#!/bin/bash

modprobe ip_tables
modprobe ip_conntrack

PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/bin
export PATH
test -x /sbin/iptables || exit 1



LOC="xxx.xxx.7.64/26"
INIF="eth1"
INIP="xxx.xxx.7.69"
BROADCAST="xxx.xxx.7.127"
LOOPBACK="127.0.0.0/8"
CLASS_A="10.0.0.0/8"
CLASS_B="172.16.0.0/12"
CLASS_C="192.168.0.0/16"
CLASS_D_MULTICAST="224.0.0.0/4"
CLASS_E_RESERVED_NET="240.0.0.0/4"
P_PORTS="0:1023"
UP_PORTS="1024:65535"
TR_SRC_PORTS="32769:65535"
TR_DEST_PORTS="33434:33523"



case $1 in
start|restart|force-reload)
        echo "Starting firewall"
        ###############################################################################
        # First we need to clear up any existing firewall rules
        # and chain which might have been created

        iptables -F
        iptables -F INPUT
        iptables -F OUTPUT
        iptables -F FORWARD
        iptables -F -t mangle
        iptables -F -t nat
        iptables -X
        iptables -Z

        # Default policies: Accept any incoming packets
        iptables -P INPUT ACCEPT
        iptables -P OUTPUT ACCEPT
        iptables -P FORWARD ACCEPT

        # Disable response to ping:
        /bin/echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all

        # Disable response to broadcasts:
        /bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

        # Enable TCP SYN cookies:
        /bin/echo "1" > /proc/sys/net/ipv4/tcp_syncookies

        # Enable bad error messages protection:
        /bin/echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

        # Disable IP forwarding:
        /bin/echo "0" > /proc/sys/net/ipv4/ip_forward

        for interface in /proc/sys/net/ipv4/conf/*
        do
            echo "0" > ${interface}/send_redirects
            echo "0" > ${interface}/accept_redirects
            echo "1" > ${interface}/secure_redirects
            echo "0" > ${interface}/accept_source_route
            echo "0" > ${interface}/bootp_relay
            echo "0" > ${interface}/proxy_arp
            echo "1" > ${interface}/log_martians
            echo "1" > ${interface}/rp_filter
        done

        # Accept any connections from the local machine
        iptables -A INPUT -i lo -j ACCEPT

        # Here we define a new chain which is going to handle
        # packets we don't want to respond to
        # limit the amount of logs to 10/min
        iptables -N Firewall
        iptables -A Firewall -m limit --limit 10/minute -j LOG --log-prefix "Firewall: "
        iptables -A Firewall -j DROP

        # log those packets and inform the sender that the packet was rejected
        iptables -N Rejectwall
        iptables -A Rejectwall -m limit --limit 10/minute -j LOG --log-prefix "Rejectwall: "
        iptables -A Rejectwall -j REJECT --reject-with icmp-host-unreachable


        iptables -N Badflags
        iptables -A Badflags -m limit --limit 10/minute -j LOG --log-prefix "Badflags: "
        iptables -A Badflags -j DROP

        iptables -N Log
        iptables -A Log -m limit --limit 10/minute -j LOG --log-prefix "Log: "
        iptables -A Log -j ACCEPT


        # A list of well known combination of Bad TCP flags
        # we redirect those to the Badflags chain
        # which is going to handle them (log and drop)
        iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j Badflags
        iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j Badflags
        iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j Badflags
        iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j Badflags
        iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j Badflags
        iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j Badflags
        iptables -A INPUT -p tcp --tcp-flags ALL ALL -j Badflags
        iptables -A INPUT -p tcp --tcp-flags ALL NONE -j Badflags
        iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j Badflags
        iptables -A INPUT -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j Badflags
        iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j Badflags



        # Syn flood protection:
        #
        # Maximize the rate of incoming connections. In order to do this
        # we divert tcp packets with the SYN bit set off to a user-defined
        # chain. Up to limit-burst connections can arrive in 1/limit
        # seconds; in this case 4 connections in one second. After this,
        # one of the burst is regained every second and connections are
        # allowed again. The default limit is 3/hour. The default limit
        # burst is 5.
        #
        iptables -N syn-flood
        iptables -A INPUT -i $INIF -p tcp --syn -j syn-flood
        iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
        iptables -A syn-flood -j LOG --log-prefix "$INIF Input TCP Syn Flood: "
        iptables -A syn-flood -j DROP

