#!/bin/sh
 # Variáveis
echo " "
echo " "
echo " "
echo " "

# Variaveis

 # -------------------------------------------------------#
 iptables="/usr/sbin/iptables"
 IF_EXTERNA="eth0"
 IF_INTERNA="eth1"

echo "----------------------------------------------------"
echo "==========>>> Rede Externa  - Internet <<<=========="
echo                       $IF_EXTERNA
echo "----------------------------------------------------"
echo " "
echo " "
echo "----------------------------------------------------"
echo "==========>>> Rede Interna  -  Empresa <<<=========="
echo                       $IF_INTERNA
echo "----------------------------------------------------"


 # Ativa módulos
 # -------------------------------------------------------#
 /sbin/modprobe ip_conntrack
 /sbin/modprobe ip_conntrack_ftp
 /sbin/modprobe ip_nat_ftp
 /sbin/modprobe ip_queue
 /sbin/modprobe ip_tables
 /sbin/modprobe ipt_LOG
 /sbin/modprobe ipt_MARK
 /sbin/modprobe ipt_MASQUERADE
 /sbin/modprobe ipt_MIRROR
 /sbin/modprobe ipt_REDIRECT
 /sbin/modprobe ipt_REJECT
 /sbin/modprobe ipt_TCPMSS
 /sbin/modprobe ipt_TOS
 /sbin/modprobe ipt_limit
 /sbin/modprobe ipt_mac
 /sbin/modprobe ipt_mark
 /sbin/modprobe ipt_multiport
 /sbin/modprobe ipt_owner
 /sbin/modprobe ipt_state
 /sbin/modprobe ipt_tcpmss
 /sbin/modprobe ipt_tos
 /sbin/modprobe ipt_unclean
 /sbin/modprobe iptable_filter
 /sbin/modprobe iptable_mangle
 /sbin/modprobe iptable_nat

 # Ativa roteamento no kernel
 # -------------------------------------------------------#
 echo "1" > /proc/sys/net/ipv4/ip_forward


 # Proteção contra IP spoofing
 # -------------------------------------------------------#
 echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter

 # protecao conta ping
 #---------------------------------------------------------#
 # echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all

 # Zera regras
 # -------------------------------------------------------#
 $iptables -F
 $iptables -X
 $iptables -F -t nat
 $iptables -X -t nat
 $iptables -F -t mangle
 $iptables -X -t mangle


 # Determina a política padrão
 # -------------------------------------------------------#
 $iptables -P INPUT DROP
 $iptables -P OUTPUT DROP
 $iptables -P FORWARD DROP


 #################################################
 # Tabela FILTER
 #################################################

# echo "Dropando TCP Indesejavel"

 # Dropa pacotes TCP indesejáveis
 # -------------------------------------------------------#
 $iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j LOG --log-level 6 --log-prefix "FWL: NEW sem syn: "
 $iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP

# echo "Dropa Pacote Mal Formado"

 # Dropa pacotes mal formados
 # -------------------------------------------------------#
 $iptables -A INPUT -i $IF_EXTERNA -m unclean -j LOG --log-level 6 --log-prefix "FWL: pacote mal formado: "
 $iptables -A INPUT -i $IF_EXTERNA -m unclean -j DROP

# echo "Aceitando Pacotes que Devem Entrar!"

 # Aceita os pacotes que realmente devem entrar
 # -------------------------------------------------------#
 $iptables -A INPUT -i ! $IF_EXTERNA -j ACCEPT
 $iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 $iptables -A OUTPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
 $iptables -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT

#echo "trinoo"

 # Proteção contra trinoo
 # -------------------------------------------------------#
 $iptables -N TRINOO
 $iptables -A TRINOO -m limit --limit 15/m -j LOG --log-level 6 --log-prefix "FWL: trinoo: "
 $iptables -A TRINOO -j DROP
 $iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 27444 -j TRINOO
 $iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 27665 -j TRINOO
 $iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 31335 -j TRINOO
 $iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 34555 -j TRINOO
 $iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 35555 -j TRINOO

# echo "trojan"

 # Proteção contra tronjans
 # -------------------------------------------------------#
 $iptables -N TROJAN
 $iptables -A TROJAN -m limit --limit 15/m -j LOG --log-level 6 --log-prefix "FWL: trojan: "
 $iptables -A TROJAN -j DROP
 $iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 666 -j TROJAN
 $iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 4000 -j TROJAN
 $iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 6000 -j TROJAN
 $iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 6006 -j TROJAN
 $iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 16660 -j TROJAN

