#!/bin/sh
#########################################
# IPTABLES
# William Robert Neumann
# williamrn@gmail.com
#########################################

case "$1" in
       start)
         echo "starting firewall..."

#Variáveis
IPTABLES="/usr/sbin/iptables"
LAN=eth0
LAN1=eth3
LAN_INT="192.168.1.0/24"

#Módulos IPTABLES
modprobe ip_tables
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ipt_REJECT
modprobe ipt_MASQUERADE
modprobe ipt_state
modprobe ipt_multiport
modprobe iptable_mangle
modprobe ipt_limit

echo "#######################################"
echo "#IPTABLES"
echo "#William Robert Neumann"
echo "#williamrn@gmail.com"
echo "#######################################"

#Zera todas as regras do iptables
$IPTABLES -F
$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -t nat -F
$IPTABLES -X

#Políticas Padrão
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP

#Ativar ip_forward
echo "1" > /proc/sys/net/ipv4/ip_forward

#Desabilitar respostas a comandos ping
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all

#####################################
# FILTER INPUT
#####################################
#Libera SSH
$IPTABLES -I INPUT -p tcp --dport 22 -s 172.27.1.39 -j ACCEPT
$IPTABLES -I INPUT -p tcp --dport 22 -s 172.27.1.23 -j ACCEPT

#Liberar Proxy para rede interna
$IPTABLES -A INPUT -p tcp -i eth3 -s $LAN_INT --dport 8090 -j ACCEPT

#Habilitando o icmp interno
$IPTABLES -I INPUT -i lo -j ACCEPT
echo "Ativado o fluxo interno"
echo "ON ....................................................... [ OK ]"

#Libera as portas principais do servidor
$IPTABLES -I INPUT -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -I INPUT -m state --state RELATED -j ACCEPT
$IPTABLES -I INPUT -p icmp -j ACCEPT
echo "Ativado a liberação das portas principais"
$IPTABLES -I INPUT -p udp -s $LAN_INT --dport 53 -j ACCEPT

######################################
# FILTER OUTPUT
######################################
#Habilitando o icmp interno
$IPTABLES -I OUTPUT -o lo -j ACCEPT

##########################################################
# FILTER FORWARD
######################################
#Roteamento de placas de REDE iptables
$IPTABLES -A FORWARD -s 0/0 -d 0/0 -j ACCEPT
$IPTABLES -A FORWARD -s $LAN_INT -p tcp --dport 8090 -j ACCEPT

#DNS
$IPTABLES -A FORWARD -p udp -s $LAN_INT --dport 53 -j ACCEPT

######################################
# PING-MORTE
######################################
#Bloqueio ping da morte
$IPTABLES -N PING-MORTE
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j PING-MORTE
$IPTABLES -A PING-MORTE -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A PING-MORTE -j DROP
echo "Ativado o bloqueio a tentativa de ataque ping da morte"
echo "ON ....................................................... [ OK ]"

####################################
# SYN ACK and FIN
####################################
#Bloqueio de scanners ocultos (Shealt Scan)
$IPTABLES -A FORWARD -p tcp --tcp-flags SYN,ACK, FIN, -m limit --limit 1/s -j ACCEPT
echo "Bloqueado scanners ocultos"
echo "ON ....................................................... [ OK ]"

######################################
# SSH-BRUT-FORCE
######################################
#Bloqueio de ataque ssh de força bruta
$IPTABLES -N SSH-BRUT-FORCE
$IPTABLES -A INPUT -i $LAN -p tcp --dport 22 -j SSH-BRUT-FORCE
$IPTABLES -A SSH-BRUT-FORCE -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A SSH-BRUT-FORCE -j DROP
echo "Ativado o bloqueio a tentativa de ataque do tipo SSH-BRUT-FORCE"
echo "ON ....................................................... [ OK ]"

######################################
# NAT
######################################

############################
# BLOQUEANDO MSN
############################
$IPTABLES -t nat -I PREROUTING -p TCP --dport 1863 -j DROP
$IPTABLES -t nat -I PREROUTING -d loginnet.passport.com -j DROP

#Habilita o roteamento da porta 80 para nosso Proxy transparente
$IPTABLES -t nat -A PREROUTING -i eth3 -p tcp --dport 80 -j REDIRECT --to-port 8090
echo "Regra para proxy transparente habilitada"
echo "ON ....................................................... [ OK ]"

#Roteamento de interface
$IPTABLES -t nat -I POSTROUTING -s 0/0 -j MASQUERADE
echo "Ativado o redirecionamento  ip_forward"
echo "ON ....................................................... [ OK ]"

#Zera contadores
echo "FIREWALL CARREGADO COM SUCESSO!!"
echo "ON ....................................................... [ OK ]"
;;
restart)
$0 stop
$0 start
;;
status)
iptables-save > /var/log/firewall |less
cat /var/firewall/firewall
;;
stop)
iptables -F
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P FORWARD ACCEPT
echo "stoping firewall..."
;;
*)
echo "usage: {start|stop|restart}"
exit 1
esac
exit 0