#!/bin/bash
#
# Simple firewall disallowing all incomming connections
# but allowing all traffic on localhost (lo device) and all outgoing
#
# usage: rc.firewall start|stop|status
#
# Author: Tomas M. <http://slax.linux-live.org/>
#

export LAN=eth0
export WAN=eth1

SYSCTLW="/sbin/sysctl -q -w"
IPTABLES="/usr/sbin/iptables"

if [ "$1" = "start" ]; then

   # Disable routing triangulation. Respond to queries out
   # the same interface, not another. Helps to maintain state
   # Also protects against IP spoofing

   $SYSCTLW net.ipv4.conf.all.rp_filter=1

   # Enable logging of packets with malformed IP addresses,
   # Disable redirects,
   # Disable source routed packets,
   # Disable acceptance of ICMP redirects,
   # Turn on protection from Denial of Service (DOS) attacks,
   # Disable responding to ping broadcasts,
   # Enable IP routing. Required if your firewall is protecting a network, NAT included

#   $SYSCTLW net.ipv4.conf.all.log_martians=1
   $SYSCTLW net.ipv4.conf.all.send_redirects=0
   $SYSCTLW net.ipv4.conf.all.accept_source_route=0
   $SYSCTLW net.ipv4.conf.all.accept_redirects=0
   $SYSCTLW net.ipv4.tcp_syncookies=1
   $SYSCTLW net.ipv4.icmp_echo_ignore_broadcasts=1
   $SYSCTLW net.ipv4.ip_forward=1

   # Firewall initialization, remove everything, start with clean tables
   # Flush current rules
   $IPTABLES -F      # remove all rules
   $IPTABLES -t nat -F
   $IPTABLES -X      # delete all user-defined chains
   #Setup default policies to handle unmatched traffic
   $IPTABLES -P OUTPUT ACCEPT
   $IPTABLES -P INPUT ACCEPT
   $IPTABLES -P FORWARD DROP

   # Lock our services so they only work from the LAN
   $IPTABLES -I INPUT -i ${LAN} -j ACCEPT
   $IPTABLES -I INPUT -i lo -j ACCEPT
   $IPTABLES -A INPUT -p UDP --dport bootps -i ! ${LAN} -j REJECT
   $IPTABLES -A INPUT -p UDP --dport domain -i ! ${LAN} -j REJECT

   # (Optional) Allow access to our ssh server from the WAN
   $IPTABLES -A INPUT -p TCP --dport ssh -i ${WAN} -j ACCEPT

   # (Optional) BitTorrent
#   for PORT in 2706 6881 6882 6883 6884 6885 6886 6887 6888 6889; do
#      $IPTABLES -A INPUT -i ${WAN} -p tcp --dport $PORT -j ACCEPT
#   done

   # (Optional) eMule
   # If you set TCP port in eMule to XX and UDP port to YY then you have to set your firewall like this:
   # iptables -A INPUT -p tcp --dport XX -j ACCEPT
   # iptables -A INPUT -p udp --dport XX+3 -j ACCEPT
   # eMule extended UDP Port
   # iptables -A INPUT -p udp --dport YY -j ACCEPT
#   $IPTABLES -A INPUT -i ${WAN} -p tcp --dport 4662 -j ACCEPT
#   $IPTABLES -A INPUT -i ${WAN} -p udp --dport 4665 -j ACCEPT
   # eMule extended UDP Port
#   $IPTABLES -A INPUT -i ${WAN} -p udp --dport 4672 -j ACCEPT

   # Drop TCP / UDP packets to privileged ports
   $IPTABLES -A INPUT -p TCP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP
   $IPTABLES -A INPUT -p UDP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP

   # Rules for NAT
   $IPTABLES -I FORWARD -i ${LAN} -d 192.168.0.0/255.255.0.0 -j DROP
   $IPTABLES -A FORWARD -i ${LAN} -s 192.168.0.0/255.255.0.0 -j ACCEPT
   $IPTABLES -A FORWARD -i ${WAN} -d 192.168.0.0/255.255.0.0 -j ACCEPT
   $IPTABLES -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE

elif [ "$1" = "stop" ]; then
   # Flush current rules
   $IPTABLES -F
   $IPTABLES -t nat -F
   $IPTABLES -X # delete all user-defined chains
   #Setup default policies to handle unmatched traffic
   $IPTABLES -P OUTPUT ACCEPT
   $IPTABLES -P INPUT ACCEPT
   $IPTABLES -P FORWARD DROP

elif [ "$1" = "status" ]; then
   $IPTABLES -L -v

else
   echo "usage: $0 start|stop|status"
fi