#!/bin/sh                    
#
# Startup script for the firewall
# chkconfig: 1.2.3.4
# processname: fire


#modprobe ip_tables         
#modprobe ip_nat_ftp
#modprobe ip_conntrck_ftp


RETVAL=0

. /var/www/maincp/var/etc/netconfig

#IFIN="enp3s0"
#IFOUT="ens3"


start() {





#Flush all rules
/sbin/iptables -F
/sbin/iptables -F -t nat
#/sbin/iptables -F -t mangle

## FLUSH de reglas
/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -Z
/sbin/iptables -t nat -F

## Establecemos politica por defecto
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT



#Set default behaviour
#iptables -P INPUT DROP
#iptables -P FORWARD ACCEPT
#iptables -P OUTPUT ACCEPT

#Allow related and established on all interfaces (input)
/sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

#Allow releated, established and ssh on $IFOUT. Reject everything else.
#/sbin/iptables -A INPUT -i $IFIN -p tcp -m tcp --dport 22 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p tcp -m tcp --dport 80 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p tcp -m tcp --dport 81 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p tcp -m tcp --dport 443 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p tcp -m tcp --dport 119 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p tcp -m udp --dport 11235 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p tcp -m tcp --dport 11235 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p tcp -m tcp --dport 8080 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p tcp -m tcp --dport 4080 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p tcp -m tcp --dport 24554 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p udp -m tcp --dport 24554 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p tcp -m tcp --dport 7780:7794 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p udp -m tcp --dport 7780:7794 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p tcp -m tcp --dport 53 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p tcp -m udp --dport 53 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p tcp -m tcp --dport 123 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p tcp -m udp --dport 123 --syn -j ACCEPT


/sbin/iptables -A INPUT -i $IFOUT -p tcp -m tcp --dport 80 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFOUT -p tcp -m tcp --dport 81 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFOUT -p tcp -m tcp --dport 443 --syn -j ACCEPT

/sbin/iptables -A INPUT -i $IFIN -p tcp -m tcp --dport 3127 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p tcp -m tcp --dport 3128 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFIN -p tcp -m tcp --dport 3129 --syn -j ACCEPT


/sbin/iptables -A INPUT -i $IFOUT -p tcp -m tcp --dport 3127 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFOUT -p tcp -m tcp --dport 3128 --syn -j ACCEPT
/sbin/iptables -A INPUT -i $IFOUT -p tcp -m tcp --dport 3129 --syn -j ACCEPT




/sbin/iptables -A INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 443 --syn -j ACCEPT

/sbin/iptables -A INPUT -p tcp -m tcp --dport 2323 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 953 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 6881 --syn -j ACCEPT
/sbin/iptables -A INPUT -p udp -m tcp --dport 6881 --syn -j ACCEPT
/sbin/iptables -A INPUT -p udp -m tcp --dport 4662 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 4662 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 443 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 119 --syn -j ACCEPT
/sbin/iptables -A INPUT -p udp -m tcp --dport 11235 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 11235 --syn -j ACCEPT
/sbin/iptables -A INPUT -p udp -m tcp --dport 53 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 53 --syn -j ACCEPT
/sbin/iptables -A INPUT -p udp -m tcp --dport 123 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 123 --syn -j ACCEPT

#Allow 3990 on other interfaces (input).

#Allow related and established from $IFOUT. Drop everything else.
/sbin/iptables -A INPUT -i $IFOUT -j DROP

#Allow http and https on other interfaces (input).
#This is only needed if authentication server is on same server as chilli
/sbin/iptables -A INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 81 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 443 --syn -j ACCEPT
/sbin/iptables -A INPUT -p udp -m tcp --dport 53 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 443 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 1123 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 11235 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m udp --dport 1123 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m udp --dport 11235 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 123 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m udp --dport 123 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m udp --dport 53 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 135:140 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 445 --syn -j ACCEPT
/sbin/iptables -A INPUT -p udp -m tcp --dport 135:140 --syn -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 7770:7794 --syn -j ACCEPT
/sbin/iptables -A INPUT -p udp -m tcp --dport 7770:7794 --syn -j ACCEPT
#Allow 3990 on other interfaces (input).

