#!/bin/bash
#
# To open ports go to PORTS section and fill in new ports as needed.
# Then restart this script. You need to be root to do this.
#
# Copyleft (c) 2007,2008 Tomaz Lovrec
# License: GPL
#

# Interfaces
# Change your interfaces.
EXTIF=ppp0
INTIF=eth1
LPDIF=lo
# Turn to 0 if you don't have an internal interface for Green Zone
INT=1

# NAT and forwarding, set to 0 if you don't want to use forwarding.
FWD=1
FWDIP1=10.0.0.10
FWDIP2=10.0.0.15

# Traffic control on Green Zone
DOWNMAX=512
DOWNCEIL=576
UPMAX=128
UPCEIL=192
BANDMAX=102400
NETMAX=1024000

# VPN. Change to 0 if you don't use VPN
VPN=1
VPNIF=tap0
VPNIPRANGE="10.8.0.0/24"

# Programs
IPT=/usr/sbin/iptables
IP6T=/usr/sbin/ip6tables
IFC=/sbin/ifconfig
G=/usr/bin/grep
SED=/usr/bin/sed
TC=/sbin/tc
IP=/sbin/ip

## Interface preferences
# External
# If you don't use PPPoE or PPP connection change the P-t-P: with Bcast:
EXTIP="`$IFC $EXTIF | $G addr: | $SED 's/.*addr:\([^ ]*\) .*/\1/'`"
EXTBC="`$IFC $EXTIF | $G P-t-P: | $SED 's/.*P-t-P:\([^ ]*\) .*/\1/'`"
EXTMSK="`$IFC $EXTIF | $G Mask: | $SED 's/.*Mask:\([^ ]*\) .*/\1/'`"
EXTNET=$EXTIP/$EXTMSK

# Internal
if [ $INT = "1" ]; then
	INTIP="`$IFC $INTIF | $G addr: | $SED 's/.*addr:\([^ ]*\) .*/\1/'`"
	INTBC="`$IFC $INTIF | $G Bcast: | $SED 's/.*Bcast:\([^ ]*\) .*/\1/'`"
	INTMSK="`$IFC $INTIF | $G Mask: | $SED 's/.*Mask:\([^ ]*\) .*/\1/'`"
	INTNET=$INTIP/$INTMSK
fi

# Loopback
LPDIP=127.0.0.1
LPDMSK=255.0.0.0
LPDNET=$LPDIP/$LPDMSK

# VPN
if [ $VPN = "1" ]; then
	VPNIP="`$IFC $VPNIF | $G addr: | $SED 's/.*addr:\([^ ]*\) .*/\1/'`"
	VPNBC="`$IFC $VPNIF | $G P-t-P: | $SED 's/.*P-t-P:\([^ ]*\) .*/\1/'`"
	VPNMSK="`$IFC $VPNIF | $G Mask: | $SED 's/.*Mask:\([^ ]*\) .*/\1/'`"
	VPNNET=$VPNIP/$VPNMSK
fi


#################
#*****PORTS*****#
#*****PORTS*****#
#*****PORTS*****#
#################


### External
## Input
# TCP
EXTINTCP=""

# UDP
EXTINUDP=""

## Output
# TCP
EXTOUTTCP=""

# UDP
EXTOUTUDP=""

### Internal
## Input
# TCP
INTINTCP=""

# UDP
INTINUDP=""

## Output
# TCP
INTOUTTCP=""

# UDP
INTOUTUDP=""

### Forward ports
## 1st IP
# TCP
FWD1TCP=""

# UDP
FWD1UDP=""

## 2nd IP
# TCP
FWD2TCP=""

# UDP 
FWD2UDP=""


# Flush, erase and set default policies
$IPT -F
$IPT -X
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP
# Flush NAT table
$IPT --table nat -F
$IPT --table mangle -F

echo "Setting up iptables..."

# Logging

$IPT -N drop_input 2> /dev/null
$IPT -A drop_input -j LOG --log-prefix 'FW DROP INPUT:'
$IPT -A drop_input -j DROP

$IPT -N drop_output 2> /dev/null
$IPT -A drop_output -j LOG --log-prefix 'FW DROP OUTPUT:'
$IPT -A drop_output -j DROP

$IPT -N drop_forward 2> /dev/null
$IPT -A drop_forward -j LOG --log-prefix 'FW DROP FORWARD:'
$IPT -A drop_forward -j DROP

# Allow loopback
$IPT -A INPUT -i $LPDIF -s $LPDIP -j ACCEPT
$IPT -A INPUT -i $LPDIF -s $EXTIP -j ACCEPT
$IPT -A INPUT -i $LPDIF -s $INTIP -j ACCEPT
$IPT -A OUTPUT -o $LPDIF -s $LPDIP -j ACCEPT
$IPT -A OUTPUT -o $LPDIF -s $EXTIP -j ACCEPT
$IPT -A OUTPUT -o $LPDIF -s $INTIP -j ACCEPT

