[HaBo]

#!/bin/sh
#
# iptables firewall script v0.3
#
# get newer versions at www.zleep.org
# (c)2003 by mr_abe <cg@zleep.org>
#

EXT_DEV=eth4
INT0_DEV=eth0
INT0_NET=192.168.0.0/24
INT1_DEV=eth1
INT1_NET=192.168.1.0/24
INT2_DEV=eth2
INT2_NET=192.168.2.0/24
INT3_DEV=eth3
INT3_NET=192.168.3.0/24
IPTABLES=/sbin/iptables

case $1 in
        start)

            echo "Activate routing"
            # load required modules
            modprobe iptable_nat

            # flush all tables, an set all connections to accept
            $IPTABLES -t filter -F INPUT
            $IPTABLES -t filter -F OUTPUT
            $IPTABLES -t filter -F FORWARD
            $IPTABLES -t filter -P INPUT ACCEPT
            $IPTABLES -t filter -P OUTPUT ACCEPT
            $IPTABLES -t filter -P FORWARD ACCEPT

            # set up routing for internal network
            $IPTABLES -t nat -F POSTROUTING
            echo 1 > /proc/sys/net/ipv4/ip_forward
            $IPTABLES -t nat -A POSTROUTING -o $EXT_DEV -s $INT0_NET -j MASQUERADE
            $IPTABLES -t nat -A POSTROUTING -o $EXT_DEV -s $INT1_NET -j MASQUERADE
            $IPTABLES -t nat -A POSTROUTING -o $EXT_DEV -s $INT2_NET -j MASQUERADE
            $IPTABLES -t nat -A POSTROUTING -o $EXT_DEV -s $INT3_NET -j MASQUERADE
            #Anzeigen


            #new
            echo 1 > /proc/sys/net/ipv4/ip_dynaddr

            # accept all connections on localhost
            $IPTABLES -t filter -A INPUT -i lo -s 0/0 -d 0/0 -j ACCEPT
            $IPTABLES -t filter -A INPUT -i $INT0_DEV -s 0/0 -d 0/0 -j ACCEPT
            $IPTABLES -t filter -A INPUT -i $INT1_DEV -s 0/0 -d 0/0 -j ACCEPT
            $IPTABLES -t filter -A INPUT -i $INT2_DEV -s 0/0 -d 0/0 -j ACCEPT
            $IPTABLES -t filter -A INPUT -i $INT3_DEV -s 0/0 -d 0/0 -j ACCEPT

            # open some ports
            $IPTABLES -t filter -A INPUT -i $EXT_DEV -p tcp --dport 21 --syn -j ACCEPT
            $IPTABLES -t filter -A INPUT -i $EXT_DEV -p tcp --dport 22 --syn -j ACCEPT
            #$IPTABLES -t filter -A INPUT -i $EXT_DEV -p tcp --dport 23 --syn -j ACCEPT
            $IPTABLES -t filter -A INPUT -i $EXT_DEV -p tcp --dport 25 --syn -j ACCEPT
            $IPTABLES -t filter -A INPUT -i $EXT_DEV -p tcp --dport 53 --syn -j ACCEPT
            $IPTABLES -t filter -A INPUT -i $EXT_DEV -p udp --dport 53 -j ACCEPT            $IPTABLES -t filter -A INPUT -i $EXT_DEV -p tcp --dport 80 --syn -j ACCEPT
            $IPTABLES -t filter -A INPUT -i $EXT_DEV -p tcp --dport 110 --syn -j ACCEPT
            $IPTABLES -t filter -A INPUT -i $EXT_DEV -p tcp --dport 143 --syn -j ACCEPT
            $IPTABLES -t filter -A INPUT -i $EXT_DEV -p udp --dport 5060 -j ACCEPT
            $IPTABLES -t filter -A OUTPUT -o $EXT_DEV -p udp --dport 5060 -j ACCEPT
            $IPTABLES -t filter -A INPUT -i $EXT_DEV -p udp --dport 5069 -j ACCEPT
            $IPTABLES -t filter -A OUTPUT -o $EXT_DEV -p udp --dport 5069 -j ACCEPT
            $IPTABLES -t filter -A INPUT -i $EXT_DEV -p udp --dport 3478:3479 -j ACCEPT
            $IPTABLES -t filter -A OUTPUT -o $EXT_DEV -p udp --dport 3478:3479 -j ACCEPT
            $IPTABLES -t filter -A INPUT -i $EXT_DEV -p udp --dport 16384:16400 -j ACCEPT
            $IPTABLES -t filter -A OUTPUT -o $EXT_DEV -p udp --dport 16384:16400 -j ACCEPT

            # close some ports :)
            $IPTABLES -t filter -A INPUT -i $EXT_DEV -p udp --dport 123 -j REJECT
            $IPTABLES -t filter -A INPUT -i $EXT_DEV -p tcp --dport 515 -j REJECT
            #$IPTABLES -t filter -A INPUT -i $EXT_DEV -p tcp --dport 3306 -j REJECT
            #$IPTABLES -t filter -A INPUT -i $EXT_DEV -p tcp --dport 110 -j REJECT
            #$IPTABLES -t filter -A INPUT -i $EXT_DEV -p tcp --dport 143 -j REJECT

            #Forward this Ports to 192.168.2.2
            $IPTABLES -t nat -F PREROUTING
            $IPTABLES -t nat -A PREROUTING -i $EXT_DEV -p tcp --dport 4662 -j DNAT --to 192.168.2.2
 
            # don't route this ports/ips
            #$IPTABLES -t filter -A FORWARD -p tcp -i eth0 -s 10.10.12.21 -j REJECT
            #$IPTABLES -t filter -A FORWARD -p tcp -i eth0 -s 10.10.12.21 --dport 80 -j REJECT
            #$IPTABLES -t filter -A FORWARD -p tcp -i eth0 -s 10.10.12.21 --dport 7082 -j REJECT
            #$IPTABLES -t filter -A FORWARD -p tcp -i eth0 -s 10.10.12.20 -d www.uboot.com -j REJECT
 
            # set up some logging rules
            #$IPTABLES -t filter -A INPUT -p tcp -j LOG --log-prefix "INPUT: TCP "
            #$IPTABLES -t filter -A INPUT -p udp -j LOG --log-prefix "INPUT: UDP "
 
            echo "Firewall & Routing activated"
        ;;
        stop)
            $IPTABLES -t filter -F INPUT
            $IPTABLES -t filter -F OUTPUT
            $IPTABLES -t filter -F FORWARD
            $IPTABLES -t nat -F POSTROUTING
        ;;

        restart)
            $0 stop && $0 start
        ;;
 
        *)
            echo "Usage: $0 {start|stop|restart}"
        ;;