#!/bin/bash

#toutes les connexion ayant pour source ou destination même le retour (INPUT et OUTPUT) seront traité en fin de ce script

#Entre VLAN1 et VLAN2

iptables -A FORWARD -i $VLAN1 -o $VLAN2 -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $VLAN2 -o $VLAN1 -p tcp --sport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i $VLAN1 -o $VLAN2 -p udp  --dport 67:68 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $VLAN2 -o $VLAN1 -p udp  --sport 67:68 -m state --state ESTABLISHED,RELATED -j ACCEPT


iptables -A FORWARD -i $VLAN1 -o $VLAN2 -p tcp -m multiport --dport 111,646 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $VLAN2 -o $VLAN1 -p tcp -m multiport --sport 111,646 -m state --state ESTABLISHED,RELATED -j ACCEPT


iptables -A FORWARD -i $VLAN1 -o $VLAN2 -p tcp  --dport 2049 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $VLAN2 -o $VLAN1 -p tcp  --sport 2049 -m state --state ESTABLISHED,RELATED -j ACCEPT


iptables -A FORWARD -i $VLAN1 -o $VLAN2 -p tcp -m multiport --dport 199,445 -m state --state NEW,ESTABLISHED,RELATED -jACCEPT
iptables -A FORWARD -i $VLAN2 -o $VLAN1 -p tcp -m multiport --dport 199,445 -m state --state NEW,ESTABLISHED,RELATED -jACCEPT

iptables -A FORWARD -i $VLAN1 -o $VLAN2 -p icmp -m state --state NEW,ESTABLISHED,RELATED -jACCEPT
iptables -A FORWARD -i $VLAN2 -o $VLAN1 -p icmp -m state --state NEW,ESTABLISHED,RELATED -jACCEPT

#Entre VLAN1 et VLAN3(Internet)
#Héhé grace au multiport je m'évite 4 lignes de regles en plus, le protocole etant le meme et l'etant de connexion aussi le meme autant tout mettre sur la meme ligne.

iptables -A FORWARD -i $VLAN1 -o $VLAN3 -p tcp -m multiport --dport 20,21,80,443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $VLAN3 -o $VLAN1 -p tcp -m multiport --dport 20,21,80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i $VLAN1 -o $VLAN3 -p icmp -m state --state NEW,ESTABLISHED,RELATED -jACCEPT
iptables -A FORWARD -i $VLAN3 -o $VLAN1 -p icmp -m state --state NEW,ESTABLISHED,RELATED -jACCEPT


#Entre VLAN1 et DMZ
#De meme le multiport m'évites une fois de plus la creation de 2 lignes supplémentaires.

iptables -A FORWARD -i $VLAN1 -o $DMZ -p tcp -m multiport --dport 22,80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $DMZ -o $VLAN1 -p tcp -m multiport --sport 22,80 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i $VLAN1 -o $DMZ -p icmp -m state --state NEW,ESTABLISHED,RELATED -jACCEPT
iptables -A FORWARD -i $DMZ -o $VLAN1 -p icmp -m state --state ESTABLISHED,RELATED -jACCEPT

#Entre VLAN2 et VLAN3

iptables -A FORWARD -i $VLAN2 -o $VLAN3 -p tcp -m multiport --dport 20,21,80,443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $VLAN3 -o $VLAN2 -p tcp -m multiport --dport 20,21,80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i $VLAN2 -o $VLAN3 -p icmp -m state --state NEW,ESTABLISHED,RELATED -jACCEPT
iptables -A FORWARD -i $VLAN3 -o $VLAN2 -p icmp -m state --state ESTABLISHED,RELATED -jACCEPT

#Entre VLAN2 et VDMZ


iptables -A FORWARD -i $VLAN2 -o $DMZ -p tcp  --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $DMZ -o $VLAN2 -p tcp  --sport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i $VLAN2 -o $DMZ -p udp  --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $DMZ -o $VLAN2 -p udp  --sport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i $VLAN2 -o $DMZ -p icmp -m state --state NEW,ESTABLISHED,RELATED -jACCEPT
iptables -A FORWARD -i $DMZ -o $VLAN2 -p icmp -m state --state ESTABLISHED,RELATED -jACCEPT

#Entre VLAN3 et DMZ

iptables -A FORWARD -i $VLAN3 -o $DMZ -p tcp -m multiport --dport 80,443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $DMZ -o $VLAN3 -p tcp -m multiport --sport 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i $VLAN3 -o $DMZ -p icmp -m state --state ESTABLISHED,RELATED -jACCEPT
iptables -A FORWARD -i $DMZ -o $VLAN3 -p icmp -m state --state NEW,ESTABLISHED,RELATED -jACCEPT

#------------------------------------

#Et mainttenant on passe au fameux INPUT et OUTPUT pour le routeur lui même !!

#------------------------------------

#Entre VLAN1 et ROUTEUR

iptables -A INPUT -i $VLAN1 -p tcp -m multiport  --dport 22 -j ACCEPT
iptables -A OUTPUT -o $VLAN1 -p tcp -m multiport --sport 22 -j ACCEPT

iptables -A INPUT -i $VLAN1 -p udp -m multiport  --dport 53,67,68 -j ACCEPT
iptables -A OUTPUT -o $VLAN1 -p udp -m multiport --sport 53,67,68 -j ACCEPT

iptables -A INPUT -i $VLAN1 -p icmp -j ACCEPT
iptables -A OUTPUT -o $VLAN1 -p icmp -j ACCEPT

#Entre VLAN2 et ROUTEUR

iptables -A INPUT -i $VLAN2 -p udp   --dport 53 -j ACCEPT
iptables -A OUTPUT -o $VLAN2 -p udp  --sport 53 -j ACCEPT

iptables -A INPUT -i $VLAN2 -p icmp -j ACCEPT
iptables -A OUTPUT -o $VLAN2 -p icmp -j ACCEPT

#Entre VLAN3 et ROUTEUR

iptables -A OUTPUT -o $VLAN3 -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i $VLAN3 -p tcp --sport 80 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A OUTPUT -o $VLAN3 -p udp --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i $VLAN3 -p udp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -i $VLAN3 -p icmp -j ACCEPT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o $VLAN3 -p icmp -j ACCEPT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

#Entre DMZ et ROUTEUR

iptables -A OUTPUT -o $DMZ -p udp --dport 53  -j ACCEPT
iptables -A INPUT -i $DMZ -p udp --sport 53  -j ACCEPT