# Regras do Firewall (Iptables) 
# Mantido por Denis - denis@indusul.com - Tecnologia da Informac,ao

# Carrega os modulos necessarios para o funcionamento do firewall
modprobe ip_tables
modprobe iptable_filter
modprobe iptable_mangle
modprobe iptable_nat
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp

# Limpa todas regras do firewall
qqiptables -F
iptables -Z
iptables -X
iptables -t nat -F
iptables -t mangle -F

# Bloqueia tudo que entra na rede (Politica Padrao)
iptables -P INPUT DROP

# Bloqueia tudo que passa pelo Firewall (Politica Padrao)
iptables -P FORWARD DROP

# Libera tudo que sai do Firewall (Politica Padrao)
iptables -P OUTPUT ACCEPT

# Liberac,ao de maquinas para uso da rede sem proxy
# Maquina Pedro
iptables -t nat -A PREROUTING -i eth1 -m mac --mac-source 00-40-F4-D9-CB-68 -p tcp -j ACCEPT
# Maquina Viviani
iptables -t nat -A PREROUTING -i eth1 -m mac --mac-source 00-00-8B-AB-F3-00 -p tcp -j ACCEPT
iptables -t nat -A PREROUTING -i eth1 -m mac --mac-source 00-40-F4-D9-CB-68 -p tcp -j ACCEPT
# Maquina Antonio
iptables -t nat -A PREROUTING -i eth1 -m mac --mac-source 00-90-96-B3-44-BA -p tcp -j ACCEPT
iptables -t nat -A PREROUTING -i eth1 -m mac --mac-source 00-02-3F-D4-15-BC -p tcp -j ACCEPT
# Maquina Jackson
iptables -t nat -A PREROUTING -i eth1 -m mac --mac-source 00-13-02-4E-C0-09 -p tcp -j ACCEPT


# Liberando acesso externo ao Protheus
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 1234 -j LOG --log-prefix "Acesso Protheus: "
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 1234 -j DNAT --to-destination 192.168.1.8:1234

# Liberando acesso ao help do Protheus
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8080 -j LOG --log-prefix "Help Protheus: "
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.8:8080

# Liberando acesso externo ao Terminal Server
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 3389 -j LOG --log-prefix "Acesso WTS: "
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 3389 -j DNAT --to-destination 192.168.1.150:3389

# Liberando acesso ao webmail
#iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7070 -j DNAT --to-destination 192.168.1.254:7070

# Bloqueia acesso ao SSH, liberando somente para o ip 192.168.1.17
#iptables -A INPUT -i eth1 -s 192.168.1.17 -p tcp -m tcp --dport 33 -j ACCEPT
#iptables -A INPUT -p tcp -m tcp --dport 33 -j LOG --log-prefix "ACESSO SSH"
#iptables -A INPUT -p tcp -m tcp --dport 33 -j DROP

# Acesso a POP, SMTP, FTP
#iptables -A INPUT -p tcp -m multiport -s 192.168.1.0/24 --dport 110,25 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -d 200.154.55.5 --dport 25 -j LOG --log-prefix "Enviando e-mail"
iptables -A INPUT -i eth0 -p tcp -d 200.154.55.5 --dport 25 -j ACCEPT
# Liberando o firewall a acessar POP e SMTP e FTP
iptables -A OUTPUT -p tcp -m multiport --dport 110,25,21 -j ACCEPT
iptables -A FORWARD -p tcp -m multiport --dport 110,25,21 -j ACCEPT

# Ping da morte
#iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j LOG --log-prefix "Ping da Morte: "
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

# Permite pacotes originados da rede interna
iptables -A INPUT -i eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -j ACCEPT

# Libera conexoes iniciadas pela rede interna
iptables -A OUTPUT -m state --state NEW -o eth0 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state NEW -o eth0 -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 

# Redirecionando acesso a paginas (80), msn  para o Proxy
# Para acesso a intranet nao e necessario o proxy
iptables -t nat -A PREROUTING -i eth1 -d 192.168.1.254 -p tcp -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -m multiport -s 192.168.1.0/24 --dport 80,443 -j REDIRECT --to-ports 3128

# Ativando NAT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward