[root@Lost ~] cat /etc/init.d/rc.firewall
#!/bin/sh 
##########################################
#
# Author Olivier GENRE : olivier.genre@efixo.com
#
##########################################
# firewalling
# Separate chains for nat and filter


IPTABLES="/bin/iptables"

LAN_NET="$(net `/bin/nvram get lan_ipaddr` `/bin/nvram get lan_netmask`)"
PPP_IFACE=`/bin/nvram get ppp_ifname`
LAN_BR=`/bin/nvram get lan_ifname`
WAN_BR=`/bin/nvram get wan_ifname`
CHILL_TUN=`/bin/nvram get chilli_tun`
NET_INFRA=`/bin/nvram get net_infra`

logger -s -t firewall -p daemon.info "== $0 $* =="

case "$1" in

        prepare)
                # INPUT POLICY set to DROP
                $IPTABLES -P INPUT DROP
                # Accept from known connections
                $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED  -j ACCEPT
                $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED  -j ACCEPT

                $IPTABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
        

                $IPTABLES -P FORWARD ACCEPT
                $IPTABLES -P OUTPUT ACCEPT

                $IPTABLES -N CHILLI_FILTER
                $IPTABLES -A INPUT -j CHILLI_FILTER

                $IPTABLES -N PPP_FILTER
                $IPTABLES -A INPUT -j PPP_FILTER

                $IPTABLES -N WAN_FILTER
                $IPTABLES -A INPUT -j WAN_FILTER

                $IPTABLES -N ACLS_FILTER
                $IPTABLES -A INPUT -j ACLS_FILTER

                $IPTABLES -N LAN_FILTER
                $IPTABLES -A INPUT -j LAN_FILTER

                $IPTABLES -N USER_FILTER
                $IPTABLES -A FORWARD -j USER_FILTER
                
                $IPTABLES -N CHILLI_FILTER_FW
                $IPTABLES -A FORWARD -i $CHILL_TUN -j CHILLI_FILTER_FW
                        
                
                $IPTABLES -t nat -N USER_NAT    
                $IPTABLES -t nat -A PREROUTING -j USER_NAT
                
                $IPTABLES -t nat -N SYS_NAT
                $IPTABLES -t nat -A PREROUTING -j SYS_NAT

                

        ;;

        PPP|ppp)
                $IPTABLES -F PPP_FILTER
                #For ICMP it's OK
                $IPTABLES -A PPP_FILTER -p icmp --icmp-type 8 -i $PPP_IFACE -j ACCEPT


        ;;
        WAN|wan|dhcp|DHCP)
                $IPTABLES -F WAN_FILTER

                $IPTABLES -A WAN_FILTER -p icmp --icmp-type 8 -i $WAN_BR -j ACCEPT
                # From 9 private network MGCP/RTP, it's OK
                $IPTABLES -A WAN_FILTER -i $WAN_BR -p udp -m udp -m state --state NEW --dport 2427 -j ACCEPT
                $IPTABLES -A WAN_FILTER -i $WAN_BR -p udp -m udp -m state --state NEW --dport 2727 -j ACCEPT
                $IPTABLES -A WAN_FILTER -i $WAN_BR -p udp -m udp -m state --state NEW --dport 53456:63456 -j ACCEPT

        ;;


