#!/bin/sh

#
# Copyright(C) 2002 Cesar Augusto Seronni Filho cesar@kernelinformatica.com.br
#
# Kernel Informatica - Rede de Computadores
#
# Configuracoes
#
############################################################################

IPTABLES="/sbin/iptables"

############################################################################

INET_IP="200.193.222.50"
INET_IFACE="eth2"

ADM_IP="10.17.24.1"
ADM_IFACE="eth0"

ACD_IP="10.18.24.1"
ACD_IFACE="eth1"

ACD2_IP="10.19.24.1"
ACD2_IFACE="eth3"

LO_IFACE="lo"
LO_IP="127.0.0.1"

GATEWAY="200.193.222.33"
VPN_IP="200.216.152.6"

# ACD - Definicao de Estacoes internas com previlegios.
DTI_SUPORTE2_ACD="10.18.24.103"
DTI_SUPORTE2_ADM="10.17.24.62"
DTI_BRAULIO_ACD="10.18.24.101"
DTI_BRAULIOII="10.17.24.41"
DTI_BRAULIO_ADM="10.17.24.80"
DTI_ALE_ACD="10.18.24.102"
DTI_ALE_ADM="10.17.24.59"
DIR_SIRLE="10.17.24.103"
DTI_SUPORTE_ACD="10.18.24.106"
VIVIANE_ADM="10.17.24.107"
TELEFONISTA="10.17.24.101"

# ADM - Definicao do ip do servidor Gandalf #####
GANDALF="10.17.24.70"
# ADM - Definicao do ip do servidor de email Aragorn ###
ARAGORN="10.17.24.251"

# ADM - Definicao de Estacoes internas com previlegios.
ESTACAO_ADM1_IP="10.17.24.103"
ESTACAO_ADM2_IP="10.17.24.102"
ESTACAO_ADM3_IP="10.17.24.31"
ESTACAO_ADM8_IP="10.17.24.118"
ESTACAO_ADM9_IP="10.17.24.80"
ESTACAO_ADM10_IP="10.17.24.90"

#MEC
MEC01="10.18.24.141"
MEC02="10.18.24.150"


# Chains para bloqueio de portscanners e nmap # Braulio #
#PORTSCANS
MY_CHAIN="PORTSCAN"
PRE_CHAIN="PORTSCANNER"

###########################################################################

/sbin/depmod -a

#/sbin/modprobe ip_tables
#/sbin/modprobe ip_conntrack
#/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe ipt_psd
#/sbin/modprobe iptable_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_state
/sbin/modprobe ipt_owner
/sbin/modprobe ipt_REJECT
/sbin/modprobe ipt_MASQUERADE
/sbin/modprobe ip_conntrack_ftp
#/sbin/modprobe ipt_p2p
/sbin/modprobe ip_conntrack_irc


# Inicializacao do script
case "$1" in
start)

###########################################################################
# Resetando as configuracoes do iptables

$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z
$IPTABLES -t nat -F
$IPTABLES -t nat -X
$IPTABLES -t nat -Z
$IPTABLES -t mangle -F
$IPTABLES -t mangle -X

###########################################################################
# Bloqueando TUDO!

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -F PORTSCAN

#Bloqueando NMAP
# Essa regra so pode ser adicionada se o kernel estiver com paths instalados, o-matic

iptables -N $MY_CHAIN
iptables -A $MY_CHAIN -m limit --limit 2/s -j LOG --log-level DEBUG --log-prefix "Iptables PortScan Detected:"
iptables -A $MY_CHAIN -j DROP
iptables -A INPUT -s 0.0.0.0/0  -m psd --psd-weight-threshold 50 --psd-delay-threshold 1300 --psd-lo-ports-weight 20 -j $MY_CHAIN

# Regras de INPUT
# Liberando TUDO
#$IPTABLES -A INPUT -p ALL -j ACCEPT

### Liberando o protocolo ICMP (ping)
$IPTABLES -A INPUT -p ICMP -j ACCEPT
$IPTABLES -A INPUT -p ICMP --icmp-type echo-request -j ACCEPT

### Liberando acesso ao ping para aulas nos laboratorios
$IPTABLES -A FORWARD -i $ACD2_IFACE -o $INET_IFACE -p ICMP -j ACCEPT

