#!/bin/bash
#
# script comentado em detalhes


# Local para o executavel do IPTables
IPT=`which iptables`;

# Interface da rede INTERNA
IF_INTERNA="eth0";

# Interface da rede EXTERNA
IF_EXTERNA="eth1";

# Definição da rede interna
REDE_INTERNA="192.168.1.0/24"


fw_start()
{
  #ativa o roteamento dinamico
  echo 1 > /proc/sys/net/ipv4/ip_forward
  echo 1 > /proc/sys/net/ipv4/ip_dynaddr


  # ================ POLITICAS PADRAO ===================
  $IPT -t filter -P INPUT       DROP
  $IPT -t filter -P FORWARD     DROP
  $IPT -t filter -P OUTPUT      ACCEPT
  $IPT -t nat    -P PREROUTING  ACCEPT
  $IPT -t nat    -P POSTROUTING ACCEPT
  $IPT -t nat    -P OUTPUT      ACCEPT
  $IPT -t mangle -P PREROUTING  ACCEPT
  $IPT -t mangle -P POSTROUTING ACCEPT
  $IPT -t mangle -P OUTPUT      ACCEPT
  $IPT -t mangle -P INPUT       ACCEPT
  $IPT -t mangle -P FORWARD     ACCEPT

  # Cria chain com regras de segurança
  $IPT -N BLOCK
  $IPT -A BLOCK -p icmp --icmp-type echo-request -j DROP
  $IPT -A BLOCK -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
  $IPT -A BLOCK -p tcp -m limit --limit 1/s -j ACCEPT
  $IPT -A BLOCK -p tcp --tcp-flags SYN,ACK,FIN,RST SYN -m limit --limit 1/s -j ACCEPT
  $IPT -A BLOCK -m unclean -j DROP
  $IPT -A BLOCK -m state --state ESTABLISHED,RELATED -j ACCEPT
  $IPT -A BLOCK -j LOG --log-prefix "FW_ALERT: "
  $IPT -A BLOCK -j DROP

  # Muda a prioridade dos pacotes (Type Of Service) para agilizar as coisas
  $IPT -t mangle -A OUTPUT -o $IF_EXTERNA -p tcp -m multiport --dports 21,22,80,6667 -j TOS --set-tos 0x10

  # Libera todo o trafego local
  $IPT -t filter -A INPUT   -i lo -j ACCEPT
  $IPT -t filter -A INPUT   -i $IF_INTERNA -j ACCEPT
  $IPT -t filter -A FORWARD -i $IF_INTERNA -j ACCEPT
# Libera só FTP, SSH e WEB
  $IPT -t filter -A INPUT -i $IF_EXTERNA -p tcp -m multiport --dports 21,22,80,6667 -j ACCEPT

  # Libera a conexao para a rede interna
  $IPT -t nat -A POSTROUTING -s $REDE_INTERNA -j MASQUERADE

  # Cria um NAT para o SSH de uma maquina da rede interna
  $IPT -t filter -A FORWARD    -p tcp -d 0/0 --dport 2222 -j ACCEPT
  $IPT -t nat    -A PREROUTING -p tcp -d 0/0 --dport 2222 -j DNAT --to 192.168.1.2:22

  # Regras para evitar packet flood
  $IPT -A INPUT   -j BLOCK
  $IPT -A FORWARD -j BLOCK
}

fw_stop()
{
  $IPT -t filter -P INPUT       ACCEPT
  $IPT -t filter -P FORWARD     ACCEPT
  $IPT -t filter -P OUTPUT      ACCEPT
  $IPT -t nat    -P PREROUTING  ACCEPT
  $IPT -t nat    -P POSTROUTING ACCEPT
  $IPT -t nat    -P OUTPUT      ACCEPT
  $IPT -t mangle -P PREROUTING  ACCEPT
  $IPT -t mangle -P POSTROUTING ACCEPT
  $IPT -t mangle -P OUTPUT      ACCEPT
  $IPT -t mangle -P INPUT       ACCEPT
  $IPT -t mangle -P FORWARD     ACCEPT
  $IPT -t filter -F
  $IPT -t nat    -F
  $IPT -t mangle -F
  $IPT -t filter -X
  $IPT -t nat    -X
  $IPT -t mangle -X
  $IPT -t filter -Z
  $IPT -t nat    -Z
  $IPT -t mangle -Z
}

fw_usage()
{
  echo
  echo "$0 (start | stop | restart | clear)"
  echo
  echo "start   - Ativa o firewall"
  echo "stop    - Desativa o firewall"
  echo "restart - Reativa o firewall"
  echo "clear   - Limpa os contatores"
}

fw_clear()
{
  $IPT -t filter -Z
  $IPT -t nat    -Z
  $IPT -t mangle -Z
}

case $1 in

  start)
     fw_start;
  ;;

  stop)
     fw_stop;
  ;;

  restart)
    fw_stop;
    fw_start;
  ;;

  clear)
     fw_clear;
  ;;
  *)
     fw_usage;
     exit;

  ;;

esac