#!/bin/sh

# /etc/rc.d/rc.firewall

# iptables rules for funky setup - vmware machines + checkpoint

# Turn off ip forwarding until all rules are applied
echo "0" > /proc/sys/net/ipv4/ip_forward

# Flush + zero everything first
iptables -F
iptables -t nat -F
iptables -Z

# Declare variables
IPT=/usr/sbin/iptables
EXTIF=eth0      # External interface (internet)
WANIF=eth1      # WAN interface
#LAN_IP="192.168.0.2"
#LAN_IP_RANGE="192.168.0.0/16"
#LAN_IFACE="eth1"

# Set default chain policies
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD DROP

# All traffic leaving external interface should be SNAT'ed
$IPT -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

# Allow all traffic on loopback interface
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT


# INPUT Rules

# Allow packets belonging to ESTABLISHED connections and those RELATED
# to established connections
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow ssh from anywhere (you may want to tweak this)
$IPT -A INPUT -p tcp --dport 22 --syn -m state --state NEW -j ACCEPT

# ** this was your old rule - not sure where this 10.x.x.x network is,
#    as it's not in your routing tables -- obfuscated external ip??
#$IPT -A INPUT -p tcp -s 10.116.5.0/24 --dport 22 -j ACCEPT

# I don't think you need this - the default will be to DROP these packets
# anyway, as they won't be EST or REL
#$IPT -A INPUT -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset

# Again, I don't see the need for this unless you're just curious
#$IPT -A INPUT -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"

# Log what's left prior to it hitting the chain policy (DROP)
# You'll probably want to comment this out once you get a working ruleset,
# as it fills the logs quite quickly :)
$IPT -A INPUT -j LOG


# DNAT rules

# NAT for mtechdemo
$IPT -t nat -A PREROUTING  -i $EXTIF -p tcp --dport 2200 -j DNAT --to-destination 192.168.13.128:22
$IPT -t nat -A PREROUTING  -i $EXTIF -p tcp --dport 25673 -j DNAT --to-destination 192.168.13.128:25673
$IPT -t nat -A PREROUTING  -i $EXTIF -p tcp --dport 23025 -j DNAT --to-destination 192.168.13.128:23025

# NAT for Checkpoint VPN-1 router
$IPT -t nat -A PREROUTING -i $EXTIF -s 146.109.240.0/24 -j DNAT --to 192.168.16.2
$IPT -t nat -A PREROUTING -i $EXTIF -s 84.74.95.0/24  -j DNAT --to 192.168.16.2
$IPT -t nat -A PREROUTING -i $EXTIF -s 150.101.122.0/24 -j DNAT --to 192.168.16.2


# FORWARD Rules

# Allow all establish/related
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow those PREROUTED packets from earlier
$IPT -A FORWARD -i $EXTIF -d 192.168.13.128 --dort 22 -j ACCEPT
$IPT -A FORWARD -i $EXTIF -d 192.168.13.128 --dport 25673 -j ACCEPT
$IPT -A FORWARD -i $EXTIF -d 192.168.13.128 --dport 23025 -j ACCEPT
$IPT -A FORWARD -i $EXTIF -s 146.109.240.0/24 -d 192.168.16.2 -j ACCEPT
$IPT -A FORWARD -i $EXTIF -s 84.74.95.0/24 -d 192.168.16.2 -j ACCEPT
$IPT -A FORWARD -i $EXTIF -s 150.101.122.0/24 -d 192.168.16.2 -j ACCEPT

# Allow outgoing DNS requests
$IPT -A FORWARD -o $EXTIF --dport 53 -j ACCEPT
$IPT -A FORWARD -o $WANIF --dport 53 -j ACCEPT

# Allow ftp, ssh, whois, pop3, usenet, imap, rsync, s-pop3, AIM, Yahoo IM,
# jabber,jabber-s, irc 6667 & 7000
$IPT -A FORWARD -o $EXTIF -p tcp --sport 1024:65535 -m multiport \
--dports 21,22,43,110,119,143,873,995,5190,5050,5222,5223,6667,7000 \
--syn -m state --state NEW -j ACCEPT

# Allow smtp (25 & 587), http on 80, 81, 88, 8080, and 8088, https
$IPT -A FORWARD -o $EXTIF -p tcp --sport 1024:65535 -m multiport \
--dports 25,587,80,81,88,8080,8088,443 -m state --state NEW --syn \
 -j ACCEPT

# Turn packet forwarding back on now
echo "1" > /proc/sys/net/ipv4/ip_forward
                                                                                            102,1   Command