# MEEBO
# --- bloqueio do meebo --- #
$IPTABLES -A FORWARD -i $ACD_IP -d 69.36.250.9 -p tcp --dport 443 -j DROP
$IPTABLES -A FORWARD -d 69.36.250.253 -p tcp --dport 443 -j DROP
$IPTABLES -A INPUT -d 69.36.250.253 -p tcp --dport 443 -j DROP
$IPTABLES -A INPUT -d 69.36.250.9 -j DROP
$IPTABLES -A INPUT -d 69.36.250.0/24 -p tcp --dport 443 -j DROP
$IPTABLES -A INPUT -d 72.51.55.9 -p tcp --dport 443 -j DROP
$IPTABLES -A INPUT -d 69.36.250.9 -p tcp --dport 443 -j DROP
$IPTABLES -A FORWARD -d 69.36.250.9  -j DROP
$IPTABLES -A FORWARD -s 10.18.24.93 -d 69.36.250/24 -j DROP
$IPTABLES -A FORWARD -s 10.18.24.93 -d 69.26.250.9 -j DROP
$IPTABLES -A FORWARD -d 10.18.24.93 -s 69.36.250/24 -j DROP
$IPTABLES -A FORWARD -s 10.18.24.93 -d 69.36.250.0/24 -p tcp --dport 443 -j DROP
$IPTABLES -A FORWARD -s 10.18.24.93 -d 69.36.250.9 -p tcp --dport 443 -j DROP
$IPTABLES -A FORWARD -s 69.36.250.9 -d 10.18.24.93 -p tcp --dport 443 -j DROP
$IPTABLES -A FORWARD -d 69.36.250.0/24 -p tcp --dport 443 -j DROP
$IPTABLES -A FORWARD -d 69.36.250.9 -p tcp --dport 443 -j DROP
$IPTABLES -t nat -I PREROUTING -i $ACD_IFACE -m tcp -p tcp -d 69.36.250.0/24 --dport 80 -j ACCEPT
# Conexao interna para ip da internet
$IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.17.24.0/24 -p tcp -j SNAT --to-source 10.17.24.1
$IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.17.24.0/24 -p udp -j SNAT --to-source 10.17.24.1
# Liberando localhost
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -j ACCEPT

# Liberando acesso ao SSH somente (INTERNO)
$IPTABLES -A INPUT -p TCP -s 0/0 -i ! $INET_IFACE  --dport 2222 -j ACCEPT

$IPTABLES -A INPUT -d 200.216.152.0/24 -j ACCEPT
$IPTABLES -A FORWARD -d 200.216.152.0/24 -j ACCEPT

# Liberando acesso ao DNS POP SMTP para a rede administrativa
$IPTABLES -A INPUT -p TCP -i $ADM_IFACE --dport 53 -j ACCEPT
$IPTABLES -A INPUT -p UDP -i $ADM_IFACE --dport 53 -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $ADM_IFACE --dport 110 -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $ADM_IFACE --dport 25 -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $ADM_IFACE --dport 143 -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $ACD_IFACE --dport 110 -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $ACD_IFACE --dport 25 -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $ACD_IFACE --dport 143 -j ACCEPT

# Liberando acesso ao DNS para a rede academica
$IPTABLES -A INPUT -p TCP -i $ACD_IFACE --dport 53 -j ACCEPT
$IPTABLES -A INPUT -p UDP -i $ACD_IFACE --dport 53 -j ACCEPT

$IPTABLES -A INPUT -p TCP -i $ACD_IFACE --dport 445 -j ACCEPT
$IPTABLES -A INPUT -p UDP -i $ACD_IFACE --dport 445 -j ACCEPT

$IPTABLES -A INPUT -p TCP -i $ACD_IFACE --dport 139 -j ACCEPT
$IPTABLES -A INPUT -p UDP -i $ACD_IFACE --dport 139 -j ACCEPT

# Liberando acesso ao DNS para a rede academica 2
$IPTABLES -A INPUT -p TCP -i $ACD2_IFACE --dport 53 -j ACCEPT
$IPTABLES -A INPUT -p UDP -i $ACD2_IFACE --dport 53 -j ACCEPT

# Liberando acesso ao PROXY para a rede administrativa
$IPTABLES -A INPUT -p TCP -i $ADM_IFACE --dport 3128 -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $ADM_IFACE --dport 443 -j ACCEPT

