#!/bin/sh


         echo "####INICIO DO SCRIPT DE FIREWALL####"




echo "###Setando Protecao Contra Ataques###"
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
for i in /proc/sys/net/ipv4/conf/*; do
echo 0 >$i/accept_redirects
echo 0 >$i/accept_source_route
echo 1 >$i/log_martians
echo 1 >$i/rp_filter;
done
echo "OK"

echo "###Opcões de configuracão###"
LAN_IP_RANGE="10.0.0.0/255.255.0.0"
LAN_IP="10.0.0.3/255.255.0.0"
LAN_BCAST_ADRESS="10.0.255.255/255.255.0.0"
LOCALHOST_IP="127.0.0.1/8"
INET_IFACE="eth0"
LAN_IFACE="eth1"
IPTABLES="/sbin/iptables"
echo "OK"

echo "###Limpando Regras###"
$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -t nat -F
echo "OK"

echo "###Carregando os modulos necessários do IPTABLES###"
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_REJECT
/sbin/modprobe ipt_MASQUERADE
/sbin/modprobe iptable_nat
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
/sbin/modprobe ip_nat_ftp
echo "OK"

echo "###Habilita o IPFORWARD###"
echo 1 > /proc/sys/net/ipv4/ip_forward
echo "OK"

echo "###Protecao contra spoof de IP###"
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo "OK"

echo "###Forcando uso do Proxy###"
$IPTABLES -t nat -A PREROUTING -s 10.0.0.200 -p tcp --dport 80 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -s 10.0.0.2 -p tcp --dport 80 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -s 10.0.0.0/255.255.0.0 -p tcp --dport 80 -j DROP
echo "OK"

echo "###Conectividade Social###"
$IPTABLES -t nat -A PREROUTING -i eth0 -p tcp -d ! 200.201.174.0/24 --dport 80 -j REDIRECT --to-port 8080
$IPTABLES -A FORWARD -s 10.0.0.22 -p TCP --dport 2631 -j ACCEPT
$IPTABLES -A FORWARD -s 10.0.0.115 -p TCP --dport 2631 -j ACCEPT
$IPTABLES -A FORWARD -s 10.0.0.126 -p TCP --dport 2631 -j ACCEPT
$IPTABLES -A FORWARD -s 10.0.0.162 -p TCP --dport 2631 -j ACCEPT
echo "OK"

echo "###Liberando SSH somente para enderecos confiaveis###"
$IPTABLES -A INPUT -p tcp -s 10.0.0.0/255.255.0.0 --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 200.150.230.82 --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 200.162.12.62 --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p TCP -s 0/0 --dport 22 -j DROP
echo "OK"

echo "###Ip's Indesejaveis###"
$IPTABLES -A INPUT -i eth0 -p tcp -s 195.122.194.234 -j DROP
echo "OK"

echo "###Habilita IP Forwarding and Masquerading simples###"
$IPTABLES -t nat -A POSTROUTING -o $LAN_IFACE -j MASQUERADE
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE
echo "OK"

echo "###Pacotes alterados de TCP indesejáveis se ferram aqui###"
$IPTABLES -A FORWARD -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "Novo pacote não syn:"
$IPTABLES -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
echo "OK"

echo "###Redirecinamento de Servicos###"
$IPTABLES -t nat -A PREROUTING -d 200.204.148.125 -p tcp --dport 3389 -j DNAT --to 10.0.0.2:3389
echo "OK"

echo "###Aceita os pacotes que realmente devem entrar###"
$IPTABLES -t filter -A FORWARD -j ACCEPT -p tcp --dport 25
$IPTABLES -t filter -A FORWARD -j ACCEPT -p tcp --dport 3389
$IPTABLES -t filter -A FORWARD -j ACCEPT -p tcp --dport 80
$IPTABLES -t filter -A FORWARD -j ACCEPT -p tcp --dport 20:21 
$IPTABLES -t filter -A FORWARD -j ACCEPT -p tcp --dport 8081
$IPTABLES -t filter -A FORWARD -j ACCEPT -p tcp --dport 1024
$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
echo "OK"

echo "###Cria cadeias separadas para ICMP, TCP e UDP passarem###" 
$IPTABLES -N icmp_packets
$IPTABLES -N tcp_packets
$IPTABLES -N udpincoming_packets
$IPTABLES -N allowed
echo "OK"

echo "###A cadeia allowed para conexoes TCP###"
$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP -j DROP
echo "OK"

echo "###Regras ICMP###"
#$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 0 -j ACCEPT
#$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 3 -j ACCEPT
#$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 5 -j ACCEPT
#$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
echo "OK"

echo "###Regras TCP###"
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 20 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 113 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 3389 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 809 -j allowed
echo "OK"

echo "###Regras UDP###"
$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT
$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 123 -j ACCEPT
$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 2074 -j ACCEPT
echo "OK"

