natfire

geo@time:~/ticpu.mech$ cat /etc/init.d/natfire
#!/bin/sh

start() {
# Enable forwarding
  echo 1 > /proc/sys/net/ipv4/ip_forward
  echo 1 > /proc/sys/net/ipv4/tcp_syncookies

# Reset iptables
  # Empty the chains
  iptables -t filter -F
  iptables -t nat    -F
  # Remove user added chains
  iptables -t filter -X
  iptables -t nat    -X

  # Default to deny all inbound
  iptables -P INPUT     DROP    # To your computer
  iptables -P FORWARD   ACCEPT  # From and To your network
  iptables -P OUTPUT    ACCEPT  # From your computer

# Enable connection tracking for
# active FTP and IRC/DCC
  # Load the modules
  modprobe ip_nat_ftp
  modprobe ip_nat_irc
  # Allow ports in relation with the modules
  iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH!
  iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Share the whole thing
  iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o ppp0 -j MASQUERADE

# Allow some pings to get thru
  iptables -A INPUT -p icmp --icmp-type echo-request \
  -m limit --limit 6/minute -j ACCEPT

# Port forwarding
  # 10.10.10.2 [whatever]
  iptables -t nat -A PREROUTING -i ppp0 -m multiport \
  -p tcp --dport 21,3389 -j DNAT --to 10.10.10.2
  # UDP example
  #iptables -t nat -A PREROUTING -i ppp0 -m multiport \
  #-p udp --dport 53,14000:14500 -j DNAT --to 10.10.10.2
  # RDP #2 example
  #iptables -t nat -A PREROUTING -i ppp0 \
  #-p tcp --dport 3389 -j DNAT --to 10.10.10.3:3390
}

stop() {
# Disable forwarding
  echo 0 > /proc/sys/net/ipv4/ip_forward

# Disable connection tracking
  rmmod ip_nat_ftp
  rmmod ip_nat_irc

# Reset iptables
  # Empty the chains
  iptables -t filter -F
  iptables -t nat    -F
  # Remove user added chains
  iptables -t filter -X
  iptables -t nat    -X

  # Default to deny all
  iptables -P INPUT     DROP    # To your computer
  iptables -P FORWARD   DROP    # From and To your network
  iptables -P OUTPUT    DROP    # From your computer

  # Always allow SSH, VNC...
  iptables -A INPUT -p tcp -m multiport \
  --dport 22,5901 -j ACCEPT
  iptables -A OUTPUT -p tcp -m multiport \
  --sport 22,5901 -j ACCEPT
  # ...and DNS
  iptables -A INPUT -p udp \
  --dport 53 -j ACCEPT
  iptables -A OUTPUT -p udp \
  --sport 53 -j ACCEPT
}

# See how we were called.
case "$1" in
  start)
        start
        RETVAL=$?
        ;;
  stop)
        stop
        RETVAL=$?
        ;;
  restart)
        stop
        start
        RETVAL=$?
        ;;
  force-reload)
        stop
        start
        RETVAL=$?
        ;;
  *)
        echo "Usage: firestarter {start|stop|restart|force-reload|lock|status}"
        exit 1
esac

exit 0
geo@time:~/ticpu.mech$