# Liberando acesso ao PROXY para a rede academica
$IPTABLES -A INPUT -p TCP -i $ACD_IFACE --dport 3128 -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $ADM_IFACE --dport 443 -j ACCEPT

# Liberando acesso ao PROXY para a rede academica 2
$IPTABLES -A INPUT -p TCP -i $ACD2_IFACE --dport 3128 -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $ACD2_IFACE --dport 443 -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $ACD2_IFACE --dport https -j ACCEPT

# Liberando acesso ao Partimage Server
$IPTABLES -A INPUT -p TCP -i ! $INET_IFACE --dport 4025 -j ACCEPT

$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -m limit --limit 3/s --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "

# # # # # # # # # # # # #  FORWARD # # # # # # # # # # # # # # # # # # # # #
# Regras de FORWARD

# Liberando acesso total
#$IPTABLES -A FORWARD -p ALL -j ACCEPT

# Bloqueio de MSN Rede Academica 2
$IPTABLES -A FORWARD -i $ACD2_IP -p tcp --dport 1863 -j DROP
$IPTABLES -A FORWARD -i $ACD2_IP -p udp --dport 1863 -j DROP
$IPTABLES -A FORWARD -i $ACD_IP -p tcp --dport 1863 -j DROP
$IPTABLES -A FORWARD -i $ACD_IP -p udp --dport 1863 -j DROP
$IPTABLES -A FORWARD -i $ADM_IP -p tcp --dport 1863 -j DROP
$IPTABLES -A FORWARD -i $ADM_IP -p udp --dport 1863 -j DROP

# Bloqueio de ICECAP na Rede Academica 2
$IPTABLES -A INPUT -i $ACD2_IP -p tcp --dport 8081 -j REJECT
$IPTABLES -A INPUT -i $ACD2_IP -p udp --dport 8081 -j REJECT
$IPTABLES -A FORWARD -i $ACD2_IP -p tcp --dport 8081 -j REJECT
$IPTABLES -A FORWARD -i $ACD2_IP -p udp --dport 8081 -j REJECT

# REDE ADMINISTRATIVA #######################################################

# Liberando acesso total a internet
#$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -p ALL -j ACCEPT
#$IPTABLES -A FORWARD -i $INET_IFACE -o $ADM_IFACE -p ALL -j ACCEPT

# Liberando acesso a DNS externo
$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -p TCP --dport 53 -j ACCEPT
$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -p UDP --dport 53 -j ACCEPT

 # Liberando acesso a POP3 externo
$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -p TCP --dport 110 -j ACCEPT

# Liberando acesso a SMTP externo
$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -p TCP --dport 25 -j ACCEPT

# Liberando acesso a IMAP externo
$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -p TCP --dport 143 -j ACCEPT

# Liberando acesso a FTP externo
#$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -p TCP --dport 20 -j ACCEPT
#$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -p TCP --dport 21 -j ACCEPT

# Liberando acesso a VPN da FAGO
$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -d $VPN_IP -j ACCEPT

#Liberando acesso a porta pra programa da viviane de prevencao a acidentes
$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -p TCP --dport 5017 -j ACCEPT
$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -p UDP --dport 5017 -j ACCEPT

# REDE ACADEMICA 1 ##############################################################

# Liberando acesso total a internet
#$IPTABLES -A FORWARD -i $ACD_IFACE -o $INET_IFACE -p ALL -j ACCEPT
#$IPTABLES -A FORWARD -i $INET_IFACE -o $ACD_IFACE -p ALL -j ACCEPT

# Liberando acesso a DNS externo
$IPTABLES -A FORWARD -i $ACD_IFACE -o $INET_IFACE -p TCP --dport 53 -j ACCEPT
$IPTABLES -A FORWARD -i $ACD_IFACE -o $INET_IFACE -p UDP --dport 53 -j ACCEPT

# Liberando acesso a POP3 externo
$IPTABLES -A FORWARD -i $ACD_IFACE -o $INET_IFACE -p TCP --dport 110 -j ACCEPT

# Liberando acesso a SMTP externo
$IPTABLES -A FORWARD -i $ACD_IFACE -o $INET_IFACE -p TCP --dport 25 -j ACCEPT

# Liberando acesso a IMAP externo
$IPTABLES -A FORWARD -i $ACD_IFACE -o $INET_IFACE -p TCP --dport 143 -j ACCEPT

# Liberando acesso a FTP externo
#$IPTABLES -A FORWARD -i $ACD_IFACE -o $INET_IFACE -p TCP --dport 20 -j ACCEPT
#$IPTABLES -A FORWARD -i $ACD_IFACE -o $INET_IFACE -p TCP --dport 21 -j ACCEPT

