
        $IPTABLES -A INPUT -i $INT -p udp --sport 500 --dport 500 -j REJECT
        $IPTABLES -A OUTPUT -o $INT -p udp --sport 500 --dport 500 -j REJECT

#ISAKMP NAT-T
        $IPTABLES -A INPUT -i $INT -p udp --sport 4500 --dport 4500 -j REJECT
        $IPTABLES -A OUTPUT -o $INT -p udp --sport 4500 --dport 4500 -j REJECT

#L2TPD-REJECT
        $IPTABLES -A OUTPUT -o $INT -p udp --sport 1701 --dport 1701 -j REJECT
        $IPTABLES -A INPUT -i $INT -p udp --sport 1701 --dport 1701 -j REJECT
        $IPTABLES -A OUTPUT -o $INT -p udp --sport 17 --dport 17 -j REJECT
        $IPTABLES -A INPUT -i $INT -p udp --sport 17 --dport 17 -j REJECT

# Allow pings, but reject the rest
        $IPTABLES -A INPUT -i $EXT -p icmp -j ACCEPT
        $IPTABLES -A OUTPUT -o $EXT -p icmp -j ACCEPT
        $IPTABLES -A INPUT -i $EXT -j REJECT
        $IPTABLES -A OUTPUT -o $EXT -j REJECT

        echo "done."
        ;;
stop)
        echo -n "Stopping IP Firewall and NAT..."
        $IPTABLES -X
        $IPTABLES -F
        $IPTABLES -Z

        # Input Rules
        echo "done."
        ;;

restart)
        echo -n "Restarting IP Firewall and NAT..."
        $0 stop > /dev/null
        sleep 1
        $0 start > /dev/null
        ;;

*)
        echo "Usage: $0 {start|stop|restart}"
        ;;
esac