civil-srv civil # cat ~/1firewall0.sh
#!/bin/bash
IPTABLES='/sbin/iptables'
LOIF="lo0"
EXTIFS="ppp0 \
        eth1"
INTIFS="eth0 \
        usb0"
/bin/echo 1 > /proc/sys/net/ipv4/ip_forward
echo "Flusing old rules..."
$IPTABLES -F
$IPTABLES -X
$IPTABLES -A INPUT -p ALL -i $LOIF -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -o $LOIF -j ACCEPT
echo "Done"

#echo "Setting new chain for Treason uncloaked..."
#$IPTABLES -F TREASON
#$IPTABLES -X TREASON
#$IPTABLES -N TREASON

# Fix for VPN - make iptables split eth's packets (wich is 1500 bytes long) to meet ppp0's requests (1462 bytes).
echo "Fixing VPN packet size"
## $IPTABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss -mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu
# $IPTABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
$IPTABLES -t mangle -A FORWARD -p tcp -o ppp+ --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1250

echo "Forwarding ICMP Fragmentation-needed"
# $IPTABLES -A FORWARD -p icmp --icmp-type fragmentation-needed -j ACCEPT
# $IPTABLES -A INPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT

# Increasing TTL
echo "Increasing TTL"
$IPTABLES -A PREROUTING -t mangle -i eth0 -j TTL --ttl-inc 1
# $IPTABLES -A PREROUTING -t mangle -i eth0 -j TTL --ttl-inc 1

#NFS stuff
echo "Allowing NFS Connects"
$IPTABLES -A INPUT -p tcp --dport 111 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 111 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 633 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 633 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 636 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 636 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 999 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 999 -j ACCEPT

# Allowing VMWare Console
$IPTABLES -A INPUT -p tcp --dport 902 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 902 -j ACCEPT

# Allowing Multicast
# $IPTABLES -A INPUT -p igmp -j ACCEPT
# $IPTABLES -A FORWARD -s 10.184.0.0/16 -p udp -j ACCEPT


# Let's allow SSH, Web and FTP server
echo "Allowing SSH, WWW and FTP Servers"
$IPTABLES -A INPUT --protocol tcp --dport 22 -j ACCEPT
$IPTABLES -A INPUT --protocol tcp --dport 80 -j ACCEPT
$IPTABLES -A INPUT --protocol tcp --dport 21 -j ACCEPT
$IPTABLES -A INPUT --protocol tcp --dport 20 -j ACCEPT

# We need this for torrent and games servers
echo "Allowing Torrents and Games (all ports in 1024:65535)"
# $IPTABLES -A INPUT -p tcp -m tcp --dport 1024:65535 --syn -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 1024:65535 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 1024:65535 -j ACCEPT

# Maybe we need this to send that Dest. Host is unreachable
# $IPTABLES -A INPUT -p icmp --icmp-type 3 -j ACCEPT
# $IPTABLES -A INPUT -p icmp --icmp-type 11 -j ACCEPT
# $IPTABLES -A INPUT -p icmp --icmp-type 12 -j ACCEPT

#Cool pings: Destination host is unreachable :D
# echo "Destination host is unreachable on ping"
# $IPTABLES -A INPUT -p icmp -i ${EXTIF1} -j REJECT --reject-with icmp-host-unreachable
# $IPTABLES -A INPUT -p icmp -i ${EXTIF2} -j REJECT --reject-with icmp-host-unreachable

# $IPTABLES -A INPUT -p icmp -i eth1 -j REJECT --reject-with 1/13
# $IPTABLES -A INPUT -p tcp -m tcp --dport 1024:65535 --syn -j ACCEPT

# TV_MNET="224.10.10.0/26"
# TV_MPORT="8001:8063"
for INTIF in `echo "${INTIFS}"`
 do
    for EXTIF in `echo "${EXTIFS}"`
     do
        echo "Enabling NAT for ${EXTIF} and ${INTIF}"
        $IPTABLES -t nat -A POSTROUTING -o ${EXTIF} -j MASQUERADE
        $IPTABLES -t nat -A POSTROUTING -o ${EXTIF} -j MASQUERADE
        $IPTABLES -A FORWARD -i ${INTIF} -o ${EXTIF} -m state --state NEW,ESTABLISHED -j ACCEPT

#       echo "Multicast forwarding"
#       if [ "${EXTIF}"="eth0" ]; then
#               $IPTABLES -A INPUT      -p 2 -i ${INTIF} -s ${EXTIF} -d ${TV_MNET} -j ACCEPT
#               $IPTABLES -A INPUT      -p 2 -i ${INTIF} -s ${EXTIF} -d 224.0.0.0/24 -j ACCEPT
#               $IPTABLES -A OUTPUT     -p 2 -o ${INTIF} -s ${EXTIF} -d ${TV_MNET} -j ACCEPT
#               $IPTABLES -A OUTPUT     -p 2 -o ${INTIF} -s ${EXTIF} -d 224.0.0.0/24 -j ACCEPT
#       fi

#       echo "Disabling all unallowed connections from ${EXTIF}"
        $IPTABLES -A INPUT -i ${EXTIF} -m state --state NEW,INVALID -j DROP
        $IPTABLES -A FORWARD -i ${EXTIF} -m state --state NEW,INVALID -j DROP
     done
 done
echo "Done. Have a lot of fun"
#$IPTABLES -j TREASON