#! /bin/sh
# description: Inicialização do iptables
#
# chkconfig: 2345 80 30
# processname: iptables
# pidfile: /var/run/iptabless.pid

. /etc/rc.d/init.d/functions
. /etc/sysconfig/network

IPTABLES="/usr/sbin/iptables"
varok(){
success
echo -en "\n"
return 0
}

if [ ${NETWORKING} = "no" ]
then
exit 0
fi

case "$1" in
start)
gprintf "Iniciando o serviço de %s: " "Firewall"
success
############ Regras do firewall #######

# Ativa roteamento de pacotes
echo 1 > /proc/sys/net/ipv4/ip_forward
echo -en "\nFirewall: Ativa roteamento:"
varok

# Anula pacotes ICMP (Ping)
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo -en "Firewall: Protege contra Ping:"
varok

# Protege contra ICMP Broadcasting
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo -en "Firewall: Protege contra ICMP Broadcasting:"
varok

# Protege contra synflood
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo -en "Firewall: Protege contra synflood:"
varok

# Proteções contra portscanners

$IPTABLES -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
$IPTABLES -A FORWARD -p tcp -m limit --limit 1/s -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
$IPTABLES -A FORWARD --protocol tcp --tcp-flags ALL SYN,ACK -j DROP
# $IPTABLES -A FORWARD -m unclean -j DROP
echo -en "Firewall: Protege contra portscanners:"
varok

# Proteções diversas
$IPTABLES -N VALID_CHECK
$IPTABLES -A VALID_CHECK -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
$IPTABLES -A VALID_CHECK -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
$IPTABLES -A VALID_CHECK -p tcp --tcp-flags ALL ALL -j DROP
$IPTABLES -A VALID_CHECK -p tcp --tcp-flags ALL FIN -j DROP
$IPTABLES -A VALID_CHECK -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPTABLES -A VALID_CHECK -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$IPTABLES -A VALID_CHECK -p tcp --tcp-flags ALL NONE -j DROP
echo -en "Firewall: Protege contra ataques diversos:"
varok

# Políticas Default
$IPTABLES -t filter -P INPUT ACCEPT
echo -en "Firewall: Política Default: INPUT ACCEPT:"
varok

$IPTABLES -t filter -P FORWARD DROP
echo -en "Firewall: Política Default: FORWARD DROP:"
varok

$IPTABLES -t filter -P OUTPUT ACCEPT
echo -en "Firewall: Política Default: OUTPUT ACCEPT:"
varok

$IPTABLES -t nat -A POSTROUTING -s 192.168.1.0/255.255.255.0 -o eth0 -j MASQUERADE
echo -en "Firewall:MASQUERADE (NAT) da Rede 192.168.1.0"
varok

########## Coloques suas regras aqui ############
# Se quiser que apareça OK no final da regra acrescente as linhas
# seguintes após a regra.
# echo -en "Firewall:MASQUERADE (NAT) da Rede 192.168.1.0"
# varok
#####################################

;;

stop)

gprintf "Parando o serviço de %s: " "IPtables"
echo
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -X VALID_CHECK
success
;;
*)
gprintf "Uso: iptables (start|stop)"
echo
;;
esac

exit 0

Iniciando o serviço de Firewall:              [  OK  ]
Firewall: Ativa roteamento:                   [  OK  ]
Firewall: Protege contra Ping:                [  OK  ]
Firewall: Protege contra ICMP Broadcasting:   [  OK  ]
Firewall: Protege contra synflood:            [  OK  ]
Firewall: Protege contra portscanners:        [  OK  ]
Firewall: Protege contra ataques diversos:    [  OK  ]
Firewall: Política Default: INPUT ACCEPT:     [  OK  ]
Firewall: Política Default: FORWARD DROP:     [  OK  ]
Firewall: Política Default: OUTPUT ACCEPT:    [  OK  ]
Firewall:MASQUERADE (NAT) da Rede 192.168.1.0 [  OK  ]