#!/bin/sh

######### Interface Variables
WAN="eth1"
LAN="eth0"
DMZ="eth2"
IP_LAN=`ifconfig $LAN | grep -e "inet addr" | awk {'print $2'} | awk -F: {'print $2'}`
IP_WAN=`ifconfig $WAN | grep -e "inet addr" | awk {'print $2'} | awk -F: {'print $2'}`

######## Load Modules
load_modules(){
IRCPORTS="6665,6666,6667,6668,6669,7000"
modprobe ip_tables
modprobe iptable_filter
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ipt_state
modprobe ipt_MASQUERADE
modprobe ip_conntrack_irc ports=$IRCPORTS
modprobe ip_nat_irc ports=$IRCPORTS
}
load_modules

######## Flush Rules
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F
iptables -F -t nat
iptables -F -t mangle
iptables -X
iptables -X -t nat
iptables -X -t mangle
######## Default Policy
policy_drop(){
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
}
policy_accept(){
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
}
policy_drop

######## Kernel Settings
kernel(){
#echo "1" > /proc/sys/net/ipv4/conf/all/accept_source_route
#echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all
#echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
#echo "0" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo "1" > /proc/sys/net/ipv4/conf/all/accept_redirects
echo "0" > /proc/sys/net/ipv4/conf/all/log_martians
echo "1" > /proc/sys/net/ipv4/ip_forward
}
for interface in /proc/sys/net/ipv4/conf/*/rp_filter; do /bin/echo "1" > ${interface} ; done
#kernel
echo "1" > /proc/sys/net/ipv4/ip_forward

iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE


######## TRANSPARENT SQUID
iptables -t nat -A PREROUTING -i $WAN -p tcp --dport 80 -j REDIRECT --to-port 3128

######## Block new connections
block_new(){
iptables -A INPUT   -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT   -m state --state NEW -j ACCEPT
iptables -A OUTPUT  -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
}
#block_new

######## New Table: LOGDROP
iptables -N logdrop
iptables -F logdrop
iptables -A logdrop -m limit --limit 2/s --limit-burst 3 -j LOG --log-prefix "LOGDROP: "
iptables -A logdrop -j DROP

######## New Table: SYNFLOOD
iptables -N synflood
iptables -F synflood
iptables -A synflood -m limit --limit 1/s --limit-burst 4 -j RETURN
iptables -A synflood -j DROP

######## New Tables: ICMP_TRAFFIC
iptables -N icmp_traffic
iptables -F icmp_traffic
#iptables -A icmp_traffic -m limit --limit 5/s --limit-burst 3 -j LOG --log-prefix "ICMP: "
iptables -A icmp_traffic -p icmp -j ACCEPT

####### RFC1918
rfc1918(){
iptables -A INPUT -i $LAN -s 127.0.0.1 -j DROP
iptables -A INPUT -i $LAN -s $IP_LAN -j DROP
iptables -A INPUT -i $WAN -s $IP_LAN -j DROP
iptables -A INPUT -i $WAN -s 127.0.0.1 -j DROP
iptables -A INPUT -i $WAN -s 10.0.0.0/8 -j DROP
iptables -A INPUT -i $WAN -s 172.16.0.0/12 -j DROP
iptables -A INPUT -i $WAN -s 192.168.0.0/16 -j DROP
}
rfc1918
######## SSH
iptables -A INPUT   -i $LAN -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT  -o $LAN -p tcp --sport 22 -j ACCEPT
iptables -A FORWARD -p tcp --dport 22 -j ACCEPT
iptables -A FORWARD -p tcp --sport 22 -j ACCEPT

######## ICMP
icmp_j(){
iptables -A INPUT   -p icmp -j icmp_traffic
iptables -A OUTPUT  -p icmp -j icmp_traffic
iptables -A FORWARD -p icmp -j icmp_traffic
}

######## ICMP
iptables -A INPUT   -p icmp -j ACCEPT
iptables -A OUTPUT  -p icmp -j ACCEPT
iptables -A FORWARD -p icmp -j ACCEPT

######## Loopback Interface
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

######## Speed Up ssh connections
iptables -t mangle -A PREROUTING -p tcp --sport 22 -j TOS --set-tos Minimize-Delay

######## SKYPE
iptables -A FORWARD -p tcp --sport  2940:3000 -j logdrop
iptables -A FORWARD -p udp --sport  1247 -j logdrop


######## DNS
iptables -A INPUT   -p udp --sport 53 -j ACCEPT
iptables -A OUTPUT  -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -p udp --sport 53 -j ACCEPT
iptables -A FORWARD -p udp --dport 53 -j ACCEPT

########  WEB
#iptables -A FORWARD -p tcp --sport 80 -j LOG --log-prefix "WWW in:" -m limit --limit 5/s
#iptables -A FORWARD -p tcp --dport 80 -j LOG --log-prefix "WWW out:" -m limit --limit 5/s
iptables -A FORWARD -p tcp --sport 80 -m state --state ESTABLISHED     -j ACCEPT
iptables -A FORWARD -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 443 -m state --state ESTABLISHED     -j ACCEPT
iptables -A FORWARD -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 3128 -m state --state ESTABLISHED     -j ACCEPT
iptables -A FORWARD -p tcp --dport 3128 -m state --state NEW,ESTABLISHED -j ACCEPT

######## IRC
iptables -A FORWARD -p tcp --sport 6665:7000 -j ACCEPT
iptables -A FORWARD -p tcp --dport 6665:7000 -j ACCEPT

######## MSN
iptables -A INPUT  -p tcp --sport 1863 -j LOG --log-prefix "MSN in: " -m limit --limit 5/s
iptables -A OUTPUT -p tcp --dport 1863 -j LOG --log-prefix "MSN out: " -m limit --limit 5/s
iptables -A FORWARD -p tcp --sport 1863 -j ACCEPT
iptables -A FORWARD -p tcp --dport 1863 -j ACCEPT