#!/bin/bash
# /etc/rc.d/rc.rc.firewall
#  firewall start up script
# (c) Proteus


do_start() {
#  Proceed only if a bridge is ready and ruuning

if ! grep -q br0 /proc/net/dev ; then
        printf "Brigde not set up ...$0 Aborted!\n"
        exit 1
fi

MODULES="ip_conntrack ip_conntrack_ftp iptable_nat ip_nat_ftp"

for module in $MODULES; do
                modprobe $module
done
############################################################################



# the firewall rules.
#
#       only traffic eth1-->eth2 is permitted
#       and related return traffic
#   everything else is blocked.
        iptables -P FORWARD DROP
        iptables -A FORWARD -m physdev --physdev-in eth1 --physdev-out eth2 -j ACCEPT
        iptables -A FORWARD -m physdev --physdev-in eth2 --physdev-out eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
#
#       emule ports to p800
#
        iptables -A FORWARD -m physdev --physdev-is-bridged -p tcp --dport 113 -j ACCEPT
        iptables -t nat -A PREROUTING -m physdev --physdev-is-bridged  -p tcp --dport 113 -j DNAT --to 192.168.1.5:113
        iptables -A FORWARD -m physdev --physdev-is-bridged -p tcp --dport 4662 -j ACCEPT
        iptables -t nat -A PREROUTING -m physdev --physdev-is-bridged  -p tcp --dport 4662 -j DNAT --to 192.168.1.5:4662
        iptables -A FORWARD -m physdev --physdev-is-bridged -p udp --dport 4672 -j ACCEPT
        iptables -t nat -A PREROUTING -m physdev --physdev-is-bridged  -p udp --dport 4672 -j DNAT --to 192.168.1.5:4672
        iptables -A FORWARD -m physdev --physdev-is-bridged -p udp --dport 4665 -j ACCEPT
        iptables -t nat -A PREROUTING -m physdev --physdev-is-bridged  -p udp --dport 4665 -j DNAT --to 192.168.1.5:4665
#
#       bittorrent ports to p800
#
        iptables -A FORWARD -m physdev --physdev-is-bridged -p tcp --dport 6881 -j ACCEPT
        iptables -t nat -A PREROUTING -m physdev --physdev-is-bridged  -p tcp --dport 6881 -j DNAT --to 192.168.1.5:6881
        iptables -A FORWARD -m physdev --physdev-is-bridged -p udp --dport 6881 -j ACCEPT
        iptables -t nat -A PREROUTING -m physdev --physdev-is-bridged  -p udp --dport 6881 -j DNAT --to 192.168.1.5:6881
        iptables -A FORWARD -m physdev --physdev-is-bridged -p udp --dport 4444 -j ACCEPT
        iptables -t nat -A PREROUTING -m physdev --physdev-is-bridged  -p udp --dport 4444 -j DNAT --to 192.168.1.5:4444


#
#       ftp ports to router
#
        iptables -A FORWARD -m physdev --physdev-is-bridged -p tcp --dport 20 -j ACCEPT
        iptables -A FORWARD -m physdev --physdev-is-bridged -p tcp --dport 21 -j ACCEPT
        iptables -t nat -A PREROUTING -m physdev --physdev-is-bridged  -p tcp --dport 20 -j DNAT --to 192.168.1.4:20
        iptables -t nat -A PREROUTING -m physdev --physdev-is-bridged  -p tcp --dport 21 -j DNAT --to 192.168.1.4:21
#
#
#       web port for router
        iptables -A FORWARD -m physdev --physdev-is-bridged -p tcp --dport 80 -j ACCEPT
        iptables -t nat -A PREROUTING -m physdev --physdev-is-bridged  -p tcp --dport 80 -j DNAT --to 192.168.1.4:80
#
#       smtp port router
#
        iptables -A FORWARD -m physdev --physdev-is-bridged -p tcp --dport 25 -j ACCEPT
        iptables -t nat -A PREROUTING -m physdev --physdev-is-bridged  -p tcp --dport 25 -j DNAT --to 192.168.1.4:25

#       Diogenes        router
        iptables -A FORWARD -m physdev --physdev-is-bridged -p tcp --dport 8888 -j ACCEPT
        iptables -t nat -A PREROUTING -m physdev --physdev-is-bridged  -p tcp --dport 8888 -j DNAT --to 192.168.1.4:8888

        echo "Firewall is up!"
}

do_stop() {

        echo "Stopping Firewall..."
        iptables -t nat -F PREROUTING
        iptables -F FORWARD
        iptables -P FORWARD ACCEPT
    echo "Firewall is down."

}

case "$1" in
        start)
                do_start
          ;;
        stop)
                do_stop
      ;;
        restart)
                do_stop
                sleep 1
                do_start
          ;;
        *)
                echo "Usage: $0 {start|stop|restart}"
                exit 1
esac
exit 0