#!/bin/bash
#
# Script: Firewall
# Autor: Gustavo Linause
# Data: 12/05/2013

# chkconfig: 345 20 80
# description: rc.firewall

module[0]="iptable_filter"
module[1]="iptable_nat"
module[2]="iptable_mangle"

for ((n=0;$n<=2;n++)); do
    if [ "`lsmod | grep ${module[$n]}`" = "" ]; then
        /sbin/modprobe ${module[$n]}
        echo -e "\nMódulo ${module[$n]} carregado."
    fi
done

#variavel path iptables
ipt=/sbin/iptables

# IP da Rede
lan=10.0.0.0/24

# Interface da Rede Local - LAN
ilan=p6p1

# Ativando o redirecionamento de pacotes
echo 1 > /proc/sys/net/ipv4/ip_forward

do_start () {

    # Removendo regras
    $ipt -F
    $ipt -t nat -F
    $ipt -t mangle -F

    # Apagando chains
    $ipt -X
    $ipt -t nat -X
    $ipt -t mangle -X
    $ipt -t nat -F POSTROUTING
    $ipt -t nat -F PREROUTING

    # Zerando contadores
    $ipt -Z
    $ipt -t nat -Z
    $ipt -t mangle -Z


    # Default policies
    $ipt -P OUTPUT ACCEPT
    $ipt -P INPUT DROP
    $ipt -P FORWARD DROP

    # Liberando o Tráfego na Interface loopback
    $ipt -t filter -A INPUT -i lo -j ACCEPT

    # Manter Conexões Estabelecidas
    $ipt -t filter -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,RELATED -j ACCEPT
    $ipt -t filter -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,RELATED -j ACCEPT

    # Liberando ping
    $ipt -t filter -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
    $ipt -t filter -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT

    ########### PROTEÇÕES ###########

    #i=/proc/sys/net/ipv4
    echo 1 > $i/tcp_syncookies
    echo 0 > $i/icmp_echo_ignore_broadcasts
    echo 0 > $i/icmp_ignore_bogus_error_responses

    for i in /proc/sys/net/ipv4/conf/*; do
        echo 0 > $i/accept_redirects
        echo 0 > $i/accept_source_route
        echo 1 > $i/log_martians
        echo 1 > $i/rp_filter
    done

   # Proteção contra Ataques
   $ipt -t filter -A INPUT -m conntrack --ctstate RELATED,INVALID -j DROP


   ############# PROTOCOLOS E SERVIÇOS #############


    # DNS - Serviço de Nomes de Dominios
    $ipt -t filter -A INPUT -i $ilan -p tcp -m tcp --dport 53 -j ACCEPT
    $ipt -t filter -A INPUT -i $ilan -p udp -m udp --dport 53 -j ACCEPT

    #HTTP/HTTPS - Protocolo de Transferência de Hypertext
    $ipt -t filter -A INPUT -i $ilan -p tcp -m tcp --dport 80 -j ACCEPT
    $ipt -t filter -A INPUT -i $ilan -p tcp -m tcp --dport 433 -j ACCEPT

    # NTP - Protocolo para sincronização dos relógios
    $ipt -t filter -A INPUT  -p udp --sport 123 -j ACCEPT
    $ipt -t filter -A FORWARD -p udp --sport 123 -j ACCEPT
    $ipt -t filter -A FORWARD -p udp --dport 123 -j ACCEPT

    # SSH - Shell Seguro
    $ipt -t filter -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

    # LOGs
    $ipt -t filter -A INPUT -p tcp -m tcp --dport 22 -j LOG --log-prefix "[Acesso SSH: ]"
    $ipt -t filter -A OUTPUT -p tcp -m tcp --dport 22 -j LOG --log-prefix "[Acesso SSH: ]"
    $ipt -I INPUT 1 -m limit -p tcp --destination-port 22 -j LOG --log-level 1 --log-prefix "[ Acesso SSH: ]"

    # log all the rest before dropping
    #$ipt -A INPUT   -j LOG --log-prefix "[INPUT: ] "
    #$ipt -A OUTPUT  -j LOG --log-prefix "[OUTPUT: ]"
    #$ipt -A FORWARD -j LOG --log-prefix "[FORWARD: ]"
}

do_stop () {

    # Removendo regras
    $ipt -F
    $ipt -t nat -F
    $ipt -t mangle -F

    # Apagando chains
    $ipt -X
    $ipt -t nat -X
    $ipt -t mangle -X
    $ipt -t nat -F POSTROUTING
    $ipt -t nat -F PREROUTING

    # Zerando contadores
    $ipt -Z
    $ipt -t nat -Z
    $ipt -t mangle -Z

        $ipt -P INPUT ACCEPT
        $ipt -P OUTPUT ACCEPT
        $ipt -P FORWARD ACCEPT
}

do_status () {
    $ipt -nL
}

case "$1" in

    start)
    echo -e "Starting Firewall iptables     [ OK ]\n"
        do_start
        ;;

    stop)
        echo -e "\nStopping Firewall iptables."
    do_stop
        ;;

    restart)
        echo -e "\nReloading Firewall configuration rules."
        do_start
        ;;

    status)
        echo -e "\nShowing the rules firewall."
        do_status
        ;;

    *)
        echo -e "\nStopping Firewall iptables\n"
        echo -e "\nUso: rc.firewall {start|stop|status|restart}\n"
        exit 1
esac

exit 0