#!/bin/sh
#
# rc.firewall - Initial IP Firewall script for 2.4.x
#
##############################################################################
#                                                                            #
#	THIS IS A SaMPLE IPTABLES CONFIGURATION ONLY!!!                      #
#	Use it as a starting point and adjust according to your specific     #
#	needs and threats. Note that this sample COMPLETELY trusts the       #
#	internal host(s) and ADSL modem, and this is not always recommanded  #
#                                                                            #
##############################################################################

# we want to start from clean tables. This way, if you rerun this script, you do not double the rules
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -F
iptables -t nat -F
# We assign some values to logical constants. These values may differ according to the specific implementation.

#
# The router local ip
HOST_IP="10.200.1.1/32"
# An inside and trusted host
HOST1_IP="10.200.1.2/32"
# Our ADSL modem ip
ADSL_IP="10.0.0.138/32"
# The LAN broadcast address
LAN_BCAST_ADDRESS="10.255.255.255/32"
# Our Internet connection interface
INET_IFACE="ppp+"
# Our LAN interface
LAN_IFACE="eth0"
# iptables full path
IPTABLES="/usr/sbin/iptables"

#########
# Load all required IPTables modules
#

#
# Needed to initially load modules
#
/sbin/depmod -a

#
# Adds some iptables targets like LOG, REJECT and MASQUARADE.
#
/sbin/modprobe ipt_LOG
#/sbin/modprobe ipt_REJECT
/sbin/modprobe ipt_MASQUERADE
/sbin/modprobe ip_nat_ftp

#
# Support for owner matching
#
#/sbin/modprobe ipt_owner

#
# Support for connection tracking of FTP and IRC.
#
/sbin/modprobe ip_conntrack_ftp
#/sbin/modprobe ip_conntrack_irc


#CRITICAL:  Enable IP forwarding since it is disabled by default.
#
echo "1" > /proc/sys/net/ipv4/ip_forward


# We need Dynamic ip support:
#
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
#
#  General strategy:
# Enable simple IP FORWARDing and Masquerading
# We forward for the internal trusted host only. The ADSL need not be 
# forwarded, and our router just uses it's local interfaces

# a table for dealing with icmp traffic
$IPTABLES -N icmp_packets
# a table to deal with tcp traffic
$IPTABLES -N tcp_packets
# a table for udp traffic
$IPTABLES -N udp_packets
# we want to run some tcp servers, so we make a table for that as well
#if you want to run udp services as well, create also a table for udp_services
$IPTABLES -N tcp_services
 

#this is the tcp_packets table. 
# tcp packets that start a new sessions are sent to the tcp_services table
$IPTABLES -A tcp_packets -p TCP --syn -j tcp_services
# this line allows exisiting connections to live. It is actualy redundent since we had this line in the INPUT table. 
$IPTABLES -A tcp_packets -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
# we log the packets before DROPing them
$IPTABLES -A tcp_packets -m limit --limit 60/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "TCP packets packet died: "
# tcp packets that are not related to established session, and are not syn packets, gets drop
$IPTABLES -A tcp_packets -p TCP -j DROP

# this is where we allow servers
# I run a ssh server, world accessible. You might want to filter according to source ip ( with the -s ip/mask ).
$IPTABLES -A tcp_services -p TCP -s 132.68.1.48/32 --dport 22 -j ACCEPT
# no other services, so we log and then drop
$IPTABLES -A tcp_services -m limit --limit 60/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "TCP srv packet died: "
$IPTABLES -A tcp_services -p TCP -s 0/0 -j DROP

#
# ICMP rules
#
# we permit icmp types 3,11
# type 3 is destination unreachable. this may save us b/w of accessive retries
# type 11 is Time Exceeded - good for traceroute .

$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 3 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
# we don't log or drop here, this will be done in the INPUT table since the inspection goes back there.
 
#
# UDP packets
#
# the following line is redundent, as it apeared in the INPUT table
#$IPTABLES -A udp_packets -p UDP -m state --state ESTABLISHED,RELATED -j ACCEPT
# we run a caching dns for the internal LAN (if we had more services we might
# have crreated a udp_services table, just like tcp_services).

$IPTABLES -A udp_packets -p UDP -i $LAN_IFACE --destination-port 53 -j ACCEPT
# we log the remaining packets before they are returning to the INPUT table
$IPTABLES -A udp_packets -m limit --limit 60/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "UDP packets packet died: "

# this is where we do the masquerading.
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE

#
# This is the INPUT table. Most filtering is done here
#
# for performance efficiency, we put the rules that should get the highest matces
# first.
#
# Firtst , we permit the ADSL modem to pass traffic on pptp (tcp port 1723) and the gre tunnel (protocol 47)
$IPTABLES -A INPUT -p 47 -s $ADSL_IP -j ACCEPT
$IPTABLES -A INPUT -p tcp -s $ADSL_IP --sport 1723 -j ACCEPT
# we trust our internal host. If you want to specificaly control its activity, remove this line and permit specific
# service in the apropriate tables.
$IPTABLES -A INPUT -p ALL -s $HOST1_IP -j ACCEPT
# the following 3 rules ensure that established connections will not break. These are the lines that make the 
# stateful inspection (and which match most of the LAN and PPP interface traffic).
$IPTABLES -A INPUT -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT
# then we permit the loopback interface
$IPTABLES -A INPUT -s 127.0.0.1 -j ACCEPT
#The following 2 rules enables the passive and active ftp port command (that opens a data stream).
$IPTABLES -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
# we allow broadcasts. 
$IPTABLES -A INPUT -p ALL -d $LAN_BCAST_ADDRESS -j ACCEPT
# any traffic coming on the internet interface that did not match the previous rules (basicaly packets that try to start sessions, or probes, or just any 
# other packet that is not related to an existing stream) will be separated to icmp, tcp and udp and treated specificaly.
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udp_packets
$IPTABLES -A INPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -j ACCEPT
# before we drop the packets that reach the end of the table, we want to record it. We limit the log rate so that we wont
#chocke it we are badly attacked.
$IPTABLES -A INPUT -m limit --limit 60/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "
#
# This is the output table.
#First we permit the pptp and gre tunnel to the ADSL
$IPTABLES -A OUTPUT -p 47 -d $ADSL_IP -j ACCEPT
# We trust our internal host
$IPTABLES -A OUTPUT -p ALL -d $HOST1_IP -j ACCEPT
# we make stateful inspection and let established sessions live, and new connections to be created.
$IPTABLES -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -m limit --limit 60/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "
#
# We forward for established sessions
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# The following line will ensure that tcp connections from the masqueraded net
# are set with the correct MSS, without the need to change the MTU of the
# Ethernet nics of the internal LAN stations 
$IPTABLES  -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
$IPTABLES -A FORWARD -m state --state NEW -s $HOST1_IP -j ACCEPT
$IPTABLES -A FORWARD -m limit --limit 60/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "
#
# set default policies for the INPUT, FORWARD and OUTPUT chains. Since we filter on the INPUT , the FORWARD 
# policy is ACCEPT
#

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP