#!/bin/bash
# chkconfig: 3456 30 90
# description: rc.firewall

# Otimizacoes de kernel

/etc/init.d/kernel-optimize start

# Declarando Variaveis

IF_EXT="eth1"
IF_INT="eth0"
IF_DMZ="eth2"

IPTABLES="/sbin/iptables"
LOG_OPTIONS="--log-tcp-sequence --log-ip-options --log-tcp-options --log-level info"
LOG_LIMIT="-m limit --limit 4/s"

# carrega alguns modulos do conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp

NETBIOS="135 137:139 445"

REDE_INTERNA="
192.168.10.0/24
"

REDE_DMZ="
10.0.0.0/8
"

LIBERA_SSH="
200.103.31.14
201.88.73.100
192.168.10.0/24
10.0.0.0/8
"

LIBERA_REMOTE_TS="
192.168.10.0/24
10.0.0.0/8
"
# Matriz      200.103.31.14
# Matriz novo 201.88.73.100
# Rota66      200.193.231.129
# luiz        201.34.243.243

LIBERA_ACESSOS_EXT="
201.88.73.100
"

EXCECOES="
$LIBERA_ACESSOS_EXT
192.168.10.70
192.168.10.71
192.168.10.101
192.168.10.120
192.168.10.200
192.168.10.220
192.168.10.30
192.168.10.31
192.168.10.132
"

############################################################
#   PORTAS MICROSIGA => 5024 6767 6768 6869 7024           #
############################################################

LIBERA_FORWARD_TCP="21 22 23 25 53 110 123 143 515 1234 1455 1999 2631 3389 5024 6767 6768 6869 8080 8443 7024 3650 3663 4550 5550"
LIBERA_FORWARD_UDP="20 22 23 25 53 110 123 143 515 1234 1455 1999 2631 3389 5024 6767 6768 6869 8080 8443 7024 3650 3663 4550 5550"

LIBERA_INPUT_TCP="53 80 135 137 138 139 445 1082 3389 3663"
LIBERA_INPUT_UDP="53 80 135 137 138 139 445 1082 3389 3663"

DNS="
201.10.128.3
201.10.120.3
200.103.31.14
201.88.73.100
201.88.73.97
201.88.73.105
"

case "$1" in
start)

# vamos comecar ....
# limpando regras
$IPTABLES -F
$IPTABLES -Z
$IPTABLES -X

# setando regras padrao
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT ACCEPT

#INPUT

# libera interface loopback
$IPTABLES -A INPUT -i lo -j ACCEPT

#$IPTABLES -N bloq_netbios
# vamos dropar pacotes NetBIOS
#for i in $NETBIOS; do
#   $IPTABLES -A bloq_netbios -p tcp --sport $i -j DROP
#   $IPTABLES -A bloq_netbios -p tcp --dport $i -j DROP
#   $IPTABLES -A bloq_netbios -p udp --sport $i -j DROP
#   $IPTABLES -A bloq_netbios -p udp --dport $i -j DROP
#done

# bloqueando qualquer tipo de BROADCAST IP
#$IPTABLES -A INPUT -m pkttype --pkt-type broadcast -j DROP

# bloqueando qualquer tipo de MULTICAST IP
#$IPTABLES -A INPUT -m pkttype --pkt-type multicast -j DROP

# jogando fora conexoes tcp/113 ( AUTH )
$IPTABLES -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset

# aplicando bloqueio NetBIOS
#$IPTABLES -A INPUT -j bloq_netbios

# liberando a volta de conexoes dos servidores DNS
for i in $DNS; do
   $IPTABLES -A INPUT -p tcp --sport 53 -s $i -j ACCEPT
   $IPTABLES -A INPUT -p udp --sport 53 -s $i -j ACCEPT
done

# liberando porta SSH para alguns IPs
for i in $LIBERA_SSH; do
   $IPTABLES -A INPUT -p tcp --dport 22 -s $i -j ACCEPT
   $IPTABLES -A INPUT -p udp --dport 22 -s $i -j ACCEPT
done

