#!/bin/sh
#### Variaveis ####

#### Conexao com a Internet ####
# Interface externa
IFEXT="eth1"
# IP Externo
IPEXT="177.54.11.148"

#### Conexao com a rede interna ####
# Interface interna
IFINT="eth0"
# IP Interno
IPINT="10.0.0.2"
# IP Servidor de E-mails (temporario)
IPSMT="10.0.0.1"
# IP Servidor Zimbra
IPZIM="10.0.0.6"
# IP SAPL
IPSAP="10.0.0.5"
# Rede
NTW="10.0.0.0/24"
# Loopback
LOO="127.0.0.1"

#### Comando do IPTables ####
IPT=`which iptables`

echo ""
$IPT -V # Apenas para ver a versão na tela
echo ""

iptables_start(){

    #### Ativando modulos de mascaramento ####
    modprobe iptable_nat
    modprobe ip_nat_ftp
    modprobe ip_conntrack
    modprobe ip_conntrack_ftp

    #### Ativando roteamento de pacotes ####
    echo 1 > /proc/sys/net/ipv4/ip_forward
    echo 1 > /proc/sys/net/ipv4/tcp_syncookies
    echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
    echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

    #### Limpando regras ####
    echo -n "Cleaning current rules... "
    $IPT -F
    $IPT -F -t nat
    $IPT -F -t mangle
    $IPT -X
    $IPT -X -t nat
    $IPT -X -t mangle
    $IPT -Z
    $IPT -Z -t nat
    $IPT -Z -t mangle
    echo "Ok"

    #### Politicas padrao ####
    echo -n "Setting default policies (DROP)... "
    $IPT -P INPUT DROP
    $IPT -P FORWARD DROP
    $IPT -P OUTPUT ACCEPT
    echo "Ok"

    #### Acesso loopback ####
    echo -n "Setting loopback access..."
    $IPT -A INPUT -s $LOO -d $LOO -j ACCEPT
    $IPT -A FORWARD -s $LOO -d $LOO -j ACCEPT
    echo "Ok"

    #### Acesso DNS ####
    echo -n "Setting DNS access..."
    $IPT -A INPUT -p tcp -s $NTW --dport 53 -j ACCEPT
    $IPT -A INPUT -p udp -s $NTW --dport 53 -j ACCEPT
    $IPT -A FORWARD -p tcp -s $NTW --dport 53 -j ACCEPT
    $IPT -A FORWARD -p udp -s $NTW --dport 53 -j ACCEPT
    echo "Ok"

    #### Acesso Telnet ####
    echo -n "Setting DNS access..."
    $IPT -A INPUT -p tcp -s $NTW --dport 23 -j ACCEPT
    $IPT -A INPUT -p udp -s $NTW --dport 23 -j ACCEPT
    $IPT -A FORWARD -p tcp -s $NTW --dport 23 -j ACCEPT
    $IPT -A FORWARD -p udp -s $NTW --dport 23 -j ACCEPT
    echo "Ok"

    #### Dropando pacotes mal-formados ####
    #echo -n "Malformed packages..."
    #$IPT -A INPUT -i $IFEXT -m unclean -m limit --limit 3/s -j LOG --log-level info --log-prefix "FIREWALL: Pacote mal formado -- "
    #$IPT -A INPUT -i $IFEXT -m unclean -j DROP
    #echo "Ok"

    #### Medidas de segurança contra spoofing, ping of death... ####
    echo -n "Setting ip spoofing protection..."
    $IPT -A INPUT -i $IFEXT -s 10.0.0.0/8 -m limit --limit 3/s -j LOG --log-level info --log-prefix "FIREWALL: Spoofing - 10. --"
    $IPT -A INPUT -i $IFEXT -s 10.0.0.0/8 -j DROP
    $IPT -A INPUT -i $IFEXT -s 172.16.0.0/16 -m limit --limit 3/s -j LOG --log-level info --log-prefix "FIREWALL: Spoofing - 172.16. --"
    $IPT -A INPUT -i $IFEXT -s 172.16.0.0/16 -j DROP
    $IPT -A INPUT -i $IFEXT -s 192.168.0.0/16 -m limit --limit 3/s -j LOG --log-level info --log-prefix "FIREWALL: Spoofing - 192.168. --"
    $IPT -A INPUT -i $IFEXT -s 192.168.0.0/16 -j DROP
    echo "Ok"

    #### Protecao contra synflood ####
    $IPT -A FORWARD -p tcp --syn -m limit --limit 2/s -j ACCEPT
    #### Proteção contra ping da morte ####
    $IPT -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

    #### Trafego para o Apache ####
    echo -n "Settings to Apache HTTPD..."
    #$IPT -A INPUT -i $IFEXT -p tcp --dport 80 -j ACCEPT
    #$IPT -A INPUT -i $IFEXT -p udp --dport 80 -j ACCEPT
    #$IPT -A INPUT -i $IFEXT -p tcp --dport 443 -j ACCEPT
    #$IPT -A INPUT -i $IFEXT -p udp --dport 443 -j ACCEPT
    $IPT -t nat -A PREROUTING -i $IFEXT -d $IPEXT -p tcp -m tcp --dport 80 -j DNAT --to $IPSMT:80
    $IPT -t nat -A POSTROUTING -d $IPSMT -p tcp --dport 80 -j SNAT --to $IPEXT

