#!/bin/sh
# /etc/rc.d/rc.firewall
# iptables rules for funky setup - vmware machines + checkpoint
# Turn off ip forwarding until all rules are applied
echo "0" > /proc/sys/net/ipv4/ip_forward
# Flush + zero everything first
iptables -F
iptables -t nat -F
iptables -Z
# Declare variables
IPT=/usr/sbin/iptables
EXTIF=eth0 # External interface (internet)
WANIF=eth1 # WAN interface
#LAN_IP="192.168.0.2"
#LAN_IP_RANGE="192.168.0.0/16"
#LAN_IFACE="eth1"
# Set default chain policies
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD DROP
# All traffic leaving external interface should be SNAT'ed
$IPT -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
# Allow all traffic on loopback interface
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
# INPUT Rules
# Allow packets belonging to ESTABLISHED connections and those RELATED
# to established connections
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow ssh from anywhere (you may want to tweak this)
$IPT -A INPUT -p tcp --dport 22 --syn -m state --state NEW -j ACCEPT
# ** this was your old rule - not sure where this 10.x.x.x network is,
# as it's not in your routing tables -- obfuscated external ip??
#$IPT -A INPUT -p tcp -s 10.116.5.0/24 --dport 22 -j ACCEPT
# I don't think you need this - the default will be to DROP these packets
# anyway, as they won't be EST or REL
#$IPT -A INPUT -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
# Again, I don't see the need for this unless you're just curious
#$IPT -A INPUT -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
# Log what's left prior to it hitting the chain policy (DROP)
# You'll probably want to comment this out once you get a working ruleset,
# as it fills the logs quite quickly :)
$IPT -A INPUT -j LOG
# DNAT rules
# NAT for mtechdemo
$IPT -t nat -A PREROUTING -i $EXTIF -p tcp --dport 2200 -j DNAT --to-destination 192.168.13.128:22
$IPT -t nat -A PREROUTING -i $EXTIF -p tcp --dport 25673 -j DNAT --to-destination 192.168.13.128:25673
$IPT -t nat -A PREROUTING -i $EXTIF -p tcp --dport 23025 -j DNAT --to-destination 192.168.13.128:23025
# NAT for Checkpoint VPN-1 router
$IPT -t nat -A PREROUTING -i $EXTIF -s 146.109.240.0/24 -j DNAT --to 192.168.16.2
$IPT -t nat -A PREROUTING -i $EXTIF -s 84.74.95.0/24 -j DNAT --to 192.168.16.2
$IPT -t nat -A PREROUTING -i $EXTIF -s 150.101.122.0/24 -j DNAT --to 192.168.16.2
# FORWARD Rules
# Allow all establish/related
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow those PREROUTED packets from earlier
$IPT -A FORWARD -i $EXTIF -d 192.168.13.128 --dort 22 -j ACCEPT
$IPT -A FORWARD -i $EXTIF -d 192.168.13.128 --dport 25673 -j ACCEPT
$IPT -A FORWARD -i $EXTIF -d 192.168.13.128 --dport 23025 -j ACCEPT
$IPT -A FORWARD -i $EXTIF -s 146.109.240.0/24 -d 192.168.16.2 -j ACCEPT
$IPT -A FORWARD -i $EXTIF -s 84.74.95.0/24 -d 192.168.16.2 -j ACCEPT
$IPT -A FORWARD -i $EXTIF -s 150.101.122.0/24 -d 192.168.16.2 -j ACCEPT
# Allow outgoing DNS requests
$IPT -A FORWARD -o $EXTIF --dport 53 -j ACCEPT
$IPT -A FORWARD -o $WANIF --dport 53 -j ACCEPT
# Allow ftp, ssh, whois, pop3, usenet, imap, rsync, s-pop3, AIM, Yahoo IM,
# jabber,jabber-s, irc 6667 & 7000
$IPT -A FORWARD -o $EXTIF -p tcp --sport 1024:65535 -m multiport \
--dports 21,22,43,110,119,143,873,995,5190,5050,5222,5223,6667,7000 \
--syn -m state --state NEW -j ACCEPT
# Allow smtp (25 & 587), http on 80, 81, 88, 8080, and 8088, https
$IPT -A FORWARD -o $EXTIF -p tcp --sport 1024:65535 -m multiport \
--dports 25,587,80,81,88,8080,8088,443 -m state --state NEW --syn \
-j ACCEPT
# Turn packet forwarding back on now
echo "1" > /proc/sys/net/ipv4/ip_forward
102,1 Command