#!/bin/sh

# our subnets:
# 10.0.0.0 - us, wired
# 10.0.1.0 - other people, wired (TODO: merge)
# 10.0.2.0 - wireless
# 10.0.3.0 - VPN

# IMPORTANT: Everything not EXT_IF is made routable to anything
# else not EXT_IF, and can reach the net
EXT_IF=${EXT_IF:-ethCable}
EXT_IP=$(/sbin/ifconfig $EXT_IF | grep "inet addr" | awk '{print $2}' | cut -f2 -d:)
# Also, if VPN_ONLY_INTERFACES is set, all computers not listed
# in /etc/novpn must use VPN on any interfaces in the list
VPN_ONLY_INTERFACES=${VPN_ONLY_INTERFACES:-ath0}

IPTABLES=/usr/sbin/iptables

function start() {
$IPTABLES -P INPUT DROP
$IPTABLES -A INPUT -i lo -j ACCEPT # Allow localhost connections

##### sysctl-based defenses #####
# Help protect against spoofing
for i in /proc/sys/net/ipv4/conf/*/rp_filter; do
	echo 1 > $i;
done
# don't participate in smurf attacks
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Ignore ICMP redirects
for i in /proc/sys/net/ipv4/conf/*/accept_redirects ; do
	echo 0 > $i;
done
# Ignore packets with source routing
for i in /proc/sys/net/ipv4/conf/*/accept_source_route ; do
	echo 0 > $i;
done


##### Connection tracking rules #####
$IPTABLES -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -m conntrack --ctstate RELATED -j ACCEPT

#### Rules to allow by ports and/or ICMP type #####
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT # ping
$IPTABLES -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT # ssh
$IPTABLES -A INPUT -p udp -m udp --dport 8767 -j ACCEPT # ts
$IPTABLES -A INPUT -p udp -m udp --dport 1194 -j ACCEPT # openvpn
$IPTABLES -A INPUT -p tcp --dport 443 -j ACCEPT # openvpn (YA RLY)
$IPTABLES -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT # HTTP
$IPTABLES -A INPUT ! -i $EXT_IF -p tcp -m tcp --dport 25 -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 5000:5050 -j ACCEPT # temphack:torrent
# Some interfaces shouldn't be allowed much
if [ "x$VPN_ONLY_INTERFACES" != "x" ]; then
	$IPTABLES -N InputVPNOnly 2>/dev/null
	for mac in $(cut -f1 '-d ' /etc/novpn); do
		$IPTABLES -A InputVPNOnly -m mac --mac-source $mac -j RETURN
	done
	$IPTABLES -A InputVPNOnly -p udp -m udp --dport 67 -j ACCEPT # DHCP
	$IPTABLES -A InputVPNOnly -p tcp -m tcp --dport dhcpv6-server -j ACCEPT # DHCP
	$IPTABLES -A InputVPNOnly -p udp -m udp --dport 53 -j ACCEPT # DNS
	$IPTABLES -A InputVPNOnly	-j DROP
	for interface in $VPN_ONLY_INTERFACES; do
		$IPTABLES -A INPUT -i $interface -j InputVPNOnly
	done
fi
# Actual local services
$IPTABLES -N InputLocal 2>/dev/null
$IPTABLES -A InputLocal -p tcp -m tcp --dport 3306 -j ACCEPT #mysql
$IPTABLES -A InputLocal -p udp -m udp --dport 67 -j ACCEPT # DHCP
$IPTABLES -A InputLocal -p udp -m udp --dport 53 -j ACCEPT # DNS
$IPTABLES -A InputLocal -p tcp -m tcp --dport dhcpv6-server -j ACCEPT # DHCP
$IPTABLES -A INPUT ! -i $EXT_IF -j InputLocal

