xispiritotables

#!/bin/bash

###########################
##Netfilter Config Script##
##By xispirito -- 12/2011##
###########################


################
#Set Confs Here#
################

#Politcs

#Input
INPUTP="DROP"
#Output
OUTPUTP="DROP"
#Forward
FORWARDP="DROP"

#Modules To Load
MODULES=""

#Outputs

#Tcp Output Ports
TCPOPORTS="22 53 80 8080"
#Udp Output Ports
UDPOPORTS="22 53"

#Iputs

#Tcp Input Ports
TCPIPORTS=""
#Udp Input Ports
UDPIPORTS=""
#Source Ip's Authorized To Connect On these Ports Above
SOURCE=""

#Tcp Input Ports -- Any Source
TCPIAPORTS=""
#Udp Input Ports -- Any Source
UDPIAPORTS=""


###########
#Functions#
###########

CMODULES()
{

    echo -e "[\e[32m*\e[0m] Loading Modules"

    modprobe $MODULES

}

DMODULES()
{

    echo -e "[\e[33m*\e[0m] Unloading Modules"

    modprobe -r $MODULES

}

BASE()
{

    echo -e "[\e[32m*\e[0m] Basic Rules"

    iptables -F
    iptables -X

    iptables -P INPUT $INPUTP
    iptables -P FORWARD $FORWARDP
    iptables -P OUTPUT $OUTPUTP

    iptables -A INPUT -i lo -j ACCEPT
    iptables -A OUTPUT -o lo -j ACCEPT

}

OUTB()
{

    echo -e "[\e[32m*\e[0m] Filtering input/output"

    iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

    #TCP
    PROTO="tcp"

    for i in $PROTO
    do
        for j in $TCPOPORTS
        do
            iptables -A OUTPUT -p $i --dport $j -j ACCEPT
        done
    done

    #UDP
    PROTO="udp"

    for i in $PROTO
    do
        for j in $UDPOPORTS
        do
            iptables -A OUTPUT -p $i --dport $j -j ACCEPT
        done
    done


    echo -e "[\e[34m*\e[0m] Done"

}

OUTF()
{

    echo -e "[\e[33m*\e[0m] Filtering Input Only"

    iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    iptables -A OUTPUT -m state --state RELATED,ESTABLISHED,NEW -j ACCEPT

    echo -e "[\e[34m*\e[0m] Done"

}

INPUT()
{

    echo -e "[\e[32m*\e[0m] Set Iputs for Authorized Sources"

    #TCP
    PROTO="tcp"

    for i in $PROTO
    do
        for j in $TCPIPORTS
        do
            iptables -A INPUT -p $i --dport $j -s $SOURCE -j ACCEPT
        done
    done

    #UDP
    PROTO="udp"

    for i in $PROTO
    do
        for j in $UDPIPORTS
        do
            iptables -A INPUT -p $i --dport $j -s $SOURCE -j ACCEPT
        done
    done

}

INPUT_ALL()
{

    echo -e "[\e[32m*\e[0m] Set Iputs for Any"

    #TCP
    PROTO="tcp"

    for i in $PROTO
    do
        for j in $TCPAIPORTS
        do
            iptables -A INPUT -p $i --dport $j -j ACCEPT
        done
    done

    #UDP
    PROTO="udp"

    for i in $PROTO
    do
        for j in $UDPIAPORTS
        do
            iptables -A INPUT -p $i --dport $j -j ACCEPT
        done
    done

}


STOP()
{

    echo -e "[\e[31m*\e[0m] Cleaning Rules"

    iptables -F
    iptables -X

    iptables -A INPUT -i o -j ACCEPT
    iptables -A OUTPUT -o lo -j ACCEPT

    iptables -A INPUT -m state --state RELATED,ESTABLISHED,NEW -j ACCEPT
    iptables -A OUTPUT -m state --state RELATED,ESTABLISHED,NEW -j ACCEPT

    echo -e "[\e[34m*\e[0m] Done"
}

HELP()
{

    echo ""
    echo "Usage:"
    echo -e "\t-s or start       Start, set Inputs from authorized and all Sources, filter Output"
    echo -e "\t-t or stop        Stop, unload Modules and set all to ACCEPT"
    echo -e "\t-r or restart\t   Restart( using start rules )"
    echo -e "\t-o or out         Same as start or -s, but free Output"
    echo -e "\t-a or noin        Same as start or -s, but no Input]"
    echo -e "\t-b or onoin       Same as out or -o, but no Input ]"
    echo -e "\t-c or authin      Same as start or -s, but only Iput in ports setted from Authorizez Sources"
    echo -e "\t-d or anyin       Same as start or -s, but only Input in ports setted from any( Authorized Sources Not Allowed )"
    echo -e "\t-e or outin       Same sa out or -o, but only Input in ports setted from Authorized Sources"
    echo -e "\t-f or outany      Same as out or -o, but only Input in ports setted from any( Authorized Sources Not Allowed )"

    echo ""
}


##########
#Starting#
##########

if [ ! $1 ];
then
    BASE
    CMODULES
    INPUT
    INPUT_ALL
    OUTB
    exit
elif [ $1 == start ];
then
    BASE
    CMODULES
    INPUT
    INPUT_ALL
    OUTB
    exit
elif [ $1 == stop ];
then
    DMODULES
    STOP
    exit
elif [ $1 == restart ];
then
    BASE
    DMODULES
    CMODULES
    INPUT
    INPUT_ALL
    OUTB
    exit
elif [ $1 == out ];
then
    BASE
    OUTF
    INPUT
    exit
elif [ $1 == noin ];
then
    BASE
    CMODULES
    OUTB
    exit
elif [ $1 == onoin ];
then
    BASE
    OUTF
    exit
elif [ $1 == authin ];
then
    BASE
    CMODULES
    INPUT
    OUTB
    exit
elif [ $1 == anyin ];
then
    BASE
    CMODULES
    INPUT_ALL
    OUTB
    exit
elif [ $1 == outin ];
then
    BASE
    INPUT
    OUTF
    exit
elif [ $1 == outany ];
then
    BASE
    INPUT_ALL
    OUTF
    exit
fi

while getopts sorthabcdef ARGM;
do
    case $ARGM in
    a)
        BASE
        CMODULES
        OUTB
        exit
        ;;
    b)
        BASE
        CMODULES
        OUTF
        exit
        ;;
    s)
        BASE
        CMODULES
        INPUT
        OUTB
        exit
        ;;
    o)
        BASE
        INPUT
        OUTF
        exit
        ;;
    r)
        BASE
        DMODULES
        CMODULES
        INPUT
        OUTB
        exit
        ;;
    t)
        DMODULES
        STOP
        exit
        ;;
    c)
        BASE
        CMODULES
        INPUT
        OUTB
        exit
        ;;
    d)
        BASE
        CMODULES
        INPUT_ALL
        OUTB
        exit
        ;;
    e)
        BASE
        INPUT
        OUTF
        exit
        ;;
    f)
        BASE
        INPUT_ALL
        OUTF
        exit
        ;;
    h)
        HELP
        exit
        ;;
    ?)
        echo -e "[\e[31m*\e[0m] Bad Argument"
        HELP
        echo -e "[\e[31m*\e[0m] Done"
        exit
        ;;
    esac
done