# Liberando acesso a VPN da FAGO
$IPTABLES -A FORWARD -i $ACD_IFACE -o $INET_IFACE -d $VPN_IP -j ACCEPT
$IPTABLES -A FORWARD -i $ACD_IFACE -o $INET_IFACE -p TCP --dport 7000:7007 -j ACCEPT
$IPTABLES -A FORWARD -i $ACD_IFACE -o $INET_IFACE -p UDP --dport 7000:7007 -j ACCEPT

# REDE ACADEMICA 2 ##############################################################
# Liberando acesso total a internet
$IPTABLES -A FORWARD -i $ACD2_IFACE -o $INET_IFACE -p ALL -j ACCEPT
$IPTABLES -A FORWARD -i $INET_IFACE -o $ACD2_IFACE -p ALL -j ACCEPT

# Liberando acesso a DNS externo
#$IPTABLES -A FORWARD -i $ACD2_IFACE -o $INET_IFACE -p TCP --dport 53 -j ACCEPT
#$IPTABLES -A FORWARD -i $ACD2_IFACE -o $INET_IFACE -p UDP --dport 53 -j ACCEPT

# Liberando acesso a FTP externo
#$IPTABLES -A FORWARD -i $ACD2_IFACE -o $INET_IFACE -p TCP --dport 20 -j ACCEPT
#$IPTABLES -A FORWARD -i $ACD2_IFACE -o $INET_IFACE -p TCP --dport 21 -j ACCEPT

# Liberando acesso a VPN da FAGO
#$IPTABLES -A FORWARD -i $ACD2_IFACE -o $INET_IFACE -d $VPN_IP -j ACCEPT

# Liberando acesso total a internet Laboratorios
#$IPTABLES -A FORWARD -i $ACD2_IFACE -o $INET_IFACE -p ALL -j ACCEPT
#$IPTABLES -A FORWARD -i $INET_IFACE -o $ACD2_IFACE -p ALL -j ACCEPT

############ Regra  Mcafee #################################################

#Atualizacao
$IPTABLES -A FORWARD -i $ACD_IFACE -p tcp --dport 8801 -j ACCEPT
$IPTABLES -A FORWARD -i $ACD_IFACE -p tcp --dport 81 -j ACCEPT
$IPTABLES -A FORWARD -i $ACD_IFACE -p udp --dport 81 -j ACCEPT
$IPTABLES -A FORWARD -i $ADM_IFACE -p udp --dport 81 -j ACCEPT
$IPTABLES -A FORWARD -i $ADM_IFACE -p tcp --dport 81 -j ACCEPT
$IPTABLES -A FORWARD -i $ADM_IFACE -p tcp --dport 8801 -j ACCEPT
$IPTABLES -A FORWARD -i $ADM_IFACE -p tcp --dport 3631 -j ACCEPT

# Bloqueando Nmap atravez do NAT.
iptables -t nat -N $PRE_CHAIN
iptables -t nat -A $PRE_CHAIN -m limit --limit 2/s -j LOG --log-level DEBUG --log-prefix "Prerouting scanport"
iptables -t nat -A $PRE_CHAIN -j DROP
iptables -t nat -A PREROUTING -d $INET_IP -m psd --psd-weight-threshold 60  --psd-delay-threshold 1300 --psd-lo-ports-weight 30 -j $PRE_CHAIN

#Conectividade Social
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -p tcp -d 200.201.174.207 --dport 80 -j REDIRECT --to-port 3128
$IPTABLES -t nat -A PREROUTING -i $ADM_IFACE -p tcp -d 200.201.174.207 --dport 80 -j REDIRECT --to-port 3128
$IPTABLES -A FORWARD -s 10.17.24.0/24 -p tcp -d 200.201.174.207 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -p tcp -d 200.201.173.68 --dport 80 -j REDIRECT --to-port 3128
$IPTABLES -t nat -A PREROUTING -i $ADM_IFACE -p tcp -d 200.201.173.68 --dport 80 -j REDIRECT --to-port 3128
$IPTABLES -A FORWARD -s 10.17.24.0/24 -p tcp -d 200.201.173.68 -j ACCEPT