# bloqueando o resto das conexoes na porta SSH
#$IPTABLES -A INPUT -p tcp --dport 22 -j LOG $LOG_OPTIONS $LOG_LIMIT --log-prefix "bloq_conexao_ssh: "
$IPTABLES -A INPUT -p tcp --dport 22 -j REJECT --reject-with tcp-reset

#Contra ping of death
  $IPTABLES -A INPUT -p ICMP --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

# Bloqueia ICMP Type 8
 #$IPTABLES -A INPUT -p icmp --icmp-type 8 -i $IF_EXT -j LOG --log-prefix "Dropped ICMP Ping"
  $IPTABLES -A INPUT -p icmp --icmp-type 8 -i $IF_EXT -j DROP


# fazendo bloqueio de alguns IPs 

#for i in $BLACKLIST; do
#   $IPTABLES -A INPUT -p tcp -s $i -j LOG $LOG_OPTIONS $LOG_LIMIT --log-prefix "bloq_blacklist: "
#   $IPTABLES -A INPUT -p tcp -s $i -j REJECT --reject-with tcp-reset
#done

# liberando portas TCP para algumas redes
for i in $LIBERA_INPUT_TCP; do
   $IPTABLES -A INPUT -s $REDE_INTERNA -p tcp --dport $i -j ACCEPT
   $IPTABLES -A INPUT -s $REDE_DMZ -p tcp --dport $i -j ACCEPT
   $IPTABLES -A INPUT -s $LIBERA_ACESSOS_EXT -p tcp --dport $i -j ACCEPT
done

# liberando portas UDP para algumas redes
for i in $LIBERA_INPUT_UDP; do
   $IPTABLES -A INPUT -s $REDE_INTERNA -p udp --dport $i -j ACCEPT
   $IPTABLES -A INPUT -s $REDE_DMZ -p udp --dport $i -j ACCEPT
   $IPTABLES -A INPUT -s $LIBERA_ACESSOS_EXT -p udp --dport $i -j ACCEPT
done

# Configurando proxy transparente
LIBERA_CAIXA="
200.201.173.68
200.201.174.0/24
"
for i in $LIBERA_CAIXA; do
$IPTABLES -t nat -A PREROUTING -i $IF_INT ! -s 192.168.10.0/24 -d ! $i -p TCP --dport 80  -j REDIRECT --to-ports 1082
$IPTABLES -t nat -A PREROUTING -i $IF_INT ! -s 192.168.10.0/24 -d ! $i -p UDP --dport 80  -j REDIRECT --to-ports 1082
$IPTABLES -t nat -A PREROUTING -i $IF_INT ! -s 192.168.10.0/24 -d ! $i -p TCP --dport 443 -j REDIRECT --to-ports 1082
$IPTABLES -t nat -A PREROUTING -i $IF_INT ! -s 192.168.10.0/24 -d ! $i -p UDP --dport 443 -j REDIRECT --to-ports 1082  
done

#for i in $LIBERA_CAIXA; do
#$IPTABLES -t nat -A PREROUTING -i $IF_INT ! -s 192.168.10.200 -d ! $i -p TCP --dport 80  -j REDIRECT --to-ports 1082
#$IPTABLES -t nat -A PREROUTING -i $IF_INT ! -s 192.168.10.200 -d ! $i -p UDP --dport 80  -j REDIRECT --to-ports 1082
#$IPTABLES -t nat -A PREROUTING -i $IF_INT ! -s 192.168.10.200 -d ! $i -p TCP --dport 443 -j REDIRECT --to-ports 1082
#$IPTABLES -t nat -A PREROUTING -i $IF_INT ! -s 192.168.10.200 -d ! $i -p UDP --dport 443 -j REDIRECT --to-ports 1082
#done

