#!/bin/sh

#Internet=eth0
#Rede Interna=eth1

# Ativa módulos
modprobe ip_tables
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_nat_ftp
modprobe ipt_REJECT
modprobe ipt_MASQUERADE

# Zera regras
iptables -F
iptables -X
iptables -F -t nat
iptables -X -t nat
iptables -F -t filter
iptables -X -t filter


# Determina a política padrão
iptables -P INPUT DROP
iptables -P FORWARD DROP

# Aceita os pacotes que realmente devem entrar
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Controle de acesso IP X MAC

#0001
iptables -t filter -A FORWARD -d 0/0 -s 192.168.1.2 -m mac --mac-source 90:E6:BA:A4:2B:C8 -j ACCEPT
iptables -t filter -A FORWARD -d 192.168.1.3 -s 0/0 -j ACCEPT
iptables -t filter -A INPUT -s 192.168.1.3 -d 0/0 -m mac --mac-source 90:E6:BA:A4:2B:C8 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.1.2 -o eth0 -j MASQUERADE

#0002
iptables -t filter -A FORWARD -d 0/0 -s 192.168.1.3 -m mac --mac-source 00:1E:0B:45:13:DD -j ACCEPT
iptables -t filter -A FORWARD -d 192.168.1.2 -s 0/0 -j ACCEPT
iptables -t filter -A INPUT -s 192.168.1.3 -d 0/0 -m mac --mac-source 00:1E:0B:45:13:DD -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.1.2 -o eth1 -j MASQUERADE

#0003
iptables -t filter -A FORWARD -d 0/0 -s 192.168.1.4 -m mac --mac-source 00:1E:0B:45:13:DD -j ACCEPT
iptables -t filter -A FORWARD -d 192.168.1.4 -s 0/0 -j ACCEPT
iptables -t filter -A INPUT -s 192.168.1.4 -d 0/0 -m mac --mac-source 00:1E:0B:45:13:DD -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.1.4 -o eth1 -j MASQUERADE


#Compartilha a conexão
echo 1 > /proc/sys/net/ipv4/ip_forward

#transfere porta 80 para 3128
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128

# Abre uma porta (inclusive para a Internet). Neste caso apenas deixamos aberto o acesso para SSH, Proxy e DNS.

iptables -A INPUT -p tcp --destination-port 22 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 53 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 3128 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 80 -j ACCEPT

# Proteções diversas contra portscanners, ping of death, ataques DoS, etc.
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD --protocol tcp --tcp-flags ALL SYN,ACK -j DROP
iptables -A FORWARD -m unclean -j DROP

# Abre para a interface de loopback.
iptables -A INPUT -i lo -j ACCEPT

# BLOQUEIA O QUE NÃO SE ENCAIXA NAS REGRAS ACIMA
iptables -A INPUT -p tcp --syn -j DROP
iptables -P FORWARD DROP