# echo "worms"

 # Proteção contra worms
 # -------------------------------------------------------#
 $iptables -A FORWARD -p tcp --dport 135 -i $IF_INTERNA -j REJECT

# SAMBA
# $iptables -I INPUT -i $IF_EXTERNA -p TCP --dport 445 -j REJECT
# $iptables -I OUTPUT -i $IF_EXTERNA -p TCP --dport 445 -j REJECT
# $iptables -I FORWARD -i $IF_EXTERNA -p TCP --dport 445 -j REJECT

# echo "syn-flood"

 # Proteção contra syn-flood
 # -------------------------------------------------------#
 $iptables -A FORWARD -p tcp --syn -m limit --limit 2/s -j ACCEPT

# echo "ping-die"

 # Proteção contra ping da morte
 # -------------------------------------------------------#
 $iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT


 # Proteção contra port scanners
 # -------------------------------------------------------#
 $iptables -N SCANNER
 $iptables -A SCANNER -m limit --limit 15/m -j LOG --log-level 6 --log-prefix "FWL: port scanner: "
 $iptables -A SCANNER -j DROP
 $iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -i $IF_EXTERNA -j SCANNER
 $iptables -A INPUT -p tcp --tcp-flags ALL NONE -i $IF_EXTERNA -j SCANNER
 $iptables -A INPUT -p tcp --tcp-flags ALL ALL -i $IF_EXTERNA -j SCANNER
 $iptables -A INPUT -p tcp --tcp-flags ALL FIN,SYN -i $IF_EXTERNA -j SCANNER
 $iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -i $IF_EXTERNA -j SCANNER
 $iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -i $IF_EXTERNA -j SCANNER
 $iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -i $IF_EXTERNA -j SCANNER


 # Loga tentativa de acesso a determinadas portas
 # -------------------------------------------------------#
 $iptables -A INPUT -p tcp --dport 21 -i $IF_EXTERNA -j LOG --log-level 6 --log-prefix "FWL: ftp: "
 $iptables -A INPUT -p tcp --dport 23 -i $IF_EXTERNA -j LOG --log-level 6 --log-prefix "FWL: telnet: "
 $iptables -A INPUT -p tcp --dport 25 -i $IF_EXTERNA -j LOG --log-level 6 --log-prefix "FWL: smtp: "
 $iptables -A INPUT -p tcp --dport 80 -i $IF_EXTERNA -j LOG --log-level 6 --log-prefix "FWL: http: "
 $iptables -A INPUT -p tcp --dport 110 -i $IF_EXTERNA -j LOG --log-level 6 --log-prefix "FWL: pop3: "
 $iptables -A INPUT -p udp --dport 111 -i $IF_EXTERNA -j LOG --log-level 6 --log-prefix "FWL: rpc: "
 $iptables -A INPUT -p tcp --dport 113 -i $IF_EXTERNA -j LOG --log-level 6 --log-prefix "FWL: identd: "
 $iptables -A INPUT -p tcp --dport 137:139 -i $IF_EXTERNA -j LOG --log-level 6 --log-prefix "FWL: samba: "
 $iptables -A INPUT -p udp --dport 137:139 -i $IF_EXTERNA -j LOG --log-level 6 --log-prefix "FWL: samba: "
 $iptables -A INPUT -p tcp --dport 161:162 -i $IF_EXTERNA -j LOG --log-level 6 --log-prefix "FWL: snmp: "
 $iptables -A INPUT -p tcp --dport 6667:6668 -i $IF_EXTERNA -j LOG --log-level 6 --log-prefix "FWL: irc: "
 $iptables -A INPUT -p tcp --dport 3128 -i $IF_EXTERNA -j LOG --log-level 6 --log-prefix "FWL: squid: "

 # Libera acesso externo a determinadas portas
 # -------------------------------------------------------#
#   $iptables -A INPUT -p tcp --dport 2222 -i $IF_EXTERNA -j ACCEPT


 # Liberando DPI para Lucas
 # -------------------------------------------------------#
# $iptables -A FORWARD -i $IF_EXTERNA -p TCP --dport 24001 -j ACCEPT
# $iptables -A FORWARD -i $IF_INTERNA -p TCP --dport 24001 -j ACCEPT
# $iptables -I FORWARD -i $IF_EXTERNA -p tcp --dport 21 -j ACCEPT
# $iptables -I FORWARD -i $IF_EXTERNA -p tcp --dport 24001 -j ACCEPT
# #$iptables -A FORWARD -p tcp -d ! XXX.XXX.XXX.XXX --dport 25

