#!/bin/bash
export LC_ALL="en"
PATH=/usr/sbin:/sbin:/bin:/usr/bin:/usr/local/sbin
#Externel net
EXT_IF="ppp0";
EXT_IP=`/sbin/ifconfig $EXT_IF | grep "inet addr" | awk '{print $2}' | sed 's/[a-z]*://'`;
#Internel net
INT_IP=192.168.0.1
INT_NET=192.168.0.0/24
INT_IF="eth2";
INT_BRC=192.168.0.255
#Localhost
LO_IF=lo
LO_IP=127.0.0.1
LO_MSK=255.0.0.0
LO_NET="$LPDIP/$LPDMSK"
#Allowed services and ports
TCPSERV="domain ssh www https ftp ftp-data mail pop3 pop3s imap3 imaps imap2 time aol 10000:60000"
UDPSERV="domain time www aol"
SERVICES="33333 www aol domain 53"
# Text tools variables
ipt='iptables';
startfw(){
# Text tools variables
ipt='iptables';
echo "-----------------------------------------------"
echo "Loading required stateful/NAT kernel modules"
echo "-----------------------------------------------"
MODULES="ip_tables ip_conntrack iptable_filter iptable_mangle iptable_nat ipt_LOG  ipt_MASQUERADE ipt_REJECT ipt_mark ipt_tcpmss ipt_state"
for i in $MODULES;
do
 echo "Inserting module $i"
 modprobe $i
done
#Enable IPv4 forwarding
echo "1" > /proc/sys/net/ipv4/ip_forward
#Enables dynamic address hacking
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
#Enables SYN flood protection
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
#Enables source validation by reversed path according to RFC1812
echo "1" > /proc/sys/net/ipv4/conf/$EXT_IF/rp_filter
echo "1" > /proc/sys/net/ipv4/conf/$INT_IF/rp_filter
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "1" > /proc/sys/net/ipv4/conf/default/rp_filter
#Ignore all ICMP echo requests sent to the broadcast address
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
#Disable accept or refuse source routed packets
echo "0" > /proc/sys/net/ipv4/conf/$EXT_IF/accept_source_route
echo "0" > /proc/sys/net/ipv4/conf/$INT_IF/accept_source_route
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
echo "0" > /proc/sys/net/ipv4/conf/default/accept_source_route
#Disable ICMP redirects
echo "0" > /proc/sys/net/ipv4/conf/$EXT_IF/accept_redirects
echo "0" > /proc/sys/net/ipv4/conf/$INT_IF/accept_redirects
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
echo "0" > /proc/sys/net/ipv4/conf/default/accept_redirects
#Secure redirects
echo "1" > /proc/sys/net/ipv4/conf/$EXT_IF/secure_redirects
echo "1" > /proc/sys/net/ipv4/conf/$INT_IF/secure_redirects
echo "1" > /proc/sys/net/ipv4/conf/all/secure_redirects
echo "1" > /proc/sys/net/ipv4/conf/default/secure_redirects
#Disable logs packets from impossible addresses
echo "0" > /proc/sys/net/ipv4/conf/$INT_IF/log_martians
echo "0" > /proc/sys/net/ipv4/conf/$EXT_IF/log_martians

echo "-----------------------------------------------"
echo "External interface: $EXT_IF"
echo "External IP address is: $EXT_IP"
echo "Loading firewall server rules..."
echo "-----------------------------------------------"
#Flush all existing chains and erase personal chains
CHAINS=`cat /proc/net/ip_tables_names 2>/dev/null`
for i in $CHAINS
do
$ipt -t $i -F
done
for i in $CHAINS
do
$ipt -t $i -X
done
#------------------------------------------------------------------------------------------#
#Dany INPUT, OUTPUT and FORWARD chains
$ipt        -P INPUT       DROP
$ipt        -P OUTPUT      DROP
$ipt        -P FORWARD     DROP