#Allow ICMP echo on other interfaces (input).
#/sbin/iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
#Allow related and established from $IFOUT. Drop everything else.
/sbin/iptables -A INPUT -p tcp -m tcp -i $IFIN -j DROP

/sbin/iptables -A INPUT -p tcp -m udp -i $IFIN -j DROP
#Allow everything on loopback interface.
/sbin/iptables -A INPUT -i lo -j ACCEPT

# Drop everything to and from $IFOUT (forward)
# This means that access points can only be managed from ChilliSpot
/sbin/iptables -A FORWARD -p tcp -m tcp -i $IFOUT -j DROP
/sbin/iptables -A FORWARD -p tcp -m tcp -o $IFOUT -j DROP


 
# Post Auth

# 80 
## Empezamos a filtrar
## Nota: $IFIN es el interfaz conectado al router y $IFOUT a la LAN
# El localhost se deja (por ejemplo conexiones locales a mysql)
/sbin/iptables -A INPUT -i lo -j ACCEPT

# Al firewall tenemos acceso desde la red local
#/sbin/iptables -A INPUT -s $SN/$MASN -i tun0 -j ACCEPT
/sbin/iptables -A INPUT -s 172.31.182.1 -i tun0 -j ACCEPT

## Ahora con regla FORWARD filtramos el acceso de la red local
## al exterior. Como se explica antes, a los paquetes que no van dirigidos al
## propio firewall se les aplican reglas de FORWARD

 





#
# Aceptamos que vayan a puertos 
/sbin/iptables -I FORWARD -s $SN/$MASN -i tun0 -p tcp --dport 20:24 -j ACCEPT
/sbin/iptables -I FORWARD -s $SN/$MASN -i tun0 -p tcp --dport 26:53 -j ACCEPT
/sbin/iptables -I FORWARD -s $SN/$MASN -i tun0 -p tcp --dport 54:512 -j ACCEPT
/sbin/iptables -I FORWARD -s $SN/$MASN -i tun0 -p tcp --dport 514:1899 -j ACCEPT
/sbin/iptables -I FORWARD -s $SN/$MASN -i tun0 -p tcp --dport 1901:6659 -j ACCEPT
/sbin/iptables -I FORWARD -s $SN/$MASN -i tun0 -p tcp --dport 6899:6902 -j ACCEPT
/sbin/iptables -I FORWARD -s $SN/$MASN -i tun0 -p tcp --dport 7002:20000 -j ACCEPT
/sbin/iptables -I FORWARD -s $SN/$MASN -i tun0 -p tcp -m udp --dport 52:53 -j ACCEPT
/sbin/iptables -I FORWARD -s $SN/$MASN -i tun0 -p tcp -m udp --dport 123:123 -j ACCEPT
/sbin/iptables -I FORWARD -s $SN/$MASN -i tun0 -p tcp -m udp --dport 5000:11236 -j ACCEPT



# Y denegamos el resto. Si se necesita alguno, ya avisara

/sbin/iptables -I FORWARD -s $SN/$MASN -i tun0 -p tcp -j DROP
/sbin/iptables -I FORWARD -s $SN/$MASN -i tun0 -p udp -j DROP
/sbin/iptables -I FORWARD -s $SN/$MASN -i tun0 -p all -j DROP


#
# Redirecionamos al proxy


/sbin/iptables -I PREROUTING -t mangle -p tcp -s $SN/$MASN -d $SQU --dport 3127 -j DROP
/sbin/iptables -I PREROUTING -t mangle -p tcp -s $SN/$MASN -d $SQU --dport 3128 -j DROP
/sbin/iptables -I PREROUTING -t mangle -p tcp -s $SN/$MASN -d $SQU --dport 3129 -j DROP
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination $SQU:3128
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 81 -j DNAT --to-destination $SQU:3128
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination $SQU:3129
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 444 -j DNAT --to-destination $SQU:3129


#/sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3128
#/sbin/iptables -t nat -A PREROUTING -p tcp --dport 81 -j REDIRECT --to-port 3128
#/sbin/iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 3129
#/sbin/iptables -t nat -A PREROUTING -p tcp --dport 444 -j REDIRECT --to-port 3129
#/sbin/iptables -t nat -A PREROUTING -i tun0 -p tcp --dport 80 -j REDIRECT --to-port 3128
#/sbin/iptables -t nat -A PREROUTING -i tun0 -p tcp --dport 81 -j REDIRECT --to-port 3128
#/sbin/iptables -t nat -A PREROUTING -i tun0 -p tcp --dport 443 -j REDIRECT --to-port 3129
#/sbin/iptables -t nat -A PREROUTING -i tun0 -p tcp --dport 444 -j REDIRECT --to-port 3129