    $IPT -t nat -A PREROUTING -i $IFEXT -d $IPEXT -p udp -m udp --dport 80 -j DNAT --to $IPSMT:80
    $IPT -t nat -A POSTROUTING -d $IPSMT -p udp --dport 80 -j SNAT --to $IPEXT

    $IPT -t nat -A PREROUTING -i $IFEXT -d $IPEXT -p tcp -m tcp --dport 443 -j DNAT --to $IPSMT:443
    $IPT -t nat -A POSTROUTING -d $IPSMT -p tcp --dport 443 -j SNAT --to $IPEXT

    $IPT -t nat -A PREROUTING -i $IFEXT -d $IPEXT -p udp -m udp --dport 443 -j DNAT --to $IPSMT:443
    $IPT -t nat -A POSTROUTING -d $IPSMT -p udp --dport 443 -j SNAT --to $IPEXT
    echo "Ok"

    #### Trafego para e-mail ###
    echo -n "Redirecting e-mail ports..."
    $IPT -t nat -A PREROUTING -i $IFEXT -d $IPEXT -p tcp --dport 25 -j DNAT --to $IPSMT:25
    $IPT -t nat -A POSTROUTING -d $IPSMT -p tcp --dport 25 -j SNAT --to $IPEXT
    echo "Ok"

    #### Proxy transparente ####
    echo -n "Setting transparent proxy... "
    $IPT -A INPUT -p tcp -s $NTW --dport 8787 -j ACCEPT
    $IPT -A INPUT -p udp -s $NTW --dport 8787 -j ACCEPT
    $IPT -t nat -A PREROUTING -s $NTW -p tcp --dport 80 -j REDIRECT --to-port 8787
    $IPT -t nat -A PREROUTING -s $NTW -p udp --dport 80 -j REDIRECT --to-port 8787
    echo "Ok"

    #### IP's livres ####
    echo -n "Masquerading free traffic..."
    for IP in `cat /etc/init.d/ips`; do
        $IPT -t nat -A POSTROUTING -o $IFEXT -s $IP/32 -j MASQUERADE
    done
    echo "Ok"

    #### Mascarando todo o resto ####
    echo -n "Masquerading all other traffic..."
    for PORT in `cat /etc/init.d/ports`; do
        $IPT -t nat -A POSTROUTING -o $IFEXT -s $NTW -p tcp --dport $PORT -j MASQUERADE
        $IPT -t nat -A POSTROUTING -o $IFEXT -s $NTW -p udp --dport $PORT -j MASQUERADE
    done
    echo "Ok"

    $IPT -A INPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
    $IPT -A OUTPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
    $IPT -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT

    #### Tarefas de log ####
    echo -n "Setting log actions..."
    $IPT -A INPUT -m limit --limit 3/m --limit-burst 3 -j LOG --log-level info --log-prefix "Firewall: INPUT --"
    $IPT -A OUTPUT -m limit --limit 3/m --limit-burst 3 -j LOG --log-level info --log-prefix "Firewall: OUTPUT --"
    $IPT -A FORWARD -m limit --limit 3/m --limit-burst 3 -j LOG --log-level info --log-prefix "Firewall: FORWARD --"
    echo "Ok"

    echo ""
    echo "Iptables started sucessfully"
    echo -n ""
}

iptables_stop(){

    echo -n "Stopping Iptables firewall... "
    echo -n ""

    echo -n "Cleaning rules... "
    $IPT -F
    $IPT -F -t nat
    $IPT -F -t mangle
    $IPT -X
    $IPT -X -t nat
    $IPT -X -t mangle
    $IPT -Z
    $IPT -Z -t nat
    $IPT -Z -t mangle
    echo "Ok"

    echo -n "Setting default ACCEPT policy... "
    $IPT -P FORWARD ACCEPT
    $IPT -P INPUT ACCEPT
    $IPT -P OUTPUT ACCEPT
    echo "Ok"
    echo -n ""
    echo -n "Iptables stopped sucessfuly"
    echo -n ""

}

iptables_restart(){
    iptables_stop
    echo ""
    sleep 1
    iptables_start
}

iptables_status(){
    echo "==========   NAT Status Policies   =========="
    echo ""
    $IPT -t nat -nL
    echo ""
    echo "==========   Mangle Status Policies   =========="
    echo ""
    $IPT -t mangle -nL
    echo ""
    echo "==========   Filter Status Policies   =========="
    echo ""
    $IPT -nL
    echo ""
}

case "$1" in
    "start")
        iptables_start
        ;;
    "stop")
        iptables_up
        ;;
    "restart")
        iptables_restart
        ;;
    "status")
        iptables_status
        ;;
    * ) echo "Use: [start] [stop] [restart] [status]"
esac