#!/bin/sh
# original author djweis@sjdjweis.com
# reworked by jud_bishop@yahoo.com
# if you need to add another rule during runtime, change the
# -A to a -I to add it to the top of the list of rules
# if you use -A it will go at the end after the reject rule 
#
# Notes:
#   ----------------	      ----------------                            Internal LAN
#   |	INTERNET   | ---------ppp0/eth0      |                               |
#   ----------------          |  Fire Wall   |                               |
#                             |           eth1----------------192.168.1.0/26--          
#                             |           eth2----------------192.168.2.0/26--
#                             ----------------                               |
#                                                                            |
#                                                                         192.168.2.2/32 
#                                                                         Web/Mail/CVS Server on DMZ
#                  


# interface definitions
EXT_IFACE=ppp0

INT_IFACE=eth1
INT_ADDR=192.168.1.0/24

DMZ_IFACE=eth2
DMZ_ADDR=192.168.2.0/24

DMZ_SERVER=192.168.2.2
INT_WORK_STATION=192.168.1.7

# turn on ip forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# turn on antispoofing protection
for f in /proc/sys/net/ipv4/conf/*/rp_filter; 
	do echo 1 > $f; 
done

# flush all rules in the filter table
iptables -F

# flush built in rules
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD

# deny everything for now
iptables -A INPUT -j DROP
iptables -A FORWARD -j DROP
iptables -A OUTPUT -j DROP

# make the chains to define packet directions
# ext is the internet, dmz is our dmz, int is our masqed network
iptables -N int-dmz
iptables -N ext-dmz
iptables -N int-ext
iptables -N dmz-int
iptables -N dmz-ext
iptables -N ext-int

iptables -N icmp-acc

#masquerade alloutgoing connections
iptables -t nat -A POSTROUTING -o $EXT_IFACE -j MASQUERADE 

# accept related packets
iptables -A FORWARD -m state --state INVALID -j DROP
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

# DMZ_SERVER_MASQ
iptables -t nat -A PREROUTING -p tcp --in-interface $EXT_IFACE --dport smtp -j DNAT --to $DMZ_SERVER:25
iptables -t nat -A PREROUTING -p tcp --in-interface $EXT_IFACE --dport http -j DNAT --to $DMZ_SERVER:80
iptables -t nat -A PREROUTING -p tcp --in-interface $EXT_IFACE --dport https -j DNAT --to $DMZ_SERVER:443
iptables -t nat -A PREROUTING -p tcp --in-interface $EXT_IFACE --dport 2401 -j DNAT --to $DMZ_SERVER:2401  #cvs
iptables -t nat -A PREROUTING -p udp --in-interface $EXT_IFACE --dport 2401 -j DNAT --to $DMZ_SERVER:2401  #cvs
iptables -t nat -A PREROUTING -p tcp --in-interface $EXT_IFACE --dport 2222 -j DNAT --to $DMZ_SERVER:22
iptables -t nat -A PREROUTING -p tcp --in-interface $EXT_IFACE --dport 2212 -j DNAT --to $INT_WORK_STATION:22
# to allow the above to work you need something like
# iptables -A ext-dmz -p tcp --dport smtp -d $DMZ_SERVER -j ACCEPT

# set which addresses jump to which chains
iptables -A FORWARD -s $INT_ADDR -o $DMZ_IFACE -j int-dmz
iptables -A FORWARD -s $INT_ADDR -o $EXT_IFACE -j int-ext

iptables -A FORWARD -s $DMZ_ADDR -i $DMZ_IFACE -o $EXT_IFACE -j dmz-ext
iptables -A FORWARD -s $DMZ_ADDR -i $DMZ_IFACE -o $INT_IFACE -j dmz-int

iptables -A FORWARD -o $DMZ_IFACE -j ext-dmz
iptables -A FORWARD -o $INT_IFACE -j ext-int