##### IP Masquerading (internet connection sharing) #####
# Don't just allow everything into the internal network
$IPTABLES -F FORWARD
$IPTABLES -P FORWARD DROP
#$IPTABLES -A FORWARD -d ut2004master1.epicgames.com -j REJECT --reject-with host-unreach
#$IPTABLES -A FORWARD -d ut2004master2.epicgames.com -j REJECT --reject-with host-unreach
# Allow incoming from established and related connections
# Block out bittorrent 
#$IPTABLES -A FORWARD -m ipp2p --ipp2p -i $INT_IF ! -s newton.hoe -j REJECT --reject-with port-unreach
$IPTABLES -A FORWARD -i $EXT_IF ! -o $EXT_IF -m state --state ESTABLISHED,RELATED -j ACCEPT
# No forwarding for novpn interfaces :)
if [ "x$VPN_ONLY_INTERFACES" != "x" ]; then
	$IPTABLES -N ForwardVPNOnly
	for mac in $(cut -f1 '-d ' /etc/novpn); do
		$IPTABLES -A ForwardVPNOnly -m mac --mac-source $mac -j RETURN
	done
	for interface in $VPN_ONLY_INTERFACES; do
		$IPTABLES -A ForwardVPNOnly ! -o lo -j REJECT --reject-with host-unreach
	done
	$IPTABLES -A FORWARD -i $interface -j ForwardVPNOnly
fi

# Unfiltered 
$IPTABLES -A INPUT ! -i $EXT_IF -j ACCEPT
$IPTABLES -A FORWARD ! -i $EXT_IF -j ACCEPT
# Enable masquerading
$IPTABLES -t nat -F POSTROUTING
$IPTABLES -t nat -A POSTROUTING -o $EXT_IF -j MASQUERADE

$IPTABLES -t nat -F PREROUTING
# More VPN_ONLY fu
if [ "x$VPN_ONLY_INTERFACES" != "x" ]; then
	$IPTABLES -t nat -N PreroutingVPNOnly
	for mac in $(cut -f1 '-d ' /etc/novpn); do
		$IPTABLES -t nat -A PreroutingVPNOnly -m mac --mac-source $mac -j RETURN
	done
	$IPTABLES -t nat -A PreroutingVPNOnly -p tcp --dport 80 ! -d 10.0.0.1 -j DNAT --to-destination 10.0.0.1
	for interface in $VPN_ONLY_INTERFACES; do
		$IPTABLES -t nat -A PREROUTING -i $interface -j PreroutingVPNOnly
	done
fi
# Forward some ports to help bittorrent along!
$IPTABLES -t nat -A PREROUTING -i $EXT_IF -p tcp --dport 4096:4200 -j DNAT --to-destination 10.0.0.10
$IPTABLES -t nat -A PREROUTING -i $EXT_IF -p udp --dport 4096:4200 -j DNAT --to-destination 10.0.0.10
$IPTABLES -A FORWARD -i $EXT_IF ! -o $EXT_IF -p tcp --dport 4096:4200 -j ACCEPT
$IPTABLES -A FORWARD -i $EXT_IF ! -o $EXT_IF -p udp --dport 4096:4200 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 4096:4200 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 4096:4200 -j ACCEPT
$IPTABLES -A INPUT -p tcp --sport 4096:4200 -j ACCEPT
$IPTABLES -A INPUT -p udp --sport 4096:4200 -j ACCEPT

# Enable IP packet forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# Enable helper modules for IRC and FTP
/sbin/modprobe ip_nat_irc
/sbin/modprobe ip_nat_ftp
}
function stop() {
$IPTABLES -t mangle -F
$IPTABLES -t nat -F
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F
$IPTABLES -X InputLocal 2>/dev/null
$IPTABLES -t nat -X PreroutingVPNOnly 2>/dev/null
$IPTABLES -X InputVPNOnly 2>/dev/null
$IPTABLES -X ForwardVPNOnly 2>/dev/null
for i in /proc/sys/net/ipv4/conf/*/rp_filter; do
	 echo 0 > $i; 
done
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
for i in /proc/sys/net/ipv4/conf/*/accept_redirects ; do
	echo 1 > $i;
done
for i in /proc/sys/net/ipv4/conf/*/accept_source_route ; do
	echo 1 > $i;
done
$IPTABLES -t nat -F POSTROUTING
echo 0 > /proc/sys/net/ipv4/ip_forward
}
stop;
case $1 in
	stop)
		exit;
		;;
	*)
		start;
esac