Miscellany

depend() {
        before net
        need logger
}


start() {
        ebegin "Starting Firewall"
        #Needed Variables

        INTERFACEINT="ppp0"
        INTERFACELAN="eth0"
        IPSTOGATEWAY="192.168.0.25"

        #protection against syn-flooding

        echo 1 > /proc/sys/net/ipv4/tcp_syncookies
        for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
            echo 1 > $f
        done

        #in case this hasnt been done by some distrosettings...

        echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
        echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
        echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
        echo "1" > /proc/sys/net/ipv4/ip_forward


        #flush the rulez...

        iptables -F
        iptables -X
        iptables -Z

        #defaultpolicies (not realy needed :) )

        iptables -P INPUT DROP
        iptables -P OUTPUT DROP
        iptables -P FORWARD DROP

        iptables -N logncrunch


        #-----------POSTROUTING----------
        iptables -t nat -A PREROUTING -p udp --dport 28004 -j DNAT --to-destination 192.168.0.25:28004  #q4

        iptables -t nat -A POSTROUTING -o ppp0 -s $IPSTOGATEWAY/255.255.255.0 -j MASQUERADE

        #-----------INPUT-----------
        #sort the incoming stuff into the chains
        iptables -A INPUT -i lo -j ACCEPT #loopback will be allowed
        iptables -A INPUT -i $INTERFACEINT -m state --state ESTABLISHED,RELATED -j ACCEPT
        iptables -A INPUT -i $INTERFACELAN -m state --state ESTABLISHED,RELATED -j ACCEPT
        #services to the internet
        iptables -A INPUT -i $INTERFACEINT -p TCP --destination-port 42042 -j ACCEPT #ssh
        iptables -A INPUT -i $INTERFACEINT -p TCP --destination-port 8010 -s 84.173.6.77 -j ACCEPT
        iptables -A INPUT -i $INTERFACEINT -p UDP --destination-port 3000 -s 83.236.220.30 -j ACCEPT #ts3server
        #iptables -A INPUT -i $INTERFACEINT -p TCP --destination-port 5900 -j ACCEPT #vnc
        #iptables -A INPUT -i $INTERFACEINT -p TCP --destination-port 8010 -s 134.155.26.73 -j ACCEPT #psi file trans
        iptables -A INPUT -i $INTERFACEINT -p TCP --destination-port 8010 -s 82.193.229.150 -j ACCEPT #psi file trans

        #services to the lan
        iptables -A INPUT -i $INTERFACELAN -p TCP --destination-port 42042      -j ACCEPT #ssh
        iptables -A INPUT -i $INTERFACELAN -p TCP --destination-port 1235       -j ACCEPT #netcat

        iptables -A INPUT -j logncrunch

        #-----------FORWARD------------------

        iptables -A FORWARD -m state --state INVALID -j logncrunch
        iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
        iptables -A FORWARD -i $INTERFACELAN -o $INTERFACEINT -s $IPSTOGATEWAY -j ACCEPT
        iptables -A FORWARD -i $INTERFACEINT -o $INTERFACELAN -d $IPSTOGATEWAY -j ACCEPT

        iptables -A FORWARD -j logncrunch

        #-------------OUTPUT---------

        iptables -A OUTPUT -o lo -j ACCEPT #loopback will be allowed
        iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
        iptables -A OUTPUT -j logncrunch

        #--------logncrunch----------------

        iptables -A logncrunch -m limit --limit 1/minute -j LOG
        iptables -A logncrunch -j DROP

        eend 0;
}

restart() {
        svc_stop
        svc_start
        eend 0;
}

stop() {
        #flush the rulez...

        iptables -F
        iptables -X
        iptables -Z

        #defaultpolicies (not realy needed :) )

        iptables -P INPUT DROP
        iptables -P OUTPUT DROP
        iptables -P FORWARD DROP

        eend 0;
}

opts="${opts} strip"

strip() {
        #open ourselves up
        iptables -F
        iptables -X
        iptables -Z

        iptables -P INPUT ACCEPT
        iptables -P OUTPUT ACCEPT
        iptables -P FORWARD DROP
        eend 0;
}