        LAN|lan)
                $IPTABLES -F LAN_FILTER
                #From loopback all is Ok !
                $IPTABLES -A LAN_FILTER -i lo -m state --state NEW -j ACCEPT
                $IPTABLES -A LAN_FILTER -p icmp --icmp-type 8 -i $LAN_BR -j ACCEPT
                # DHCP Client from lan
                $IPTABLES -A LAN_FILTER -p udp -m udp -i $LAN_BR --dport 67 -m state --state NEW -j ACCEPT
                $IPTABLES -A LAN_FILTER -p udp -m udp -i $LAN_BR --dport 68 -m state --state NEW -j ACCEPT
                # DNS
                $IPTABLES -A LAN_FILTER -p tcp -m tcp -i $LAN_BR -s $LAN_NET --dport 53 -m state --state NEW -j ACCEPT
                $IPTABLES -A LAN_FILTER -p udp -m udp -i $LAN_BR -s $LAN_NET --dport 53 -m state --state NEW -j ACCEPT
                # Web servers
                $IPTABLES -A LAN_FILTER -p tcp -m tcp -i $LAN_BR -s $LAN_NET --dport 80 -m state --state NEW -j ACCEPT
                $IPTABLES -A LAN_FILTER -p tcp -m tcp -i $WAN_BR -s $LAN_NET --dport 80 -m state --state NEW -j ACCEPT
                $IPTABLES -A LAN_FILTER -p tcp -m tcp -i $WAN_BR -s $LAN_NET --dport 8080 -m state --state NEW -j ACCEPT
                $IPTABLES -A LAN_FILTER -p tcp -m tcp -i $LAN_BR -s $LAN_NET --dport 8080 -m state --state NEW -j ACCEPT
                $IPTABLES -A LAN_FILTER -p tcp -m tcp -i $WAN_BR -s $LAN_NET --dport 1287 -m state --state NEW -j ACCEPT
                $IPTABLES -A LAN_FILTER -p tcp -m tcp -i $LAN_BR -s $LAN_NET --dport 1287 -m state --state NEW -j ACCEPT

        ;;


        ACLS|acls)

                $IPTABLES -F ACLS_FILTER        
                #if [ "$NET_INFRA" != "mediafibre" ]
                #then
                # STB ACLS
                #       $IPTABLES -A ACLS_FILTER -i $WAN_BR -p tcp -m tcp -s 172.16.255.253 --dport 80 -m state --state NEW -j ACCEPT
                #       $IPTABLES -A ACLS_FILTER -i $WAN_BR -p tcp -m tcp -s 172.16.255.253 --dport 8080 -m state --state NEW -j ACCEPT
                #else
                #       $IPTABLES -A ACLS_FILTER -i eth1.2101 -p tcp -m tcp -s 172.16.255.253 --dport 80 -m state --state NEW -j ACCEPT
                #       $IPTABLES -A ACLS_FILTER -i eth1.2101 -p tcp -m tcp -s 172.16.255.253 --dport 8080 -m state --state NEW -j ACCEPT
                #fi 
                # TELNET ACLS
                $IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 192.168.0.0/255.255.248.0 --dport 1287 -m state --state NEW -j ACCEPT
                $IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 192.168.0.0/255.255.248.0 --dport 22 -m state --state NEW -j ACCEPT
                #$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 212.94.162.0/255.255.255.128 --dport 1287 -m state --state NEW -j ACCEPT
                #$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 80.118.192.64/26 --dport 1287 -m state --state NEW -j ACCEPT
                #$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 80.118.196.0/26 --dport 1287 -m state --state NEW -j ACCEPT
                #$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 10.0.32.0/255.255.224.0 --dport 1287 -m state --state NEW -j ACCEPT
                #$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 84.96.217.0/255.255.255.0 --dport 1287 -m state --state NEW -j ACCEPT
                #$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 86.64.233.0/27 --dport 1287 -m state --state NEW -j ACCEPT
                #$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 84.103.237.176/28 --dport 1287 -m state --state NEW -j ACCEPT
                #$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 84.103.235.176/29 --dport 1287 -m state --state NEW -j ACCEPT
                #$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 86.64.145.176/29 --dport 1287 -m state --state NEW -j ACCEPT

        ;;


        stop)
#               $IPTABLES -F PPP_FILTER
#               $IPTABLES -X PPP_FILTER
#
#               $IPTABLES -F WAN_FILTER
#               $IPTABLES -X WAN_FILTER
#
#               $IPTABLES -F ACLS_FILTER
#               $IPTABLES -X ACLS_FILTER
#
#               $IPTABLES -F LAN_FILTER
#               $IPTABLES -X LAN_FILTER
#
#               $IPTABLES -F USER_FILTER
#               $IPTABLES -X USER_FILTER
#               
                $IPTABLES -P INPUT ACCEPT
                $IPTABLES -F

                exit 0
        ;;


        *)
                echo "Usage: $0 {stop}"
                exit 1
                ;;


esac