        # New tcp connections must be made with Syn packets:
        iptables -A INPUT -i $INIF -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "$INIF Input TCP Syn: "
        iptables -A INPUT -i $INIF -p tcp ! --syn -m state --state NEW -j DROP



        # Refuse spoofed packets pretending to be from the INIP IP
        # address:
        iptables -A INPUT -i $INIF -s $INIP -j LOG --log-prefix "$INIF Input Spoof: "
        iptables -A INPUT -i $INIF -s $INIP -j DROP

        # Refuse packets claiming to be from a Class A private network:
        iptables -A INPUT -i $INIF -s $CLASS_A -j LOG --log-prefix "$INIF Input Class A Private: "
        iptables -A INPUT -i $INIF -s $CLASS_A -j DROP

        # Refuse packets claiming to be from a Class B private network,
        # (INNET is a Class B private network-its commented out):
        iptables -A INPUT -i $INIF -s $CLASS_B -j LOG --log-prefix "$INIF Input Class B Private: "
        iptables -A INPUT -i $INIF -s $CLASS_B -j DROP

        # Refuse packets claiming to be from a Class C private network:
        iptables -A INPUT -i $INIF -s $CLASS_C -j LOG --log-prefix "$INIF Input Class C Private: "
        iptables -A INPUT -i $INIF -s $CLASS_C -j DROP

        # Refuse Class D multicast addresses. Multicast is illegal as a
        # source address:
        iptables -A INPUT -i $INIF -s $CLASS_D_MULTICAST -j LOG --log-prefix "$INIF Input Multicast: "
        iptables -A INPUT -i $INIF -s $CLASS_D_MULTICAST -j DROP

        # Refuse Class E reserved IP addresses:
        iptables -A INPUT -i $INIF -s $CLASS_E_RESERVED_NET -j LOG --log-prefix "$INIF Input Class E: "
        iptables -A INPUT -i $INIF -s $CLASS_E_RESERVED_NET -j DROP

        # Refuse packets claiming to be to the loopback interface:
        iptables -A INPUT -i $INIF -d $LOOPBACK -j LOG --log-prefix "$INIF Input Loopback Spoof: "
        iptables -A INPUT -i $INIF -d $LOOPBACK -j DROP

        # Refuse broadcast address packets:
        iptables -A INPUT -i $INIF -d $BROADCAST -j LOG --log-prefix "$INIF Input Broadcast: "
        iptables -A INPUT -i $INIF -d $BROADCAST -j DROP


        # Limit ICMP
        iptables -A INPUT -p icmp --fragment -j DROP
        iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/second -j ACCEPT
        iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
        iptables -A INPUT -p icmp --icmp-type source-quench -j ACCEPT
        iptables -A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT
        iptables -A INPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT
        iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
        iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
        iptables -A INPUT -p icmp -j Firewall



        # Accept ssh connections from the Internet
        iptables -A INPUT -i $INIF -p tcp -m state --syn --state NEW --dport 22 -m limit --limit 6/minute --limit-burst 1 -j ACCEPT
        iptables -A INPUT -i $INIF -p tcp -m state --syn --state NEW --dport 22 -j Firewall



        # Accept smtp connections from the Internet
        iptables -A INPUT -i $INIF -p tcp -m state --syn --state NEW --dport 25 -m limit --limit 6/minute --limit-burst 1 -j ACCEPT
        iptables -A INPUT -i $INIF -p tcp -m state --syn --state NEW --dport 25 -j Firewall


        # DROP DROP DROP DROP DROP

        # Drop netbios from the outside, no log, just drop
        iptables -A INPUT -p udp --sport 137 --dport 137 -j DROP

        # Drop nfs from the Internet
        iptables -A INPUT -p tcp --dport 111 -j DROP
        iptables -A INPUT -p tcp --dport 2049 -j DROP


        # Drop baclula from the Internet
        iptables -A INPUT -p tcp --dport 9101 -j DROP
        iptables -A INPUT -p tcp --dport 9103 -j DROP

        ###############################################################################
    ;;
stop)
        ###############################################################################
        echo "Stoping firewall"
        iptables -F
        iptables -X
        iptables -Z
        iptables -P INPUT ACCEPT
        iptables -P FORWARD ACCEPT
        iptables -P OUTPUT ACCEPT
        ###############################################################################
    ;;
esac