# Block broadcasts
$IPT -A INPUT -i $EXTIF -d $EXTBC -j drop_input
#$IPT -A INPUT -i $INTIF -d $INTBC -j drop_input
$IPT -A OUTPUT -o $EXTIF -d $EXTBC -j drop_output
#$IPT -A OUTPUT -o $INTIF -d $INTBC -j drop_output

# Block ICMP except ping
$IPT -A OUTPUT -o $EXTIF -p icmp --icmp-type ! 8 -j drop_output

####################
# External packets #
####################
## Incoming
# Open TCP ports
for i in $EXTINTCP
do
	$IPT -A INPUT -i $EXTIF -p tcp -d $EXTIP --dport $i --syn -m state --state NEW -j ACCEPT 
done

# Open UDP ports
for i in $EXTINUDP
do
	$IPT -A INPUT -i $EXTIF -p udp -d $EXTIP --dport $i -m state --state NEW -j ACCEPT
done

## Special ports
# Allow Protocol 41 for IPv6
$IPT -A INPUT -i $EXTIF -p 41 -s $EXTIP -j ACCEPT

## Outgoing
# Open TCP ports
for i in $EXTOUTTCP
do
	$IPT -A OUTPUT -o $EXTIF -p tcp -s $EXTIP --dport $i --syn -m state --state NEW -j ACCEPT
done

# Open UDP ports
for i in $EXTOUTUDP
do
	$IPT -A OUTPUT -o $EXTIF -p udp -s $EXTIP --dport $i -m state --state NEW -j ACCEPT
done

# Allow Protocol 41 for IPv6
$IPT -A OUTPUT -o $EXTIF -p 41 -s $EXTIP -j ACCEPT


####################
# Internal packets #
####################
## Incoming
# Open TCP ports
for i in $INTINTCP
do
	$IPT -A INPUT -i $INTIF -p tcp -d $INTIP --dport $i -j ACCEPT
	$IPT -A INPUT -i $INTIF -p tcp -d $EXTIP --dport $i --syn -m state --state NEW -j ACCEPT
done

# Open UDP ports
for i in $INTINUDP
do
	$IPT -A INPUT -i $INTIF -p udp -d $INTIP --dport $i -j ACCEPT
	$IPT -A INPUT -i $INTIF -p udp -d $EXTIP --dport $i -m state --state NEW -j ACCEPT
done

## Outgoing
# Open TCP ports
for i in $INTOUTTCP
do
	$IPT -A OUTPUT -o $INTIF -p tcp -s $INTIP --dport $i --syn -m state --state NEW -j ACCEPT
done

# Open UDP ports
for i in $INTOUTUDP
do
	$IPT -A OUTPUT -o $INTIF -p udp -s $INTIP --dport $i -m state --state NEW -j ACCEPT
done

$IPT -A INPUT -i $INTIF -p 41 -j ACCEPT
#ip6tables -A INPUT -i $INTIF -p ICMPv6 -j ACCEPT
$IPT -A OUTPUT -o $INTIF -p 41 -j ACCEPT
#ip6tables -A OUTPUT -o $INTIF -p ICMPv6 -j ACCEPT

######################
# Forwarding packets #
######################
# Enable IP forwarding
if [ $FWD = "1" ]; then
	echo "Starting NAT (Network Address Translation)..."
	$IPT -A FORWARD -i $EXTIF -o $INTIF -m state --state RELATED,ESTABLISHED -j ACCEPT
	$IPT -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
	$IPT -A FORWARD -i $VPNIF -o $INTIF -s $VPNIPRANGE -m state --state RELATED,ESTABLISHED -j ACCEPT
	$IPT -A FORWARD -i $INTIF -o $VPNIF -d $VPNIPRANGE -j ACCEPT
	$IPT --table nat -A POSTROUTING -o $VPNIF -d $VPNIPRANGE -j MASQUERADE
	$IPT --table nat -A POSTROUTING -o $EXTIF -j MASQUERADE
# MANGLES for traffic control
	$IPT --table mangle -A INPUT -i $EXTIF -j MARK --set-mark 10
	$IPT --table mangle -A OUTPUT -o $EXTIF -j MARK --set-mark 11
	$IPT --table mangle -A INPUT -i $INTIF -j MARK --set-mark 20
	$IPT --table mangle -A OUTPUT -o $INTIF -j MARK --set-mark 21
	$IPT --table mangle -A FORWARD -i $EXTIF -o $INTIF -j MARK --set-mark 22
	$IPT --table mangle -A POSTROUTING -o $EXTIF -j MARK --set-mark 24
	echo 1 > /proc/sys/net/ipv4/ip_forward

#####
######## Forward rules for Computer 1, FWDIP1.
#####
	# TCP

	for i in $FWD1TCP
	do
		$IPT --table nat -A PREROUTING -p tcp -i $EXTIF -d $EXTIP --dport $i -j DNAT --to $FWDIP1:$i
		$IPT -A FORWARD -p tcp -i $EXTIF -o $INTIF -d $FWDIP1 --dport $i -j ACCEPT
	done

