#!/bin/bash
#version 1.1

. /lib/lsb/init-functions

INTERNET="eth1"
SERVICII="http ssh"        # servicii (porturi) care pot fi accesate din internet


case "$1" in
start)
        log_daemon_msg "Starting Firewall" "firewall"

        modprobe ip_conntrack_ftp

        iptables -P INPUT DROP                          # blocheaza tot
        iptables -A INPUT -i ! ${INTERNET} -j ACCEPT
        iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # permite pachetele din conexiuni deja stabilite
        iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT


        # accepta conexiuni noi pe porturile din $SERVICII
        for i in ${SERVICII}; do
        iptables -A INPUT -p tcp --dport ${i} -m state --state NEW -j ACCEPT
        done

        # NAT, daca nu aveti nevoie, stergeti linia
        iptables -t nat -A POSTROUTING -o ${INTERNET} -j MASQUERADE
        echo 1 > /proc/sys/net/ipv4/ip_forward

        #Protectii SYN attack
        echo 3 > /proc/sys/net/ipv4/tcp_synack_retries
        echo 3 > /proc/sys/net/ipv4/tcp_syn_retries
        echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter
        echo 1 > /proc/sys/net/ipv4/tcp_syncookies

        #Deschid port pentru torrent 
        iptables -t nat -I PREROUTING -p tcp --dport 22769 -i ${INTERNET} -j DNAT --to 192.168.0.3
        iptables -t nat -I PREROUTING -p udp --dport 22769 -i ${INTERNET} -j DNAT --to 192.168.0.3

        #DC 
        iptables -t nat -I PREROUTING -p tcp --dport 22768 -i ${INTERNET} -j DNAT --to 192.168.0.3
        iptables -t nat -I PREROUTING -p udp --dport 22768 -i ${INTERNET} -j DNAT --to 192.168.0.3


        #torrent 
        iptables -t nat -I PREROUTING -p tcp --dport 22770 -i ${INTERNET} -j DNAT --to 192.168.0.2
        iptables -t nat -I PREROUTING -p udp --dport 22770 -i ${INTERNET} -j DNAT --to 192.168.0.2

        #DC 
        iptables -t nat -I PREROUTING -p tcp --dport 22771 -i ${INTERNET} -j DNAT --to 192.168.0.2
        iptables -t nat -I PREROUTING -p udp --dport 22771 -i ${INTERNET} -j DNAT --to 192.168.0.2

        #Xchat file transfer
        iptables -t nat -I PREROUTING -p tcp --dport 22772:22780 -i ${INTERNET} -j DNAT --to 192.168.0.2

        log_end_msg $?
;;
stop)
        log_begin_msg "Stopping Firewall"
        iptables -F INPUT
        iptables -F FORWARD
        iptables -P FORWARD ACCEPT
        iptables -P INPUT ACCEPT

        # opreste NAT, daca nu aveti nevoie, stergeti linia
        iptables -t nat -F POSTROUTING
        iptables -F -t nat
        echo 0 > /proc/sys/net/ipv4/ip_forward

        log_end_msg $?
;;
restart)
    $0 stop
    sleep 1
    $0 start
;;
*)
    log_success_msg "usage: $0 {start|stop|restart}"
esac
exit 0