#!/bin/sh
#GET THE EXTERNAL IP
EXTIP="`/sbin/ifconfig eth0 | grep 'inet addr' | awk '{print $2}' | sed -e 's/.*://'`"
EXTNIC="eth0"
INTNIC="eth1"
TCATIP="192.168.10.101" #tomcat ip
# IPTables Location - adjust if needed
IPT="/sbin/iptables"
echo "Loading required stateful/NAT kernel modules..."
/sbin/depmod -a
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
/sbin/modprobe iptable_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc
/sbin/modprobe ipt_MASQUERADE # masquerade target module
echo " Enabling IP forwarding..."
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
echo " External interface: $EXTNIC"
echo " External interface IP address is: $EXTIP"
echo " Loading proxy server rules..."
###############################################################################
#
# Flush Any Existing Rules or Chains
#
echo "*************************"
echo "Flushing Tables ..."
# Reset Default Policies
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT
# Flush all rules
$IPT -F
$IPT -t nat -F
$IPT -t mangle -F
# Erase all non-default chains
$IPT -X
$IPT -t nat -X
$IPT -t mangle -X
if [ "$1" = "stop" ]
then
echo "Firewall completely flushed! Now running with no firewall."
exit 0
fi
## Set Policies ##
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP
# allow all packets on the loopback interface
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
#Allow established connections:
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#Drop packets with an unknown state like tcp ack with no connection
$IPT -A FORWARD -m state --state INVALID -j DROP
echo "Allow SSH "
#allow ssh to firewall box from internal lan
$IPT -A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT
echo "Allow all out connections"
# FWD: Allow all connections OUT and only existing and related ones IN
$IPT -A FORWARD -i $EXTNIC -o $INTNIC -m state --state ESTABLISHED,RELATED -j ACCEPT #direct related traffic from the outside in
$IPT -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT # Allow packets to the firewall itself
$IPT -A FORWARD -i $INTNIC -o $EXTNIC -j ACCEPT #forward traffic from the inside out
$IPT -A OUTPUT -m state --state NEW -j ACCEPT
echo "Masquerade the parade"
# Enabling SNAT (MASQUERADE) functionality on $EXTNIC --- POST ROUTING
$IPT -t nat -A POSTROUTING -o $EXTNIC -j MASQUERADE
echo "Postrouting, change internal ip to external ip"
#http://www.linux.com/article.pl?sid=04/11/23/2022252
# Stuff the packet with external ip to go out instead of having the lan ip
$IPT -t nat -A POSTROUTING -o $EXTNIC -s 192.168.0.0/16 -j SNAT --to $EXTIP #207.166.198.1
############## ASTERISK ###########################################################################
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #keep an already established state
$IPT -A INPUT -p udp --dport 5060 -j ACCEPT #need this or the audio is choppy
#$IPT -A FORWARD -o eth0 -p udp --dport 5060 -j ACCEPT #not needed so commented out
#$IPT -t nat -A POSTROUTING -o eth0 -j SNAT --to-source $EXTIP #not needed so commented out
$IPT -A INPUT -p udp -m udp --dport 5004:5082 -j ACCEPT # SIP on UDP port 5060. Other SIP servers may need TCP port 5060 as well
#$IPT -A INPUT -p udp -m udp --dport 4569 -j ACCEPT # IAX2- the IAX protocol
#$IPT -A INPUT -p udp -m udp --dport 5036 -j ACCEPT # IAX - most have switched to IAX v2, or ought to
$IPT -A INPUT -p udp -m udp --dport 10000:15000 -j ACCEPT # RTP - the media stream, NEEDED FOR AUDIO
#$IPT -A INPUT -p udp -m udp --dport 2727 -j ACCEPT # MGCP - if you use media gateway control protocol
$IPT -A INPUT -i eth1 -p tcp --dport 5038 -j ACCEPT # allow the asterisk call manager to connect
#$IPT -A INPUT -i eth1 -p udp --dport 5038 -j ACCEPT #need this or the audio is choppy
#$IPT -A INPUT -i ech1 -p tcp --dport 5038 -j ACCEPT #need this or the audio is choppy
################### LIME WIRE ####################################
#$IPT -A INPUT -p tcp --destination-port 6346 -j ACCEPT
$IPT -A FORWARD -p tcp -i $EXTNIC --dport 6346 -o $INTNIC -j ACCEPT
$IPT -A FORWARD -p udp -i $EXTNIC --dport 6346 -o $INTNIC -j ACCEPT
echo "Web server that goes meow"
# Let the outside world reach the internal lan for a web server
#$IPT -t nat -A PREROUTING --dst $EXTIP -p tcp --dport 8080 -j DNAT --to-destination $TCATIP #to tomcate from web user
#$IPT -t nat -A POSTROUTING -p tcp --dst $TCATIP --dport 8080 -j SNAT --to-source 192.168.10.20 #returned to web user from tomcat
#$IPT -t nat -A OUTPUT --dst $EXTIP -p tcp --dport 8080 -j DNAT --to-destination $TCATIP #firewall tries to connect to tomcat
# Allow forwarding of incoming Port 8080 traffic to DMZ Web server
iptables -A FORWARD -i $EXTNIC -o $INTNIC -d 192.168.10.101 -p tcp --dport 8080 -j ACCEPT
# Enable DNAT port translation to DMZ Web server
iptables -t nat -A PREROUTING -i $EXTNIC -d $EXTIP -p tcp --dport 8080 -j DNAT --to 192.168.10.101
# drop all other packets
echo " applying default drop policies"
echo ""
$IPT -A INPUT -i eth0 -p tcp --dport 0:65535 -j DROP
$IPT -A INPUT -i eth0 -p udp --dport 0:65535 -j DROP
# Catch all rule, all other forwarding is denied and logged.
#$IPT -A FORWARD -j drop-and-log-it #doesn't work as is
echo "All done"