#!/bin/bash
#
### BEGIN INIT INFO
# Provides: firewall
# Required-Start: $network
# Required-Stop: $network
# Default-Start: S
# Default-Stop: 0 1 6
# Short-Description: Provides Firewall Rules based on Iptables IPV4
### END INIT INFO
#
IFACEWAN=eth1
IFACECOOVA=eth0
NETCOOVA=10.1.0.0/24
#
## RULES STARTS -->

# Chains off CoovaChilli ...
iptables -N coova-INPUT &> /dev/null
iptables -N coova-FORWARD &> /dev/null
iptables -t mangle -N coova-FORWARD &> /dev/null
iptables -t nat -N coova-PREROUTING &> /dev/null

# Active traffic on Interfaces
echo 1 > /proc/sys/net/ipv4/ip_forward

# disabling Reverse Path Filter used to check if the
# packets are leaving the server are returns by same interface ...
echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter

# Load Module IpTable
modprobe iptable_nat


#####################
# FILTER INPUT RULES
#####################

# DEFAULT POLICY TO INPUT PACKETS AND CLEAN RULES
iptables -t filter -F INPUT
iptables -t filter -P INPUT ACCEPT
iptables -t filter -P INPUT DROP

# SSH Accept Everything
iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT

# Ping - ICMP packets
iptables -t filter -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT

# Established outgoing TCP connections
iptables -t filter -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# Local and Loopback
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A INPUT -s 127.0.0.0/8 -j ACCEPT

# from proto & port
iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT

# DHCP
iptables -t filter -A INPUT -p tcp --dport 67:68 -j ACCEPT
iptables -t filter -A INPUT -p udp --dport 67:68 -j ACCEPT

# Coova
iptables -A INPUT -j coova-INPUT

# Fecha conexao na Interface de acesso ao Hotspot
iptables -t filter -A INPUT -i ${IFACECOOVA} -j DROP
iptables -t filter -A INPUT -s ${NETCOOVA} -j coova-INPUT


#######################
# FILTER FORWARD RULES
#######################

# DEFAULT POLICY TO FORWARD PACKETS AND CLEAN RULES
iptables -t filter -F FORWARD
iptables -t filter -P FORWARD ACCEPT

# Established TCP connections
iptables -t filter -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# Coova
iptables -A FORWARD -j coova-FORWARD

# Bloqueia pacotes vindos do Hotspot destinados as redes ADM
iptables -t filter -A FORWARD -o ${IFACECOOVA} -j DROP
iptables -t filter -A FORWARD -i ${IFACECOOVA} -j DROP
iptables -t filter -A FORWARD -s ${NETCOOVA} -p tcp --dport 53 -j ACCEPT
iptables -t filter -A FORWARD -s ${NETCOOVA} -p udp --dport 53 -j ACCEPT


#######################
# NAT PREROUTING RULES
#######################

# DEFAULT POLICY TO NAT PREROUTING PACKETS AND CLEAN RULES
iptables -t nat -F PREROUTING

# Nao faz nat para redes locais
LOCALNET="192.168.0.0/16 172.16.0.0/12 10.0.0.0/8"
for n in ${LOCALNET}; do
iptables -t nat -A PREROUTING -s ${n} -d 192.168.0.0/16 -j RETURN
iptables -t nat -A PREROUTING -s ${n} -d 172.16.0.0/12 -j RETURN
iptables -t nat -A PREROUTING -s ${n} -d 10.0.0.0/8 -j RETURN
done

# Nat CoovaChilli
iptables -t nat -A PREROUTING -j coova-PREROUTING


########################
# NAT POSTROUTING RULES
########################

# DEFAULT POLICY TO NAT POSTROUTING PACKETS AND CLEAN RULES
iptables -t nat -F POSTROUTING

# Nao faz nat para redes locais
LOCALNET="192.168.0.0/16 172.16.0.0/12 10.0.0.0/8"
for n in ${LOCALNET}; do
  iptables -t nat -A POSTROUTING -s ${n} -d 192.168.0.0/16 -j RETURN
  iptables -t nat -A POSTROUTING -s ${n} -d 172.16.0.0/12 -j RETURN
  iptables -t nat -A POSTROUTING -s ${n} -d 10.0.0.0/8 -j RETURN
done

# Mascara Qualquer saida para a Internet
iptables -t nat -A POSTROUTING -o ${IFACEWAN} -j MASQUERADE


##########################
# MANGLE PREROUTING RULES
##########################

# MANGLE PREROUTING PACKETS AND CLEAN RULES
iptables -t mangle -F PREROUTING


#######################
# MANGLE FORWARD RULES
#######################

# MANGLE FORWARD PACKETS AND CLEAN RULES
iptables -t mangle -F FORWARD

# Mangle CoovaChilli
iptables -t mangle -A FORWARD -j coova-FORWARD

######################
# MANGLE OUTPUT RULES
######################

# MANGLE OUTPUT PACKETS AND CLEAN RULES
iptables -t mangle -F OUTPUT

###########################
span class="comentario"># MANGLE POSTROUTING RULES
###########################

# MANGLE POSTROUTING PACKETS AND CLEAN RULES
iptables -t mangle -F POSTROUTING

exit 0