# drop anything that doesn't fit these
iptables -A FORWARD -j LOG --log-prefix "chain-jump "
iptables -A FORWARD -j DROP

# icmp acceptance
iptables -A icmp-acc -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A icmp-acc -p icmp --icmp-type source-quench -j ACCEPT
iptables -A icmp-acc -p icmp --icmp-type time-exceeded -j ACCEPT
iptables -A icmp-acc -p icmp --icmp-type echo-request -j ACCEPT
iptables -A icmp-acc -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A icmp-acc -j LOG --log-prefix "icmp-acc "
iptables -A icmp-acc -j DROP

# from internal to dmz
iptables -A int-dmz -p tcp --dport smtp -j ACCEPT
iptables -A int-dmz -p tcp --dport pop3 -j ACCEPT
iptables -A int-dmz -p udp --dport domain -j ACCEPT
iptables -A int-dmz -p tcp --dport domain -j ACCEPT
iptables -A int-dmz -p tcp --dport www -j ACCEPT
iptables -A int-dmz -p tcp --dport https -j ACCEPT
iptables -A int-dmz -p tcp --dport ssh -j ACCEPT
iptables -A int-dmz -p tcp --dport telnet -j ACCEPT
iptables -A int-dmz -p tcp --dport auth -j ACCEPT
iptables -A int-dmz -p tcp --dport ftp -j ACCEPT
iptables -A int-dmz -p tcp --dport 1521 -j ACCEPT
iptables -A int-dmz -p tcp --dport 2401 -j ACCEPT #cvs
iptables -A int-dmz -p udp --dport 2401 -j ACCEPT #cvs
iptables -A int-dmz -p icmp -j icmp-acc
iptables -A int-dmz -j LOG --log-prefix "int-dmz "
iptables -A int-dmz -j DROP

# from external to dmz
iptables -A ext-dmz -p tcp --dport smtp -j ACCEPT
iptables -A ext-dmz -p udp --dport domain -j ACCEPT
iptables -A ext-dmz -p tcp --dport domain -j ACCEPT
iptables -A ext-dmz -p udp --sport domain -j ACCEPT
iptables -A ext-dmz -p tcp --sport domain -j ACCEPT
iptables -A ext-dmz -p tcp --dport www -j ACCEPT
iptables -A ext-dmz -p tcp --dport https -j ACCEPT
iptables -A ext-dmz -p tcp --dport ssh -j ACCEPT
iptables -A ext-dmz -p tcp --dport 2401 -j ACCEPT #cvs
iptables -A ext-dmz -p udp --dport 2401 -j ACCEPT #cvs
#iptables -A ext-dmz -p tcp -d $DMZ_SERVER --dport ftp -j ACCEPT
iptables -A ext-dmz -p icmp -j icmp-acc
iptables -A ext-dmz -j LOG --log-prefix "ext-dmz "
iptables -A ext-dmz -j DROP


# from internal to external
iptables -A int-ext -j ACCEPT
#iptables -t nat -A POSTROUTING -o $EXT_IFACE -j SNAT --to $MASQ_SERVER
#iptables -A int-ext -p tcp -j MASQ
#iptables -A int-ext -p udp -j MASQ
#iptables -A int-ext -p icmp -j MASQ
#ipchains -A int-ext -p tcp --dport www -j MASQ
#ipchains -A int-ext -p tcp --dport ssh -j MASQ
#ipchains -A int-ext -p udp --dport 33434:33500 -j MASQ
#ipchains -A int-ext -p tcp --dport ftp -j MASQ
#ipchains -A int-ext -p icmp --icmp-type ping -j MASQ
#ipchains -A int-ext -j REJECT -l