#Liberacao de acesso
$IPTABLES -A FORWARD -s 10.18.24.252 -d 10.19.24.0/22 -j ACCEPT
$IPTABLES -A FORWARD -s 10.19.24.0/22 -d 10.18.24.252 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -s 10.18.24.252 -d 10.19.24.0/22 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -d 10.18.24.252 -s 10.19.24.0/22 -j ACCEPT
$IPTABLES -t nat -A POSTROUTING -s 10.18.24.252 -d 10.19.24.0/22 -j ACCEPT
$IPTABLES -t nat -A POSTROUTING -d 10.18.24.252 -s 10.19.24.0/22 -j ACCEPT

#Liberacao de acesso
$IPTABLES -A FORWARD -s 10.18.24.35 -d 10.19.24.0/22 -j ACCEPT
$IPTABLES -A FORWARD -s 10.19.24.0/22 -d 10.18.24.35 -j ACCEPT

#HTTPS
iptables -A FORWARD -p tcp --dport 443 -i $INET_IFACE  -j ACCEPT
iptables -A FORWARD -p tcp --dport 443 -i $ACD_IFACE -j ACCEPT
iptables -A FORWARD -p tcp --dport 443 -i $ADM_IFACE -j ACCEPT
iptables -A FORWARD -p tcp --dport 443 -i $ACD2_IFACE -j ACCEPT
iptables -A FORWARD -p udp --dport 443 -i $INET_IFACE  -j ACCEPT
iptables -A FORWARD -p udp --dport 443 -i $ACD_IFACE -j ACCEPT
iptables -A FORWARD -p udp --dport 443 -i $ADM_IFACE -j ACCEPT
iptables -A FORWARD -p udp --dport 443 -i $ACD2_IFACE -j ACCEPT

# Liberacao total da Internet para os servidores
$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -s 10.17.24.254 -p ALL -j ACCEPT
$IPTABLES -A FORWARD -i $ACD_IFACE -o $INET_IFACE -s 10.18.24.254 -p ALL -j ACCEPT
$IPTABLES -A FORWARD -i $ACD2_IFACE -o $INET_IFACE -s 10.19.24.254 -p ALL -j ACCEPT
$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -s 10.17.24.251 -p ALL -j ACCEPT
$IPTABLES -A FORWARD -i $ACD_IFACE -o $INET_IFACE -s 10.18.24.251 -p ALL -j ACCEPT

#Suporte 2
$IPTABLES -A FORWARD -i $ACD_IFACE -o $INET_IFACE -s 10.18.24.103 -p ALL -j ACCEPT
$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -s 10.17.24.62 -p ALL -j ACCEPT

$IPTABLES -A FORWARD -i $ACD_IFACE -o $INET_IFACE -s $DTI_BRAULIO_ACD -p ALL -j ACCEPT
$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -s $DTI_BRAULIO_ADM -p ALL -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -s $DTI_BRAULIO_ACD -p ALL -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -s $DTI_BRAULIO_ADM -p ALL -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -s $DTI_BRAULIOII -p ALL -j ACCEPT

#MEC
$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -s $MEC01 -p ALL -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -s $MEC01 -p ALL -j ACCEPT

$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -s $MEC02 -p ALL -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -s $MEC02 -p ALL -j ACCEPT

#Liberacao de Demais Maquinas
$IPTABLES -A FORWARD -o $INET_IFACE -s $GANDALF -p ALL -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -s $ARAGORN -p ALL -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -p tcp -d $ARAGORN -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -p tcp -s $ARAGORN -j ACCEPT
$IPTABLES -A FORWARD -p tcp -d $ARAGORN -j ACCEPT
$IPTABLES -A FORWARD -p tcp -s $ARAGORN -j ACCEPT

$IPTABLES -A FORWARD -o $INET_IFACE -s $DTI_SUPORTE2_ACD -p ALL -j ACCEPT
$IPTABLES -A FORWARD -i $ADM_IFACE -o $INET_IFACE -s $VIVIANE_ADM -p ALL -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -s $VIVIANE_ADM -p ALL -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -s $DTI_ALE_ACD -p ALL -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -s $DTI_SUPORTE_ACD -p ALL -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -s $DIR_SIRLE -p ALL -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -s $ESTACAO_ADM2_IP -p ALL -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -s $ESTACAO_ADM3_IP -p ALL -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -s $ESTACAO_ADM8_IP -p ALL -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -s $ESTACAO_ADM9_IP -p ALL -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -s $ESTACAO_ADM10_IP -p ALL -j ACCEPT
$IPTABLES -A FORWARD -o $INET_IFACE -s $TELEFONISTA -p ALL -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m limit --limit 3/s --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "

