#!/bin/bash
###****BEGIN IPTABLES HOSTAPD FIREWALL****###
# Ensure subnets do not match
ifconfig dns0 up 172.16.0.1 netmask 255.255.255.254
ifconfig dns1 up 172.16.2.1 netmask 255.255.255.252
ifconfig wlan0 up 10.0.0.2 netmask 255.255.255.0
# Clearing old iptables settings
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
iptables -t nat -X
iptables -t mangle -X
# Reqired iptables rule for eth0 masquerading (enable only if not using a vpn)
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
# Allowing iodine (ip-over-dns) traffic (enable only if not using a vpn)
iptables -t filter -A FORWARD -i eth0 -o dns+ -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -i dns+ -o eth0 -j ACCEPT
# Make sure "accepted" packets are allowed
iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

###****BEGIN IPTABLES WIFI FIREWALL ****###
iptables -P FORWARD DROP
# http, https
iptables --append FORWARD --in-interface wlan0 --out-interface -p tcp --dport 80 eth0 -j ACCEPT
iptables --append FORWARD --in-interface wlan0 --out-interface -p tcp --dport 443 eth0 -j ACCEPT

###****BEGIN IPTABLES SERVER FIREWALL****###
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
## Fine tune what traffic we want
# Keep state.
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Loop device.
iptables -A INPUT -i lo -j ACCEPT
# http, https
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
# smtp, submission
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 587 -j ACCEPT
# pop3, pop3s
iptables -A INPUT -p tcp --dport 110 -j ACCEPT
iptables -A INPUT -p tcp --dport 995 -j ACCEPT
# imap, imaps
iptables -A INPUT -p tcp --dport 143 -j ACCEPT
iptables -A INPUT -p tcp --dport 993 -j ACCEPT
# ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# Allow PING from remote hosts.
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
# ejabberd
#iptables -A INPUT -p tcp --dport 5222 -j ACCEPT
#iptables -A INPUT -p tcp --dport 5223 -j ACCEPT
#iptables -A INPUT -p tcp --dport 5280 -j ACCEPT
# ldap/ldaps
#iptables -A INPUT -p tcp --dport 389 -j ACCEPT
#iptables -A INPUT -p tcp --dport 636 -j ACCEPT
# ftp.
#iptables -A INPUT -p tcp --dport 20 -j ACCEPT
#iptables -A INPUT -p tcp --dport 21 -j ACCEPT

###EXTRA IPTABLES STUFF###

##REQUIRED IPTABLES RULES FOR VPN AND VPN IP MASQUERADING
#iptables --table nat --append POSTROUTING --out-interface tun0 -j MASQUERADE
#iptables -t filter -A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -t filter -A FORWARD -i tun0 -o eth0 -j ACCEPT

##REQIRED IPTABLES RULES FOR IODINE OVER VPN
#iptables -t filter -A FORWARD -i tun0 -o dns+ -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -t filter -A FORWARD -i dns+ -o tun0 -j ACCEPT