#!/bin/bash

echo
echo " Iniciando o FIREWALL"
echo
sleep 1

echo " Definindo variáveis"

IPTABLES="/usr/sbin/iptables"
INTERNA="192.168.0.1" # IP da placa interna
EXTERNA="10.1.1.3" # IP da placa externa
REDEINTERNA="192.168.0.0/24" # rede interna
REDEEXTERNA="10.1.1.0/24"
#echo " Habilitando o forward entre as interfaces"
#sleep 1
#echo "1" > /proc/sys/net/ipv4/ip_forward # habilitando o roteamento

echo " Carregando os módulos necessários"
sleep 1
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_tables

echo " Limpando as regras da tabela nat"
sleep 1
$IPTABLES -t nat -F
$IPTABLES -t nat -X
$IPTABLES -t nat -Z

echo " Limpando as regras da tabela filter"
sleep 1
$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z

echo " Definindo as polices"
sleep 1
$IPTABLES -P INPUT DROP # drop nega tudo
$IPTABLES -P FORWARD DROP # ninguem passa pelo firewall

echo " Permitindo conexoes loopback"
# Liberando acessos para o próprio micro
sleep 1
$IPTABLES -A INPUT -s 127.0.0.1 -j ACCEPT
$IPTABLES -A INPUT -s $EXTERNA -j ACCEPT
$IPTABLES -A INPUT -s $INTERNA -j ACCEPT

echo " Permitindo conexoes para a placa interna"
sleep 1

$IPTABLES -A INPUT -d $INTERNA -p icmp -j ACCEPT # aceita ping
$IPTABLES -A INPUT -d $INTERNA -p tcp --dport 80 -j ACCEPT # http WEB
$IPTABLES -A INPUT -d $INTERNA -p tcp --dport 443 -j ACCEPT # https
$IPTABLES -A INPUT -d $INTERNA -p udp --dport 53 -j ACCEPT # dns
$IPTABLES -A INPUT -d $INTERNA -p tcp --dport 53 -j ACCEPT # dns
$IPTABLES -A INPUT -d $INTERNA -p tcp --dport 25 -j ACCEPT # SMTP
$IPTABLES -A INPUT -d $INTERNA -p tcp --dport 110 -j ACCEPT # POP3
$IPTABLES -A INPUT -d $INTERNA -p tcp --dport 143 -j ACCEPT # imap
$IPTABLES -A INPUT -d $INTERNA -p tcp --dport 143 -j ACCEPT # imap
$IPTABLES -A INPUT -d $INTERNA -p udp --dport 3128 -j ACCEPT # proxy
$IPTABLES -A INPUT -d $INTERNA -p tcp --dport 3128 -j ACCEPT # proxy

echo " Permitindo conexoes para a placa externa"
sleep 1
# Permitindo o acesso da internet para o firewall
$IPTABLES -A INPUT -d $EXTERNA -p udp --dport 53 -j ACCEPT
$IPTABLES -A INPUT -d $EXTERNA -p tcp --dport 53 -j ACCEPT
$IPTABLES -A INPUT -d $EXTERNA -p tcp --dport 25 -j ACCEPT
$IPTABLES -A INPUT -d $EXTERNA -p tcp --dport 80 -j ACCEPT

# Exemplo de conexão para a placa de rede externa via MAC Address
# $IPTABLES -A INPUT -d $EXTERNA -m mac --mac-source 00:10:DC:55:D6:A9 -p tcp --dport 22 -j ACCEPT

# Exemplo de uma máquina externa (modem) para acessar a placa externa de
# um único endereço externo não para toda a Internet
# $IPTABLES -A INPUT -s 10.1.1.1 -d $EXTERNA -p tcp --dport 20 -j ACCEPT
# $IPTABLES -A INPUT -s 10.1.1.1 -d $EXTERNA -p tcp --dport 21 -j ACCEPT
# $IPTABLES -A INPUT -s 10.1.1.1 -d $EXTERNA -p tcp --dport 22 -j ACCEPT

echo " Habilitando statefull"
sleep 1

$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

echo " Permitindo a saida da rede interna"
sleep 1

$IPTABLES -A FORWARD -s $REDEINTERNA -p icmp -j ACCEPT
# Libera web
$IPTABLES -A FORWARD -s $REDEINTERNA -p tcp --dport 80 -j ACCEPT
# Sem proxy
$IPTABLES -A FORWARD -s $REDEINTERNA -p udp --dport 80 -j ACCEPT

echo " Habilitando o masquerade"
sleep 1
# Habilitando o mascaramento

$IPTABLES -t nat -A POSTROUTING -s $REDEINTERNA -j MASQUERADE

echo " Permitindo a entrada para a rede interna"
sleep 1
$IPTABLES -A FORWARD -d 192.168.0.1 -p tcp --dport 3389 -j ACCEPT
$IPTABLES -A FORWARD -d 192.168.0.1 -p tcp --dport 20 -j ACCEPT
$IPTABLES -A FORWARD -d 192.168.0.1 -p tcp --dport 21 -j ACCEPT

echo " Redirecionando portas do Firewall para Web Server e FTP Server"
sleep 1
# NAT reverso

$IPTABLES -t nat -A PREROUTING -d $EXTERNA -p tcp --dport 3389 -j DNAT --to 192.168.0.1
$IPTABLES -t nat -A PREROUTING -d $EXTERNA -p tcp --dport 20 -j DNAT --to 192.168.0.1
$IPTABLES -t nat -A PREROUTING -d $EXTERNA -p tcp --dport 21 -j DNAT --to 192.168.0.1

echo " Protecao contra ping da morte"
sleep 1

$IPTABLES -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

echo " Gerando Logs"
sleep 1
$IPTABLES -A INPUT -d $INTERNA -j LOG
$IPTABLES -A INPUT -d $EXTERNA -j LOG
$IPTABLES -A FORWARD -s $REDEINTERNA -j LOG
$IPTABLES -A FORWARD -d $REDEINTERNA -j LOG