#$iptables -I INPUT -p tcp --dport 20 -j ACCEPT
#$iptables -I INPUT -p tcp --dport 21 -j ACCEPT
#$iptables -I INPUT -p tcp --dport 24000 -j ACCEPT
#$iptables -I INPUT -p tcp --dport 24001 -j ACCEPT
#$iptables -I INPUT -p tcp --dport 24002 -j ACCEPT

#$iptables -I OUTPUT -p tcp --dport 20 -j ACCEPT
#$iptables -I OUTPUT -p tcp --dport 21 -j ACCEPT
#$iptables -I OUTPUT -p tcp --dport 24000 -j ACCEPT
#$iptables -I OUTPUT -p tcp --dport 24001 -j ACCEPT
#$iptables -I OUTPUT -p tcp --dport 24002 -j ACCEPT

#$iptables -I FORWARD -p tcp --dport 20 -j ACCEPT
#$iptables -I FORWARD -p tcp --dport 21 -j ACCEPT
#$iptables -I FORWARD -p tcp --dport 24000 -j ACCEPT
#$iptables -I FORWARD -p tcp --dport 24001 -j ACCEPT
#$iptables -I FORWARD -p tcp --dport 24002 -j ACCEPT

#$iptables -I INPUT -p tcp --dport 20 -j ACCEPT
#$iptables -I INPUT -p tcp --dport 21 -j ACCEPT
#$iptables -I INPUT -p tcp --dport 24000 -j ACCEPT
#$iptables -I INPUT -p tcp --dport 24001 -j ACCEPT
#$iptables -I INPUT -p tcp --dport 24002 -j ACCEPT

#$iptables -I OUTPUT -p tcp --dport 20 -j ACCEPT
#$iptables -I OUTPUT -p tcp --dport 21 -j ACCEPT
#$iptables -I OUTPUT -p tcp --dport 24000 -j ACCEPT
#$iptables -I OUTPUT -p tcp --dport 24001 -j ACCEPT
#$iptables -I OUTPUT -p tcp --dport 24002 -j ACCEPT

#$iptables -I FORWARD -p tcp --dport 20 -j ACCEPT
#$iptables -I FORWARD -p tcp --dport 21 -j ACCEPT
#$iptables -I FORWARD -p tcp --dport 24000 -j ACCEPT
#$iptables -I FORWARD -p tcp --dport 24001 -j ACCEPT
#$iptables -I FORWARD -p tcp --dport 24002 -j ACCEPT

#Regras que me passaram no underlinux
$iptables -I FORWARD -p tcp -s 192.168.0.3 -d 0/0 --dport 20 -j ACCEPT
$iptables -I FORWARD -p tcp -d 192.168.0.3 -s 0/0 --dport 20 -j ACCEPT
$iptables -I FORWARD -p udp -s 192.168.0.3 -d 0/0 --dport 20 -j ACCEPT
$iptables -I FORWARD -p udp -d 192.168.0.3 -s 0/0 --dport 20 -j ACCEPT

$iptables -I FORWARD -p tcp -s 192.168.0.3 -d 0/0 --dport 21 -j ACCEPT
$iptables -I FORWARD -p tcp -d 192.168.0.3 -s 0/0 --dport 21 -j ACCEPT
$iptables -I FORWARD -p udp -s 192.168.0.3 -d 0/0 --dport 21 -j ACCEPT
$iptables -I FORWARD -p udp -d 192.168.0.3 -s 0/0 --dport 21 -j ACCEPT

$iptables -I FORWARD -p tcp -s 192.168.0.3 -d 0/0 --dport 24001 -j ACCEPT
iptables -I FORWARD -p tcp -d 192.168.0.3 -s 0/0 --dport 24001 -j ACCEPT
$iptables -I FORWARD -p udp -s 192.168.0.3 -d 0/0 --dport 24001 -j ACCEPT
$iptables -I FORWARD -p udp -d 192.168.0.3 -s 0/0 --dport 24001 -j ACCEPT

 #################################################
 # Tabela NAT
 #################################################


 # Ativa mascaramento de saída roteamento
 # -------------------------------------------------------#
 $iptables -A POSTROUTING -t nat -o $IF_EXTERNA -j MASQUERADE


 # Proxy transparente
 # -------------------------------------------------------#
  $iptables -t nat -A PREROUTING -i $IF_INTERNA -p TCP -d ! 200.201.174.0/24 --dport 80 -j REDIRECT --to-port 3128