Stuff

# definitions.
ipt=`which iptables`
mod=`which modprobe`

ext="eth1"
ext_ip="201.12.35.51"
ext_ipsec="201.12.35.53"

int="eth0"
int_net="192.168.1.0/24"
int_ip="192.168.1.1"

odin_ext="201.12.35.52"
odin_int="192.168.1.134"

sicredi_ip="201.77.95.20"
sicredi_net="172.16.0.0/12"

# sysctl.
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 0 > /proc/sys/net/ipv4/ip_forward

# modules.
$mod ip_conntrack_ftp

# policy.
$ipt -P INPUT DROP
$ipt -P FORWARD DROP
$ipt -P OUTPUT ACCEPT

# flush.
$ipt -F
$ipt -F -t nat
$ipt -Z
$ipt -Z -t nat

##############
# PREROUTING #
##############

# squid.
$ipt -t nat -A PREROUTING -i $int -s $int_net -p tcp --dport 80 -j REDIRECT --to-port 3128

# odin.
$ipt -t nat -A PREROUTING -i $odin_ext -p tcp --dport 80 -j DNAT --to-dest $odin_int 
$ipt -t nat -A PREROUTING -i $odin_ext -p tcp --dport 21 -j DNAT --to-dest $odin_int 

#########
# INPUT #
#########

# accept loopback.
$ipt -A INPUT -i lo -j ACCEPT

# basic input accept.
$ipt -A INPUT -i $ext -m state --state ESTABLISHED,RELATED -j ACCEPT

# block NEW without SYN.
$ipt -A INPUT -p tcp ! --syn -m state --state NEW -j DROP 

# accept everything from network.
$ipt -A INPUT -i $int -s $int_net -j ACCEPT

# block scans.
$ipt -A INPUT -i $ext -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
$ipt -A INPUT -i $ext -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$ipt -A INPUT -i $ext -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
$ipt -A INPUT -i $ext -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j DROP
$ipt -A INPUT -i $ext -p tcp -m tcp --tcp-flags ACK,FIN FIN -j DROP
$ipt -A INPUT -i $ext -p tcp -m tcp --tcp-flags ACK,URG URG -j DROP

# accept pptp.
$ipt -A INPUT -i $ext -p tcp --dport 1723 -j ACCEPT
$ipt -A INPUT -i $ext -p gre -j ACCEPT

# accept dns.
$ipt -A INPUT -i $ext -p udp --dport 53 -j ACCEPT

# accept ping, but limit it.
$ipt -A INPUT -i $ext -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

# accept ipsec.
$ipt -A INPUT -i $ext_ipsec -p esp -s $sicredi_ip -j ACCEPT
$ipt -A INPUT -i $ext_ipsec -p ah -s $sicredi_ip -j ACCEPT
$ipt -A INPUT -i $ext_ipsec -p udp --dport 500 -s $sicredi_ip -j ACCEPT

# drop identd quickly.
$ipt -A INPUT -p tcp -i $ext --dport 113 -j REJECT --reject-with tcp-reset

###########
# FORWARD #
###########

# forward network traffic.
$ipt -A FORWARD -i $int -o $ext -j ACCEPT
$ipt -A FORWARD -i $ext -o $int -m state --state ESTABLISHED,RELATED -j ACCEPT

# block msn to all, but not for us :).
$ipt -A FORWARD -o $ext -p tcp --dport 1863 -m iprange ! --src-range 192.168.1.120-192.168.1.123 -j DROP

# block orkut to all, but not for us :).
$ipt -A FORWARD -o $ext -p tcp -d orkut.com -m iprange ! --src-range 192.168.1.120-192.168.1.123 -j DROP

# forward ftp to odin.
$ipt -A FORWARD -p tcp --sport 21 -m state --state ESTABLISHED -d $odin_int -j ACCEPT
$ipt -A FORWARD -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -d $odin_int -j ACCEPT
$ipt -A FORWARD -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -d $odin_int -j ACCEPT

# forward http to odin.
$ipt -A FORWARD -p tcp -m state --state NEW -d $odin_int --dport 80 -j ACCEPT

# forward ipsec.
$ipt -A FORWARD -i $int -o ipsec+ -j ACCEPT
$ipt -A FORWARD -i ipsec+ -o $int -j ACCEPT

##########
# OUTPUT #
##########

###############
# POSTROUTING #
###############

# nat for network.
$ipt -A POSTROUTING -t nat -s 192.168.1.0/24 -p tcp --dport 20 -o $ext -j SNAT --to-source $ext_ip
$ipt -A POSTROUTING -t nat -s 192.168.1.0/24 -p tcp --dport 21 -o $ext -j SNAT --to-source $ext_ip
$ipt -A POSTROUTING -t nat -s 192.168.1.0/24 -p tcp --dport 25 -o $ext -j SNAT --to-source $ext_ip
$ipt -A POSTROUTING -t nat -s 192.168.1.0/24 -p tcp --dport 110 -o $ext -j SNAT --to-source $ext_ip
$ipt -A POSTROUTING -t nat -s 192.168.1.0/24 -p tcp --dport 443 -o $ext -j SNAT --to-source $ext_ip
$ipt -A POSTROUTING -t nat -s 192.168.1.0/24 -p tcp --dport 1863 -o $ext -j SNAT --to-source $ext_ip

# nat for odin.
$ipt -A POSTROUTING -t nat -s $odin_int -o $ext -j SNAT --to-source $odin_ext

# now enable ip-forward.
echo 1 > /proc/sys/net/ipv4/ip_forward

echo "Firewall Enabled."