# REDIRECIONANDO PORTA 1234 REQUISITADA DA REDE INTERNA PARA REDE DMZ

for i in $REDE_INTERNA; do
   $IPTABLES -t nat -A PREROUTING -i $IF_INT -s $i -d $REDE_DMZ -p TCP --dport 1234 -j DNAT --to 10.0.0.2:1234
   $IPTABLES -t nat -A PREROUTING -i $IF_INT -s $i -d $REDE_DMZ -p UDP --dport 1234 -j DNAT --to 10.0.0.2:1234
   $IPTABLES -t nat -A PREROUTING -i $IF_INT -s $i -d $REDE_DMZ -p TCP --dport 7024 -j DNAT --to 10.0.0.2:7024
   $IPTABLES -t nat -A PREROUTING -i $IF_INT -s $i -d $REDE_DMZ -p UDP --dport 7024 -j DNAT --to 10.0.0.2:7024
done

# REDIRECIONAMENTO DAS PORTAS PARA FUNCIONAMENTO DO REMOTE ADMIN
for i in $LIBERA_REMOTE_TS; do
# $IPTABLES -t nat -A PREROUTING -i $IF_EXT -s $i -p TCP --dport 48991 -j DNAT --to 192.168.10.220:4899
# $IPTABLES -t nat -A PREROUTING -i $IF_EXT -s $i -p TCP --dport 3650 -j DNAT --to 192.168.10.220:3650
  $IPTABLES -t nat -A PREROUTING -i $IF_EXT -s $i -p TCP --dport 48992 -j DNAT --to 192.168.10.200:4899
  $IPTABLES -t nat -A PREROUTING -i $IF_EXT -s $i -p TCP --dport 48995 -j DNAT --to 10.0.0.2:4899
  $IPTABLES -t nat -A PREROUTING -i $IF_EXT -s $i -p TCP --dport 3389  -j DNAT --to 10.0.0.2:3389

#   $IPTABLES -t nat -A PREROUTING -i $IF_EXT -s $i -p TCP --dport 48993 -j DNAT --to 192.168.10.31:4899
#   $IPTABLES -t nat -A PREROUTING -i $IF_EXT -s $i -p TCP --dport 48994 -j DNAT --to 192.168.10.32:4899
done


# #################################################################################################################
#                                           DESATIVADO                                                            #
#                                                                                                                 #
#  REDIRECIONAMENTO DAS PORTAS PARA FUNCIONAMENTO DO SISTEMAS DE CAMERAS - PICO                                   #
#    $IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p TCP --dport 1999 -j DNAT --to 192.168.10.220:1999  #
# #################################################################################################################

# #################################################################################################################
#                                                                                                                 #
#                                             ATIVANDO SISTEMA DE CAMERAS GEOVISION                               #
#                                                                                                                 #
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p TCP --dport 8080 -j DNAT --to 192.168.10.220:8080
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p TCP --dport 6550 -j DNAT --to 192.168.10.220:6550
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p TCP --dport 4550 -j DNAT --to 192.168.10.220:4550
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p TCP --dport 5550 -j DNAT --to 192.168.10.220:5550
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p UDP --dport 8080 -j DNAT --to 192.168.10.220:8080
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p UDP --dport 6550 -j DNAT --to 192.168.10.220:6550
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p UDP --dport 4550 -j DNAT --to 192.168.10.220:4550
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p UDP --dport 5550 -j DNAT --to 192.168.10.220:5550

$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 192.168.10.4/0 -p TCP --dport 3650 -j DNAT --to 192.168.10.220:3650
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p UDP --dport 3650 -j DNAT --to 192.168.10.220:3650
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p TCP --dport 3663 -j DNAT --to 192.168.10.220:3663
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p TCP --dport 3550 -j DNAT --to 192.168.10.220:3550
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p UDP --dport 3550 -j DNAT --to 192.168.10.220:3550
#                                                                                                                #
##################################################################################################################