# from dmz to internal
# iptables -A dmz-int -p tcp ! --syn --sport smtp -j ACCEPT
iptables -A dmz-int -p tcp --dport smtp -j ACCEPT
iptables -A dmz-int -m state --state ESTABLISHED,RELATED -j ACCEPT 
#take only already established connections o
#iptables -A dmz-int -p tcp --sport smtp -j ACCEPT
#iptables -A dmz-int -p udp --sport domain -j ACCEPT
#iptables -A dmz-int -p tcp ! --syn --sport domain -j ACCEPT
#iptables -A dmz-int -p tcp ! --syn --sport www -j ACCEPT
#iptables -A dmz-int -p tcp ! --syn --sport ssh -j ACCEPT
#iptables -A dmz-int -p tcp -d 192.168.1.34 --dport smtp -j ACCEPT
#iptables -A dmz-int -p icmp -j icmp-acc
iptables -A dmz-int -j LOG --log-prefix "dmz-int "
iptables -A dmz-int -j DROP

# from dmz to external
iptables -A dmz-ext -p tcp --dport smtp -j ACCEPT
iptables -A dmz-ext -p tcp --sport smtp -j ACCEPT
iptables -A dmz-ext -p udp --dport domain -j ACCEPT
iptables -A dmz-ext -p tcp --dport domain -j ACCEPT
iptables -A dmz-ext -p tcp --dport www -j ACCEPT
iptables -A dmz-ext -p tcp --dport https -j ACCEPT
iptables -A dmz-ext -p tcp --dport ssh -j ACCEPT
#iptables -A dmz-ext -p tcp --dport ftp -j ACCEPT
#iptables -A dmz-ext -p tcp --dport whois -j ACCEPT
#iptables -A dmz-ext -p tcp --dport telnet -j ACCEPT
iptables -A dmz-ext -p udp --dport ntp -j ACCEPT
iptables -A dmz-ext -p icmp -j icmp-acc
iptables -A dmz-ext -j LOG --log-prefix "dmz-ext "
iptables -A dmz-ext -j DROP

# from external to internal
iptables -A ext-int -p tcp --dport ssh -j ACCEPT
iptables -A ext-int -m state --state ESTABLISHED,RELATED -j ACCEPT 
#iptables -A ext-int -p tcp --dport smtp -d $MAIL_SERVER_INTERNAL -j ACCEPT
#iptables -A ext-int -p tcp --dport http -d $MAIL_SERVER_INTERNAL -j ACCEPT
#iptables -A ext-int -p tcp --dport https -d $MAIL_SERVER_INTERNAL -j ACCEPT
iptables -A ext-int -j LOG --log-prefix "ext-int "
iptables -A ext-int -j REJECT

# rules for this firewall
iptables -N ext-if
iptables -N dmz-if
iptables -N int-if

# set up the jumps to each chain
iptables -A INPUT -i $EXT_IFACE -j ext-if
iptables -A INPUT -i $DMZ_IFACE -j dmz-if
iptables -A INPUT -i $INT_IFACE -j int-if

# external iface
iptables -A ext-if -p icmp -j icmp-acc
iptables -A ext-if -j ACCEPT
#ipchains -A ext-if -i ! ppp0 -j DENY -l
#ipchains -A ext-if -p TCP --dport 61000:65095 -j ACCEPT
#ipchains -A ext-if -p UDP --dport 61000:65095 -j ACCEPT
#ipchains -A ext-if -p ICMP --icmp-type pong -j ACCEPT
#ipchains -A ext-if -j icmp-acc
#ipchains -A ext-if -j DENY

# dmz iface
iptables -A ext-if -p icmp -j icmp-acc
iptables -A dmz-if -j ACCEPT

# internal iface
iptables -A int-if -p tcp --dport ssh -j ACCEPT
iptables -A int-if -p ICMP --icmp-type ping -j ACCEPT
iptables -A int-if -p ICMP --icmp-type pong -j ACCEPT
iptables -A int-if -j icmp-acc
iptables -A int-if -j DROP


# remove the complete blocks
iptables -D INPUT 1
iptables -D FORWARD 1
iptables -D OUTPUT 1