#!/bin/bash
###############################################################################
# FIREWALL COM IPTABLES
# JOSE FRANCISCO R. DA SILVA
# NET SITE S/A
# JUNHO DE 2002
###############################################################################
# Limpa cadeias
iptables -F INPUT

# Muda politica para negar tudo
iptables -P INPUT DROP

# Aceita todas as conexões localhost para localhost
iptables -A INPUT -i lo -j ACCEPT

# Conexões estabelecidas, relacionadas
iptables -A INPUT -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p UDP -m state --state ESTABLISHED,RELATED -j ACCEPT

# SSH
iptables -A INPUT -p TCP -s 0/0 -d 192.168.200.58 --dport 22 -m state --state NEW -j ACCEPT

# NFS
iptables -A INPUT -p TCP -s 192.168.200.0/24 -d 192.168.200.58 --dport 2049 -m state --state NEW -j ACCEPT
iptables -A INPUT -p UDP -s 192.168.200.0/24 -d 192.168.200.58 --dport 2049 -m state --state NEW -j ACCEPT

# POP3
iptables -A INPUT -p TCP -s 192.168.200.58 -d 192.168.200.58 --dport 110 -m state --state NEW -j ACCEPT

# SMTP
iptables -A INPUT -p TCP -s 192.168.200.58 -d 192.168.200.58 --dport 25 -m state --state NEW -j ACCEPT

# DNS
iptables -A INPUT -p TCP -s 0/0 -d 192.168.200.58 --dport 53 -m state --state NEW -j ACCEPT
iptables -A INPUT -p UDP -s 0/0 -d 192.168.200.58 --dport 53 -m state --state NEW -j ACCEPT


# CUPS
#iptables -A INPUT -p TCP -s 192.168.200.58 -d 192.168.200.58 --dport 631 -m state --state NEW -j ACCEPT

# Habilita ICMP
iptables -A INPUT -p ICMP -j ACCEPT
#iptables -A INPUT -p ICMP -j DROP

# Logging
iptables -A INPUT -j LOG --log-level 6 --log-prefix "INPUT..: "

# NNTP port 119
iptables -A INPUT -p TCP -s 0/0 -d 192.168.200.58 --dport 119 -m state --state NEW -j ACCEPT
iptables -A INPUT -p UDP -s 0/0 -d 192.168.200.58 --dport 119 -m state --state NEW -j ACCEPT

# FTP port 21
iptables -A INPUT -p TCP -s 0/0 -d 192.168.200.58 --dport 21 -j ACCEPT

# Webmin
iptables -A INPUT -p TCP -s 0/0 -d 200.187.175.79 --dport 10000 -m state --state NEW -j ACCEPT

# HTTP port 80
iptables -A INPUT -p TCP -s 0/0 -d 192.168.200.58 --dport 80 -j ACCEPT

# NTP port 123
iptables -A INPUT -p UDP -s 200.187.175.0/24 -d 192.168.200.58 --dport 123 -j ACCEPT
iptables -A INPUT -p UDP -s 192.168.200.0/24 -d 192.168.200.58 --dport 123 -j ACCEPT

# SNMP ports 161 e 162
iptables -A INPUT -p UDP -s 200.187.175.0/24 -d 192.168.200.58 --dport 161:162 -m state --state NEW -j ACCEPT

# SMTP port 25
iptables -A INPUT -p TCP -s 192.168.200.58 -d 192.168.200.58 --dport 25 -j ACCEPT

# Netbios
iptables -A INPUT -p UDP -s 192.168.200.0/24 -d 192.168.200.58/24 --dport 137 -m state --state NEW  -j ACCEPT
iptables -A INPUT -p UDP -s 192.168.200.0/24 -d 192.168.200.58/24 --dport 138 -m state --state NEW -j ACCEPT
iptables -A INPUT -p UDP -s 192.168.200.0/24 -d 192.168.200.58/24 --dport 139 -m state --state NEW -j ACCEPT
iptables -A INPUT -p TCP -s 192.168.200.0/24 -d 192.168.200.58/24 --dport 137 -m state --state NEW -j ACCEPT
iptables -A INPUT -p TCP -s 192.168.200.0/24 -d 192.168.200.58/24 --dport 138 -m state --state NEW -j ACCEPT
iptables -A INPUT -p TCP -s 192.168.200.0/24 -d 192.168.200.58/24 --dport 139 -m state --state NEW -j ACCEPT

# Webmin
#iptables -A INPUT -p TCP -s 192.168.200.0/24 -d 192.168.200.58 --dport 10000 -m state --state NEW -j ACCEPT

# Descarte dos pacotes
iptables -A INPUT -p TCP -j REJECT --reject-with tcp-reset