#!/bin/bash
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F
iptables -F -t nat
iptables -F -t mangle
iptables -X
iptables -X -t nat
iptables -X -t mangle

# Setup default policies to handle unmatched traffic
policy_1(){
iptables -P INPUT   DROP
iptables -P OUTPUT  DROP
iptables -P FORWARD DROP
}
policy_2(){
iptables -P INPUT   ACCEPT
iptables -P OUTPUT  ACCEPT
iptables -P FORWARD ACCEPT
}
policy_2
# My Interfaces
export LAN=eth0
export WAN=eth1
IP_LAN=`ifconfig $LAN | grep -e "inet addr" | awk {'print $2'} | awk -F: {'print $2'}`
IP_WAN=`ifconfig $WAN | grep -e "inet addr" | awk {'print $2'} | awk -F: {'print $2'}`

# Kernel Settings
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/all/log_martians
for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 1 > $f ; done

######## NAT / PROXY #############################
iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
iptables -t nat -A PREROUTING  -i $LAN -p tcp --dport 80    -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING  -i $WAN -p tcp --dport 5900  -j DNAT --to-destination 192.168.10.127
iptables -t nat -A PREROUTING  -i $WAN -p tcp --dport 2401  -j DNAT --to-destination 192.168.10.127
iptables -t nat -A PREROUTING  -i $WAN -p tcp --dport 22    -j DNAT --to-destination 192.168.10.127
iptables -t nat -A PREROUTING  -i $WAN -p tcp --dport 3389 -j DNAT --to-destination 192.168.10.3
iptables -t nat -A PREROUTING  -i $WAN -p udp --dport 5900  -j DNAT --to-destination 192.168.10.127


####### RFC1918

iptables -A INPUT -i $LAN -s 127.0.0.1 -j DROP
iptables -A INPUT -i $WAN -s $IP_LAN -j DROP
iptables -A INPUT -i $WAN -s 127.0.0.1 -j DROP
iptables -A INPUT -i $WAN -s 10.0.0.0/8 -j DROP
iptables -A INPUT -i $WAN -s 172.16.0.0/12 -j DROP
#iptables -A INPUT -i $WAN -s 192.168.0.0/16 -j DROP


# Drop Class E & D
iptables -A INPUT   -i $LAN -s 240.0.0.0/5 -j DROP
iptables -A INPUT   -i $WAN -s 240.0.0.0/5 -j DROP
iptables -A INPUT   -i $LAN -s 224.0.0.0/4 -j DROP
iptables -A INPUT   -i $WAN -s 224.0.0.0/4 -j DROP
iptables -A FORWARD -i $LAN -s 240.0.0.0/5 -j DROP
iptables -A FORWARD -i $WAN -s 240.0.0.0/5 -j DROP
iptables -A FORWARD -i $LAN -s 224.0.0.0/4 -j DROP
iptables -A FORWARD -i $WAN -s 224.0.0.0/4 -j DROP

# Previously initiated and accepted exchanges bypass rule checking
iptables -A INPUT   -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT  -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


# Allow incoming port 22 (ssh) connections on LAN interface
iptables -A INPUT  -i $LAN -p tcp --dport 5900 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT  -i $LAN -p udp --dport 5900 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


# Allow ICMP
iptables -A INPUT   -p icmp -j ACCEPT
iptables -A OUTPUT  -p icmp -j ACCEPT
iptables -A FORWARD -p icmp -j ACCEPT

# Allow localhost traffic
iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT