#!/bin/sh
# Autor: Cesar Vieira Bento
# Modelo de configuração de firewall
# Descrição: FIREWALL PARA SERVIDORES INTRANET/INTERNET
#

case "$1" in

 start)
   echo "Iniciando o serviço de: Iptables "
   /sbin/modprobe ip_tables

   # Limpando as Regras
   echo " Limpando regras..."
   iptables -F INPUT
   iptables -F OUTPUT
   iptables -F FORWARD

   # Variaveis
   
   LAN="192.168.0.0/24"
   INTRA="eth0"
   INTER="eth1"
   SUPORT="192.168.0.1/24"
   SQUID="6588"
           
     # Definição de Policiamento 
     iptables -t filter -P INPUT DROP
     iptables -t filter -P OUTPUT ACCEPT
     iptables -t filter -P FORWARD DROP
     iptables -t nat -P PREROUTING ACCEPT
     iptables -t nat -P OUTPUT ACCEPT
     iptables -t nat -P POSTROUTING DROP
     iptables -t mangle -P PREROUTING ACCEPT
     iptables -t mangle -P OUTPUT ACCEPT
     
   echo " Proteção contra IP-Spoofing..."
   for i in /proc/sys/net/ipv4/conf/*/rp_filter; do
    echo 1 >$i
   done
   
   echo " Proteção contra pacotes mal formados..."
   iptables -A FORWARD -m unclean -j DROP

   echo " Proteção contra Ping da Morte..."
   iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

   echo " Ativando redirecionamento de Pacotes..."
   echo "1" >/proc/sys/net/ipv4/ip_forward

   echo " Porteção contra Port Scanner..."
   iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
       
   echo " Proteção contra SYN-Fooding..."
   iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT

   echo " Proteção do Kernel: syncookies... "
   if [ -e /proc/sys/net/ipv4/tcp_syncookies ]
     then
     echo 1 > /proc/sys/net/ipv4/tcp_syncookies
   fi

     
     # INPUT 
     iptables -N NET
     iptables -A INPUT -i $INTER -j NET
     iptables -A INPUT -i lo -s 127.0.0.1 -j ACCEPT
     iptables -A INPUT -s $LAN -i $INTRA -j ACCEPT
     iptables -A INPUT -j LOG --log-prefix "FIREWALL: INPUT "
     # FORWARD 
     iptables -A FORWARD -d $LAN -i $INTER -o $INTRA -j ACCEPT
     iptables -A FORWARD -s $LAN -i $INTRA -o $INTER -j ACCEPT
     iptables -A FORWARD -j LOG --log-prefix "FIREWALL: FORWARD "
     # NET
     iptables -A NET -p icmp -m limit --limit 2/s -j ACCEPT
     iptables -A NET -p udp --sport 53 -j ACCEPT
     iptables -A NET -p tcp --dport 21 -j ACCEPT
 #   iptables -A NET -p tcp --dport 80 -j LOG --log-prefix "FIREWALL: http "
     iptables -A NET -p tcp --dport 25 -j LOG --log-prefix "FIREWALL: smtp "
     iptables -A NET -p udp --dport 53 -j LOG --log-prefix "FIREWALL: dns "
     iptables -A NET -p tcp --dport 110 -j LOG --log-prefix "FIREWALL: pop3 "
     iptables -A NET -p tcp --dport 113 -j LOG --log-prefix "FIREWALL: identd "
     iptables -A NET -p udp --dport 111 -j LOG --log-prefix "FIREWALL: rpc"
     iptables -A NET -p tcp --dport 111 -j LOG --log-prefix "FIREWALL: rpc"
     iptables -A NET -p tcp --dport 137:139 -j LOG --log-prefix "FIREWALL: samba "
     iptables -A NET -p udp --dport 137:139 -j LOG --log-prefix "FIREWALL: samba "
     iptables -A NET -m state --state ! ESTABLISHED,RELATED -j LOG --log-prefix "FIREWALL: INTER-SYS "
     iptables -A NET -m state --state ! ESTABLISHED,RELATED -j DROP
     iptables -A NET -j ACCEPT
     # NAT
     iptables -t nat -A PREROUTING -p tcp -i $INTRA -s $LAN --dport 80 -j REDIRECT --to-port $SQUID
     iptables -t nat -A POSTROUTING -o lo -j ACCEPT
     iptables -t nat -A POSTROUTING -s $LAN -o $INTRA -j ACCEPT
     iptables -t nat -A POSTROUTING -s $LAN -o $INTER -p tcp --dport 80 -j LOG --log-prefix "FIREWALL: SNAT-www "
     iptables -t nat -A POSTROUTING -s $LAN -o $INTER -p tcp --dport 80 -j DROP
     iptables -t nat -A POSTROUTING -s $LAN -o $INTER -j MASQUERADE
     iptables -t nat -A POSTROUTING -o $INTRA -d $LAN -j LOG --log-prefix "FIREWALL: SNAT-Desconhecido"
     iptables -t nat -A POSTROUTING -o $INTRA -d $LAN -j DROP
     iptables -t nat -A POSTROUTING -o $INTER -j ACCEPT
     iptables -t nat -A POSTROUTING -j LOG --log-prefix "FIREWALL: SNAT "
     iptables -t nat -A POSTROUTING -j DROP
     # OUTPUT
     iptables -t mangle -A OUTPUT -o $INTER -p tcp --dport 21 -j TOS --set-tos 0x10
     iptables -t mangle -A OUTPUT -o $INTER -p tcp --dport 23 -j TOS --set-tos 0x10
     iptables -t mangle -A OUTPUT -o $INTER -p tcp --dport 6665:6668 -j TOS --set-tos 0x10
     iptables -t mangle -A OUTPUT -o $INTER -p udp --dport 53 -j TOS --set-tos 0x10
 ;;

 stop)
     echo "Parando o serviço de: Firewall"
     echo -n " Apagando chain criada..."
     iptables -F
     iptables -X NET
     iptables -t filter -P INPUT ACCEPT
     iptables -t filter -P FORWARD ACCEPT
     iptables -t nat -P POSTROUTING ACCEPT
     echo "                                [ OK ]"
     echo
 ;;

 restart)
     echo "Reiniciando Firewall."
     echo
     $0 stop
     $0 start
 ;;

 status)
     echo "Exibindo regras de Iptables... "
     echo
     iptables -vnL
 ;;

 *)
     echo "Uso: iptables (start | stop | restart | status)"
     echo
 ;;

esac
exit 0