# -*- shell-script -*-
#
#  Configuration file for ferm(1).
#

table nat {
    chain ( PREROUTING INPUT OUTPUT ) { policy ACCEPT; }
    chain POSTROUTING {
	policy ACCEPT;
	proto ( tcp udp ) saddr 192.168.122.0/24 daddr ! 192.168.122.0/24 MASQUERADE to-ports 1024-65535;
	saddr 192.168.122.0/24 daddr ! 192.168.122.0/24 MASQUERADE;
	saddr 192.168.0.0/24 daddr ! 192.168.0.0/24 MASQUERADE;
	outerface tap0 MASQUERADE;
    }
}

table mangle {
    chain ( PREROUTING INPUT FORWARD OUTPUT POSTROUTING ) { policy ACCEPT ; }
}


    ##blackhole ipset hash generation/handling.
	@hook pre 'ipset -exist create blackhole hash:ip timeout 180';
	@hook flush 'ipset flush blackhole';

    ##proxies ipset hash generation/handling.
	@hook pre 'ipset -exist create proxies hash:ip,port';
	@hook pre 'ipset flush proxies ; echo "172.20.28.15,80 172.20.28.15,443 172.20.28.16,80 172.20.28.16,443" | xargs -d" " -P4 -I{} echo "add proxies {}" | ipset - 1>dev/null';
	@hook flush 'ipset flush proxies';

    ##spammers ipset hash generation/handling.
	@hook pre 'ipset -exist create spammers hash:net';
	@hook pre 'ipset flush spammers ; cat /etc/spammers | xargs -d"\n" -P4 -I{} echo "add spammers {}" | ipset - 1>/dev/null';
	@hook flush 'ipset flush spammers';


    ##trustnets ipset hash generation/handling.
	@hook pre 'ipset -exist create trustout hash:net';
	@hook pre 'ipset -exist create trustin hash:net';
	@hook pre 'ipset flush trustout ; echo "192.168.0.0/24 192.168.1.0/24 192.168.122.0/24 172.20.55.130 127.0.0.1/32" | xargs -d" " -P4 -I{} echo "add trustout {}" | ipset - 1>/dev/null';
	@hook pre 'ipset flush trustin ; echo "192.168.0.0/24 192.168.1.0/24 192.168.122.0/24 172.20.55.204 172.20.55.65 172.21.10.108 172.20.55.179" | xargs -d" " -P4 -I{} echo "add trustin {}" | ipset - 1>/dev/null';
	@hook flush 'ipset flush trustout';
	@hook flush 'ipset flush trustin';

    ##trustforwards ipset hash generation/handling.
	@hook pre 'ipset -exist create trustforward hash:net';
	@hook pre 'ipset flush trustforward ; echo "192.168.122.0/24 192.168.1.0/24 192.168.0.0/24 10.0.0.0/24 10.0.3.0/24 172.20.55.65/32 172.20.55.130/32 172.21.10.108/32 172.20.55.204/32 172.20.55.179/32" | xargs -d" " -P4 -I{} echo "add trustforward {}" | ipset - 1>/dev/null';
	@hook flush 'ipset flush trustforward';

    ##fileport/filenet ipset handling/generation.
	@hook pre 'ipset -exist create fileport bitmap:port range 0-10000';
	@hook pre 'ipset flush fileport; echo "873 2049" | xargs -d" " -P4 -I{} echo "add fileport {}" | ipset - 1>/dev/null;';
	@hook flush 'ipset flush fileport';
	@hook pre 'ipset -exist create filenet hash:net';
	@hook pre 'ipset flush filenet; echo "172.20.20.161/32 192.168.122.0/24 192.168.1.0/24" | xargs -d" " -P4 -I{} echo "add filenet {}" | ipset - 1>/dev/null;';
	@hook flush 'ipset flush filenet';

table filter {

    chain INPUT {
        policy DROP;

        # connection tracking
        mod state state INVALID DROP;
        mod state state (ESTABLISHED RELATED) ACCEPT;

        # allow local packet
        interface ( lo virbr0 tap0 wlan0 ) ACCEPT;

	proto all {
		mod set set trustin src ACCEPT;
		mod set set blackhole src DROP;
		saddr ( 172.20.22.78 172.20.22.79 ) DROP;
	}

	proto all mod set set spammers src @subchain "SPAMMERS" {
		LOG log-prefix "Blocked-IP per rule $LINE: " log-level warning;
		DROP;
	}


        # respond to ping
        proto icmp ACCEPT;

        # allow IPsec
        proto udp dport 500 ACCEPT;
	LOG log-prefix "IPSec connection event: " log-level warning proto (esp ah);
        proto (esp ah) ACCEPT;

        # enable services
        proto tcp {
		# Restrict unknown hosts to no more than 8 ssh attempts every three minutes.
		dport ssh @subchain SSH-ALL {
			mod recent name SSH {
				set NOP;
				update seconds 180 hitcount 8 @subchain SSH-BLOCKED {
					LOG log-prefix "Blocked-ssh per rule $LINE: " log-level warning;
					SET add-set blackhole src;
					DROP;
				}
			}
		LOG log-prefix "Accepted-ssh per rule $LINE: " log-level warning;
		ACCEPT;
		}
		dport ( domain http https ) ACCEPT;
		mod set set filenet src @subchain FILETRANSFER {
			mod set set fileport dst ACCEPT;
			RETURN;
		}
		sport ( ldap ldaps ) ACCEPT;
		mod set set proxies src ACCEPT;
	}

	proto udp {
		mod set set trustout dst @subchain TRUSTIN-UDP {
			dport domain ACCEPT;
			mod set set fileport src ACCEPT;
			RETURN;
		}
	}
    }
    chain OUTPUT {
        policy ACCEPT;

        # connection tracking
        #mod state state INVALID DROP;
        mod state state (ESTABLISHED RELATED) ACCEPT;

	# Trusted Private
	proto all {
		mod set set trustout src ACCEPT;
		mod set set trustin src @subchain TRUSTIN-OUTPUT {
			mod set set trustout dst ACCEPT;
			RETURN;
		}
		mod set set trustout dst ACCEPT;
	}
	proto tcp {
		LOG log-prefix "Accept-DNS out: rule $LINE: " log-level warning dport domain ;
		dport ( ssh smtp http https ldap ldaps domain ) ACCEPT;
		sport ( http https ) ACCEPT;
	}
	proto udp {
		LOG log-prefix "Accept-DNS out: rule $LINE: " log-level warning dport domain;
		dport domain ACCEPT ;
	}
    }
    chain FORWARD {
        policy DROP;

        # connection tracking
        mod state state INVALID DROP;
        mod state state (ESTABLISHED RELATED) ACCEPT;

	saddr ( 172.20.22.78 172.20.22.79 ) DROP;
	mod set set trustforward src @subchain TRUSTFORWARDS {
		mod set set trustforward dst ACCEPT;
		RETURN;
	}
	proto tcp {
		mod set set proxies src ACCEPT;
		mod set set proxies dst ACCEPT;
		RETURN;
	}
    }
}