# permitindo conexoes estabelecidas
$IPTABLES -A INPUT -m state --state ! NEW -j ACCEPT

# liberando ICMP
$IPTABLES -A INPUT -p icmp -j ACCEPT 

# bloqueio total
#$IPTABLES -A INPUT -j LOG $LOG_OPTIONS $LOG_LIMIT --log-prefix "bloq_final_INPUT: "
$IPTABLES -A INPUT -p tcp -j REJECT --reject-with tcp-reset
$IPTABLES -A INPUT -p ! tcp -j REJECT

#FORWARD

# liberando ICMP
$IPTABLES -A FORWARD -p icmp -j ACCEPT

# libera interface loopback
$IPTABLES -A FORWARD -i lo -j ACCEPT

# MASQUERADE DA REDE INTERNA PARA INTERNET
 
$IPTABLES -t nat -A POSTROUTING -s $REDE_INTERNA -o $IF_EXT -j MASQUERADE

# MASQUERADE DA REDE DMZ PARA REDE INTERNA
$IPTABLES -t nat -A POSTROUTING -s $REDE_DMZ -d $REDE_INTERNA -o $IF_INT -j MASQUERADE

# liberando portas TCP com permissao pra todo mundo
for i in $LIBERA_FORWARD_TCP; do
   $IPTABLES -A FORWARD -p tcp --dport $i -j ACCEPT
done

# liberando portas UDP com permissao pra todo mundo
for i in $LIBERA_FORWARD_UDP; do
   $IPTABLES -A FORWARD -p udp --dport $i -j ACCEPT
done

# liberando portas altas para algumas maquinas
for i in $EXCECOES; do
$IPTABLES -A FORWARD -s $i -p tcp --dport 80 -j ACCEPT
$IPTABLES -A FORWARD -s $i -p tcp --dport 443 -j ACCEPT
$IPTABLES -A FORWARD -s $i -p tcp --dport 1024:65535 -j ACCEPT
done
         
# liberando portas altas para algumas maquinas
for i in $EXCECOES; do
$IPTABLES -A FORWARD -s $i -p udp --dport 80 -j ACCEPT
$IPTABLES -A FORWARD -s $i -p udp --dport 137 -j ACCEPT
$IPTABLES -A FORWARD -s $i -p udp --dport 443 -j ACCEPT
$IPTABLES -A FORWARD -s $i -p udp --dport 1024:65535 -j ACCEPT
done
                     
# permitindo conexoes estabelecidas
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# bloqueio total
#$IPTABLES -A FORWARD -j LOG $LOG_OPTIONS $LOG_LIMIT --log-prefix "bloq_final_FORWARD: "
$IPTABLES -A FORWARD -p tcp -j REJECT --reject-with tcp-reset
$IPTABLES -A FORWARD -p ! tcp -j REJECT

;;

stop)

$IPTABLES -t filter -F
$IPTABLES -t filter -Z
$IPTABLES -t nat -F
$IPTABLES -t nat -Z
$IPTABLES -X

#POLICY

$IPTABLES -t filter -P INPUT ACCEPT   
$IPTABLES -t filter -P FORWARD ACCEPT 
$IPTABLES -t filter -P OUTPUT ACCEPT  
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT
  
;;

status)

$IPTABLES -t filter -L -v
$IPTABLES -t nat -L -v
  
;;

panic)

$IPTABLES -t filter -F
$IPTABLES -t filter -Z
$IPTABLES -t nat -F
$IPTABLES -t nat -Z

$IPTABLES -X

#POLICY

$IPTABLES -t filter -P INPUT DROP
$IPTABLES -t filter -P FORWARD DROP
$IPTABLES -t filter -P OUTPUT DROP 
$IPTABLES -t nat -P POSTROUTING DROP
$IPTABLES -t nat -P PREROUTING DROP 
$IPTABLES -t nat -P OUTPUT DROP

;;
*)
  
echo $0 'start||stop|status|panic'

esac

exit 0