	# UDP
	for i in $FWD1UDP
	do
		$IPT --table nat -A PREROUTING -p udp -i $EXTIF -d $EXTIP --dport $i -j DNAT --to $FWDIP1:$i
		$IPT -A FORWARD -p udp -i $EXTIF -o $INTIF -d $FWDIP1 --dport $i -j ACCEPT
	done

#####
######## Forward rules for Computer 2, FWDIP2.
#####
	# TCP

	for i in $FWD2TCP
	do
		$IPT --table nat -A PREROUTING -p tcp -i $EXTIF -d $EXTIP --dport $i -j DNAT --to $FWDIP2:$i
		$IPT -A FORWARD -p tcp -i $EXTIF -o $INTIF -d $FWDIP2 --dport $i -j ACCEPT
	done

	# UDP
	for i in $FWD2UDP
	do
		$IPT --table nat -A PREROUTING -p udp -i $EXTIF -d $EXTIP --dport $i -j DNAT --to $FWDIP2:$i
		$IPT -A FORWARD -p udp -i $EXTIF -o $INTIF -d $FWDIP2 --dport $i -j ACCEPT
	done

	# IPv6
	$IPT -A FORWARD -p 41 -i $EXTIF -o $INTIF -j ACCEPT
	$IPT -A FORWARD -p 41 -i $INTIF -o $EXTIF -j ACCEPT

####
####### Traffic Control
####
	echo "Starting traffic control..."

	# Flush all first
	$TC qdisc del dev $EXTIF root
	$TC qdisc del dev $INTIF root

	# Add roots
	$TC qdisc add dev $EXTIF parent root handle 1:0 htb default 10
	$TC qdisc add dev $INTIF parent root handle 2:0 htb default 22
	$TC class add dev $EXTIF parent 1:0 classid 1:1 htb rate ${NETMAX}kbit quantum 1500
	$TC class add dev $INTIF parent 2:0  classid 2:1 htb rate ${BANDMAX}kbit quantum 1500

	# Download
	$TC class add dev $EXTIF parent 1:1 classid 1:10 htb rate ${NETMAX}kbit
	$TC qdisc add dev $EXTIF parent 1:10 handle 10:0 sfq
	$TC class add dev $INTIF parent 2:1 classid 2:20 htb rate ${BANDMAX}kbit
	$TC qdisc add dev $INTIF parent 2:20 handle 20:0 sfq
	$TC class add dev $INTIF parent 2:1 classid 2:22 htb rate ${DOWNMAX}kbit ceil ${DOWNCEIL}kbit
#	$TC qdisc add dev $INTIF parent 2:22 classid 22:0 sfq

	# Upload
	$TC class add dev $EXTIF parent 1:1 classid 1:11 htb rate ${NETMAX}kbit
        $TC qdisc add dev $EXTIF parent 1:11 handle 11:0 sfq
        $TC class add dev $INTIF parent 2:1 classid 2:21 htb rate ${BANDMAX}kbit
	$TC qdisc add dev $INTIF parent 2:21 handle 21:0 sfq
        $TC class add dev $EXTIF parent 1:1 classid 1:24 htb rate ${UPMAX}kbit ceil ${UPCEIL}kbit
#        $TC qdisc add dev $INTIF parent 2:24 classid 24:0 sfq

	$TC filter add dev $EXTIF parent 1:0 protocol ip handle 10 fw classid 1:10
	$TC filter add dev $EXTIF parent 1:0 protocol ip handle 11 fw classid 1:11
	$TC filter add dev $INTIF parent 2:0 protocol ip handle 20 fw classid 2:20
	$TC filter add dev $INTIF parent 2:0 protocol ip handle 21 fw classid 2:21
	$TC filter add dev $INTIF parent 2:0 protocol ip handle 22 fw classid 2:22
	$TC filter add dev $EXTIF parent 1:0 protocol ip handle 24 fw classid 1:24

	$IP rule add fwmark 24 table 24
	$IP rule add fwmark 22 table 22
	$IP rule add fwmark 21 table 21
	$IP rule add fwmark 20 table 20
	$IP rule add fwmark 11 table 11
	$IP rule add fwmark 10 table 10

fi


###################
# VPN Connections #
###################
# On a VPN we allow everything.
if [ $VPN = "1" ]; then
	$IPT -A INPUT -i $VPNIF -j ACCEPT
	$IPT -A OUTPUT -o $VPNIF -j ACCEPT
fi


# Allow ping in
$IPT -A INPUT -i $EXTIF -p icmp -d $EXTIP --icmp-type 8 -m state --state NEW -j ACCEPT
$IPT -A INPUT -i $INTIF -p icmp -d $INTIP --icmp-type 8 -m state --state NEW -j ACCEPT

# Allow ping out
$IPT -A OUTPUT -o $EXTIF -p icmp -s $EXTIP --icmp-type 8 -m state --state NEW -j ACCEPT
$IPT -A OUTPUT -o $INTIF -p icmp -s $INTIP --icmp-type 8 -m state --state NEW -j ACCEPT


# Allow existing
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Block everything else and log
$IPT -A INPUT -j drop_input
$IPT -A OUTPUT -j drop_output
$IPT -A FORWARD -j drop_forward

# Done.
echo "Done."