#!/bin/bash
#
EXT="my.domain.name"
INT="my.hostname"
LOCAL_ALIASES="my.domain.name my.hostname localhost"
TCP_SERVICES="http https ssh domain 236 237 smtp 7777 3979 3128 10000 4242 16697 mysql 1022 2727 3389"
UDP_SERVICES="openvpn 1195 3979"
ALL="0/0"
OPENVPN_DEVICES="tun0 tap0"
OPENVPN_NETWORKS="10.1.0.0/24 10.1.1.0/24"

iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -t nat -F PREROUTING
iptables -t nat -F POSTROUTING

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

# Allow localhost callbacks
#for alias1 in $LOCAL_ALIASES
#do
#	for alias2 in $LOCAL_ALIASES
#	do
#		iptables -A INPUT -s $alias1 -d $alias2 -j ACCEPT
#	done
#done

# Established connections remain
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

# Proxy intercept (Squid: 3128; Privoxy: 8080)
for device in $OPENVPN_DEVICES
do
	iptables -t nat -A PREROUTING -i $device -p tcp --dport http -j REDIRECT --to-port 3128
done

# IPv4 Forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

for network in $OPENVPN_NETWORKS
do
	iptables -t nat -A POSTROUTING -s $network -o eth0 -j MASQUERADE
done

# Allow internal VPN requests
for device in $OPENVPN_DEVICES
do
	iptables -A INPUT -i $device -j ACCEPT
	iptables -A FORWARD -i $device -j ACCEPT
done

# Easy incoming server connections
for tcp_service in $TCP_SERVICES
do
	iptables -A INPUT -p tcp -d $EXT --dport $tcp_service -s $ALL -m state --state NEW -j ACCEPT
done

for udp_service in $UDP_SERVICES
do
	iptables -A INPUT -p udp -d $EXT --dport $udp_service -s $ALL -m state --state NEW -j ACCEPT
done

# Output rules
#for tcp_service in $TCP_SERV
#do
#iptables -A OUTPUT -o eth0 -p tcp -d $ALL --dport $FREE_PORTS -s $EXT --sport $tcp_service -m state --state ESTABLISHED -j ACCEPT
#done

#for udp_service in $UDP_SERV
#do
#iptables -A OUTPUT -o eth0 -p udp -d $ALL --dport $FREE_PORTS -s $EXT --sport $udp_service -m state --state ESTABLISHED -j ACCEPT
#done

#iptables -A OUTPUT -o eth0 -d $VPN_NET -s $INT -j ACCEPT
#iptables -A OUTPUT -p udp -s $INT --sport 53 -d $VPN_NET --dport 53 -m state --state ESTABLISHED -j ACCEPT

# List rules
iptables -L
iptables -L -t nat