#User Specified Chains
$ipt -N BAD_TCP

#BAD_TCP
$ipt -A BAD_TCP -p 6 ! --syn -m state --state NEW -m limit  -j LOG --log-prefix " New not syn: "
$ipt -A BAD_TCP -p 6 ! --syn -m state --state NEW -j REJECT
#------------------------------------------------------------------------------------------#
#PREROUTING
$ipt -t mangle -A PREROUTING -i $EXT_IF -j TTL --ttl-inc 1
#------------------------------------------------------------------------------------------#
#INPUT
$ipt -A INPUT   -i $LO_IF -s   $LO_IP     -j ACCEPT
$ipt -A INPUT   -i $LO_IF -s   $EXT_IP    -j ACCEPT
$ipt -A INPUT   -i $LO_IF -s   $INT_IP    -j ACCEPT
$ipt -A INPUT -p 6 -j BAD_TCP
for i in $SERVICES;
do
$ipt -A INPUT -p 6 -d $EXT_IP  --sport $i -m state --state NEW,ESTABLISHED -j ACCEPT
$ipt -A INPUT -p 6 -d $EXT_IP  --dport $i -m state --state NEW,ESTABLISHED -j ACCEPT
done
$ipt -A INPUT -p 17  -d $EXT_IP --sport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
#------------------------------------------------------------------------------------------#
#OUTPUT
$ipt -A OUTPUT   -o $LO_IF -d   $LO_IP     -j ACCEPT
$ipt -A OUTPUT   -o $LO_IF -d   $EXT_IP    -j ACCEPT
$ipt -A OUTPUT   -o $LO_IF -d   $INT_IP    -j ACCEPT
#$ipt -A OUTPUT -p 6 -j BAD_TCP
$ipt -A OUTPUT  -o $INT_IF ! -d $INT_NET -j DROP
$ipt -A OUTPUT  -o $EXT_IF ! -s  $EXT_IP -j DROP
for i in $SERVICES;
do
$ipt -A OUTPUT -p 6 -s $EXT_IP --dport $i -m state --state NEW,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT -p 6 -s $EXT_IP --sport $i -m state --state NEW,ESTABLISHED -j ACCEPT
done
for i in $TCPSERV;
do
$ipt -A OUTPUT  -o $INT_IF -p 6 -s $INT_NET --dport $i -m state --state NEW,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT  -o $EXT_IF -p 6 -s $EXT_IP  --dport $i -m state --state NEW,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT  -o $EXT_IF -p 6  --dport $i -m state --state NEW,ESTABLISHED -j ACCEPT
done
for i in $UDPSERV;
do
$ipt -A OUTPUT  -o $EXT_IF -p 17 -s $EXT_IP --dport $i -m state --state NEW,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT  -o $INT_IF -p 17 -s $INT_NET --dport $i -m state --state NEW,ESTABLISHED -j ACCEPT
done
# Allow to ping out
$ipt -A OUTPUT  -o $EXT_IF -p 1 -s $EXT_IP --icmp-type 8 -m state --state NEW -j ACCEPT
$ipt -A OUTPUT  -o $INT_IF -p 1 -s $INT_NET --icmp-type 8 -m state --state NEW -j ACCEPT
$ipt -A OUTPUT  -o $EXT_IF -p 1 --icmp-type ! 8 -j DROP
#------------------------------------------------------------------------------------------#
#FORWARD
#spoof
$ipt -A FORWARD -s $INT_NET -i $EXT_IF -j DROP
#smurf
#$ipt -A FORWARD -p 1 -i $EXT_IF -d $INT_NET -m multiport -j DROP

$ipt -A FORWARD -i $INT_IF -s ! $INT_NET -j DROP
#$ipt -A FORWARD -o $INT_IF -d ! $INT_NET -j DROP
# Block outbound ICMP (except for PING)
$ipt -A FORWARD -o $EXT_IF -p 1 --icmp-type ! 8 -j DROP
for i in $TCPSERV;
do
$ipt -A FORWARD  -i $INT_IF -p 6 -s $INT_NET --dport $i  -m state --state NEW,ESTABLISHED -j ACCEPT
$ipt -A FORWARD  -i $EXT_IF -p 6 -d $INT_NET --sport $i  -m state --state NEW,ESTABLISHED -j ACCEPT
done
for i in $UDPSERV;
do
$ipt -A FORWARD -i $INT_IF -p 17 -s $INT_NET  --dport $i -m state --state NEW,ESTABLISHED -j ACCEPT
$ipt -A FORWARD -i $EXT_IF -p 17 -d $INT_NET  --sport $i -m state --state NEW,ESTABLISHED -j ACCEPT
done
# Allow to ping out
$ipt -A FORWARD -i $INT_IF -p 1 -s $INT_NET --icmp-type 8 -m state --state NEW -j ACCEPT
$ipt -A FORWARD -j DROP
$ipt -A FORWARD -o $EXT_IF -p 1 --icmp-type ! 8 -j DROP
#------------------------------------------------------------------------------------------#
#POSTROUTING
$ipt -t mangle -A POSTROUTING -s $INT_NET -o $EXT_IF -j TTL --ttl-set 64 
$ipt -t nat -A POSTROUTING -o $EXT_IF -j MASQUERADE
echo -e "    Firewall rules loading complete\n\n"
}

stopfw(){
#Flush all existing chains and erase personal chains
echo -n "Clearing iptables...       "
CHAINS=`cat /proc/net/ip_tables_names 2>/dev/null`
for i in $CHAINS
do
$ipt -t $i -F
done
for i in $CHAINS
do
$ipt -t $i -X
done
POL="INPUT OUTPUT FORWARD"
for i in $POL
do
$ipt -P $i ACCEPT
done
echo "Done"
}

action="$1"
case $action in
  start)
  stopfwl
  startfw
  ;;
  stop)
  stopfw
  ;;
  restart)
  stopfw
  startfw
  ;;
  *)
  echo "Invalid action!
Usage: sh firewall.sh { start | stop | restart }"
  ;;
  esac