#echo "###Bloqueio do MSN###"
#$IPTABLES -A FORWARD -p TCP --dport 1863 -j REJECT
#$IPTABLES -A FORWARD -d 64.4.13.0/24 -j REJECT
#$IPTABLES -A FORWARD -s 192.168.10.0/255.255.255.0 -d messenger.hotmail.com -j REJECT
#$IPTABLES -A FORWARD -s 192.168.10.0/255.255.255.0 -d baym-gw31.msgr.hotmail.com -j REJECT
#echo "OK"

echo "###Bloqueio Kazaa###"
$IPTABLES -A FORWARD -d 213.248.112.0/24 -j REJECT
$IPTABLES -A FORWARD -p TCP --dport 1214 -j REJECT
echo "OK"

echo "###Cadeia PREROUTING###"
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 10.0.0.0/255.255.0.0 -j DROP
echo "OK"

echo "###Cadeia INPUT###"
$IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "Novo pacote não syn:"
$IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
echo "OK"

echo "###Regras para pacotes vindos da internet###"
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udpincoming_packets
$IPTABLES -A INPUT -p TCP -i $INET_IFACE --dport 27665 -j DROP
echo "OK"

echo "###Proteção contra TRINOO###"
$IPTABLES -A INPUT -p TCP -i $INET_IFACE --dport 27444 -j DROP
$IPTABLES -A INPUT -p TCP -i $INET_IFACE --dport 1214 -j DROP
$IPTABLES -A INPUT -p TCP -i $INET_IFACE --dport 31335 -j DROP
echo "OK"

echo "###Protecão contra Tronjans###"
$IPTABLES -A INPUT -p TCP -i $INET_IFACE --dport 666 -j DROP
$IPTABLES -A INPUT -p TCP -i $INET_IFACE --dport 666 -j DROP
$IPTABLES -A INPUT -p TCP -i $INET_IFACE --dport 4000 -j DROP
echo "OK"

echo "###Protecao contra acesso externo ao Squid###"
$IPTABLES -A INPUT -p TCP -i $INET_IFACE --dport 3128 -j DROP
$IPTABLES -A INPUT -p TCP -i $INET_IFACE --dport 8080 -j DROP
echo "OK"

echo "###Proteção contra acesso externo ao NETBIOS###"
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -d 200.204.148.125 --dport 137:8000 -j DROP
echo "OK"

echo "###Proteção contra acesso externo ao TELNET###"
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -d 10.0.0.3 --dport telnet -j DROP
echo "OK"

echo "###Regras para rede interna e localhost###"
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_BCAST_ADRESS -j ACCEPT
$IPTABLES -A INPUT -p ALL -d $LOCALHOST_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -d $LAN_IP -j ACCEPT
echo "OK"

echo "###Cadeia OUTPUT###"
$IPTABLES -A OUTPUT -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "Novo pacote nao syn:"
$IPTABLES -A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP 
$IPTABLES -A OUTPUT -p ALL -s $LOCALHOST_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
echo "OK" 

#echo "###Habilitando Seguranca###"
#iptables -A INPUT -p tcp -i eth0 -j REJECT --reject-with tcp-reset
#iptables -A INPUT -p udp -i eth0 -j REJECT --reject-with icmp-port-unreachable
#echo "OK"

echo "###Seta a politica default para INPUT, FORWARD e OUTPUT###"
#$IPTABLES -A INPUT -p tcp --syn -j DROP
$IPTABLES -t filter -P INPUT ACCEPT
$IPTABLES -t filter -P OUTPUT ACCEPT
$IPTABLES -t filter -P FORWARD DROP 
echo "OK"



      echo "#####FIM DO SCRIPT DE FIREWALL#####"