############################################################################
# Regras de OUTPUT
$IPTABLES -A OUTPUT -p ALL -j ACCEPT
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "

# Regra de OUTPUT para acessar o lyceum online e o FTP de dentro da rede interna colocando ip verdadeiro
$IPTABLES -t nat -A OUTPUT -p tcp -d $INET_IP --dport 80 -j DNAT --to $GANDALF:80
#$IPTABLES -t nat -A OUTPUT -p tcp -d $INET_IP --dport 21 -j DNAT --to $GANDALF:21

# Regra de Saida para acessar o email de dentro da rede interna com o ip externo
$IPTABLES -t nat -A OUTPUT -p tcp -d $INET_IP --dport 25 -j DNAT --to $ARAGORN:25
$IPTABLES -t nat -A OUTPUT -p tcp -d $INET_IP --dport 110 -j DNAT --to $ARAGORN:110
$IPTABLES -t nat -A OUTPUT -p tcp -d $INET_IP --dport 143 -j DNAT --to $ARAGORN:143

#$IPTABLES -t nat -A OUTPUT -p ALL -d app.radio.musica.uol.com.br --dport 3128 -j DNAT --to-port 7000:7007

##############################################################################
# NAT para acesso a Internet
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP
# Redirecionamento de portas
# Proxy Transparente
#$IPTABLES -A FORWARD -p tcp --dport 80 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p TCP -i $ADM_IFACE --dport 80 -j REDIRECT --to-port 3128
$IPTABLES -t nat -A PREROUTING -p TCP -i $ACD_IFACE --dport 80 -j REDIRECT --to-port 3128
$IPTABLES -t nat -A PREROUTING -p TCP -i $ACD2_IFACE --dport 80 -j REDIRECT --to-port 3128

# NAT PORTA TORRENT
$IPTABLES -A FORWARD -s 10.18.24.103 -p tcp --dport 62236 -j ACCEPT
$IPTABLES -A FORWARD -s 10.18.24.101 -p tcp --dport 62236 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IP --dport 62236 -j DNAT --to $DTI_SUPORTE2_ACD:62236
$IPTABLES -t nat -A PREROUTING -p UDP -i $INET_IP --dport 62236 -j DNAT --to $DTI_SUPORTE2_ACD:62236
$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IP --dport 62236 -j DNAT --to $DTI_SUPORTE2_ADM:62236
$IPTABLES -t nat -A PREROUTING -p UDP -i $INET_IP --dport 62236 -j DNAT --to $DTI_SUPORTE2_ADM:62236

$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IP --dport 38232 -j DNAT --to $DTI_BRAULIO_ACD:38232
$IPTABLES -t nat -A PREROUTING -p UDP -i $INET_IP --dport 38232 -j DNAT --to $DTI_BRAULIO_ACD:38232
$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IP --dport 38232 -j DNAT --to $DTI_BRAULIO_ADM:38232
$IPTABLES -t nat -A PREROUTING -p UDP -i $INET_IP --dport 38232 -j DNAT --to $DTI_BRAULIO_ADM:38232

#HTTPS
iptables -t nat -A POSTROUTING -s 0/0 -d 0/0 -o $INET_IFACE -p tcp --dport 443 -j MASQUERADE

############################################################################
# Tabela Mangle para priorizar servicos
############################################################################
# Priorizando trafego da VPN
$IPTABLES -t mangle -A FORWARD -d $VPN_IP -j TOS --set-tos 16

### Liberando acesso ao MSN Privilegiados
$IPTABLES -A FORWARD -i $ADM_IFACE -p tcp --dport 1863 -s $ESTACAO_ADM1_IP -j ACCEPT
$IPTABLES -A FORWARD -i $ADM_IFACE -p udp --dport 1863 -s $ESTACAO_ADM1_IP -j ACCEPT
$IPTABLES -A FORWARD -i $ACD_IFACE -p tcp --dport 1863 -s $DIR_SIRLE -j ACCEPT
$IPTABLES -A FORWARD -i $ACD_IFACE -p udp --dport 1863 -s $DIR_SIRLE -j ACCEPT
$IPTABLES -A FORWARD -i $ADM_IFACE -p tcp --dport 1863 -s $DTI_ALE_ADM -j ACCEPT
$IPTABLES -A FORWARD -i $ADM_IFACE -p udp --dport 1863 -s $DTI_ALE_ADM -j ACCEPT
$IPTABLES -A FORWARD -i $ACD_IFACE -p tcp --dport 1863 -s $DTI_ALE_ACD -j ACCEPT
$IPTABLES -A FORWARD -i $ACD_IFACE -p udp --dport 1863 -s $DTI_ALE_ACD -j ACCEPT
$IPTABLES -A FORWARD -i $ADM_IFACE -p tcp --dport 1863 -s $DTI_BRAULIO_ADM -j ACCEPT
$IPTABLES -A FORWARD -i $ADM_IFACE -p udp --dport 1863 -s $DTI_BRAULIO_ADM -j ACCEPT
$IPTABLES -A FORWARD -i $ACD_IFACE -p tcp --dport 1863 -s $DTI_BRAULIO_ACD -j ACCEPT
$IPTABLES -A FORWARD -i $ACD_IFACE -p udp --dport 1863 -s $DTI_BRAULIO_ACD -j ACCEPT
$IPTABLES -A FORWARD -i $ADM_IFACE -p tcp --dport 1863 -s $ESTACAO_ADM10_IP -j ACCEPT
$IPTABLES -A FORWARD -i $ADM_IFACE -p udp --dport 1863 -s $ESTACAO_ADM10_IP -j ACCEPT
$IPTABLES -A FORWARD -i $ACD_IFACE -p tcp --dport 1863 -s $DTI_BRAULIOII -j ACCEPT
$IPTABLES -A FORWARD -i $ACD_IFACE -p udp --dport 1863 -s $DTI_BRAULIOII -j ACCEPT

### NAT para acessar o lyceum online #######
$IPTABLES -A FORWARD -i $INET_IFACE -p tcp --dport 80 -d $GANDALF -j ACCEPT
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -p tcp --dport 80 -j DNAT --to $GANDALF:80

###FTP
#$IPTABLES -A FORWARD -i $INET_IFACE -p tcp --dport 21 -d $GANDALF -j ACCEPT
#$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -p tcp --dport 21 -j DNAT --to $GANDALF:21

### NAT Para acesso ao Email SMTP
$IPTABLES -A FORWARD -i $INET_IFACE -p tcp --dport 25 -d $ARAGORN -j ACCEPT
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -p tcp --dport 25 -j DNAT --to $ARAGORN:25

### NAT para acesso ao Email POP
$IPTABLES -A FORWARD -i $INET_IFACE -p tcp --dport 110 -d $ARAGORN -j ACCEPT
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -p tcp --dport 110 -j DNAT --to $ARAGORN:110

### NAT Para Acesso ao Email IMAP
$IPTABLES -A FORWARD -i $INET_IFACE -p tcp --dport 143 -d $ARAGORN -j ACCEPT
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -p tcp --dport 143 -j DNAT --to $ARAGORN:143

### Bloqueando Kazaa
$IPTABLES -A FORWARD -d 213.248.112.0/24 -j DROP
$IPTABLES -A FORWARD -p tcp --dport 1214 -j DROP

############################################################################
# FIM
# Regras Extras
####################################################################################

echo "Habilitando o forward entre as interfaces"
echo "1" >/proc/sys/net/ipv4/ip_forward
echo "4096" > /proc/sys/net/ipv4/ip_conntrack_max
echo "Habilitando verificacao de fonte do endereco"
echo "1" > /proc/sys/net/ipv4/conf/default/rp_filter
echo "Desabilitando o ICPM Redirect"
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
echo "Desabilitando ICMP"
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo "Desabilitando o Rota source"
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
echo "Desabilitando Syn flood"
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "Feito!"

;;

stop)

echo "Parando o Firewall"

$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -X
$IPTABLES -Z

$IPTABLES -P INPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT

;;

restart)

/etc/init.d/firewall.sh stop

/etc/init.d/firewall.sh start
echo "Iniciando o firewall"
;;

status)

$IPTABLES -t filter -L -v -n
$IPTABLES -t nat -L -v -n

;;

*)

echo $0 'start|stop|restart|status'

esac

exit 0