/sbin/iptables -t nat -I PREROUTING -s $SN/$MASN --dst $SQU -p tcp --dport 443 -j REDIRECT --to-port 443
/sbin/iptables -t nat -I OUTPUT -s $SN/$MASN --dst $SQU -p tcp --dport 443 -j REDIRECT --to-port 443

# Ahora hacemos enmascaramiento de la red local
# y activamos el BIT DE FORWARDING (imprescindible!!!!!)


/sbin/iptables -t nat -A POSTROUTING -o $IFIN -j MASQUERADE 




# Con esto permitimos hacer forward de paquetes en el firewall, o sea
# que otras máquinas puedan salir a traves del firewall.

echo 1 > /proc/sys/net/ipv4/ip_forward

## Y ahora cerramos los accesos indeseados del exterior:
# Nota: 0.0.0.0/0 significa: cualquier red

# Cerramos el rango de puerto bien conocido
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFOUT -p tcp --dport 1:20 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFOUT -p tcp --dport 22:52 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFOUT -p tcp --dport 54:79 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFOUT -p tcp --dport 82:118 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFOUT -p tcp --dport 124:442 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFOUT -p tcp --dport 447:2322 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFOUT -p tcp --dport 2324:3127 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFOUT -p tcp --dport 3130:3989 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFOUT -p tcp --dport 3991:4079 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFOUT -p tcp --dport 4081:4661 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFOUT -p tcp --dport 4663:4989 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFOUT -p tcp --dport 4991:6881 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFOUT -p tcp --dport 6883:7778 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFOUT -p udp --dport 1:52 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFOUT -p udp --dport 54:122 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFOUT -p udp --dport 124:65535 -j DROP

# el otro lado
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFIN -p tcp --dport 1:20 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFIN -p tcp --dport 22:52 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFIN -p tcp --dport 54:79 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFIN -p tcp --dport 82:118 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFIN -p tcp --dport 124:442 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFIN -p tcp --dport 447:2322 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFIN -p tcp --dport 2324:3127 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFIN -p tcp --dport 3130:3989 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFIN -p tcp --dport 3991:4079 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFIN -p tcp --dport 4081:4661 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFIN -p tcp --dport 4663:4989 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFIN -p tcp --dport 4991:6881 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFIN -p tcp --dport 6883:7778 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFIN -p udp --dport 1:52 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFIN -p udp --dport 54:122 -j DROP
/sbin/iptables -A INPUT -s 0.0.0.0/0 -i $IFIN -p udp --dport 124:7778 -j DROP




# Anti-flooding o inundación de tramas SYN.

/sbin/iptables -N syn-flood
/sbin/iptables -A INPUT -i $IFOUT -p tcp --syn -j syn-flood
/sbin/iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
/sbin/iptables -A syn-flood -j DROP

/sbin/iptables -N syn-flood
/sbin/iptables -A INPUT -i $IFIN -p tcp --syn -j syn-flood
/sbin/iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
/sbin/iptables -A syn-flood -j DROP


rm -f /var/www/maincp/sub/BAN/*

# reponemos el ban

sleep 1

/var/www/maincp/root/bangmc 1>& /dev/null



# close subnets

/sbin/iptables -I INPUT -p all -m iprange --src-range 10.0.0.0-10.255.255.255 -m state --state NEW,ESTABLISHED -j DROP
/sbin/iptables -I FORWARD -p all -m iprange --src-range 10.0.0.0-10.255.255.255 -m state --state NEW,ESTABLISHED -j DROP



/sbin/iptables -I INPUT -p all -m iprange --src-range 172.16.0.0-172.29.255.255 -m state --state NEW,ESTABLISHED -j DROP
/sbin/iptables -I FORWARD -p all -m iprange --src-range 172.16.0.0-172.29.255.255 -m state --state NEW,ESTABLISHED -j DROP


/sbin/iptables -I INPUT -p all -m iprange --src-range 192.168.0.0-192.168.1.2 -m state --state NEW,ESTABLISHED -j DROP
/sbin/iptables -I FORWARD -p all -m iprange --src-range 192.168.0.0-192.168.1.2 -m state --state NEW,ESTABLISHED -j DROP
/sbin/iptables -I INPUT -p all -m iprange --src-range 192.168.1.28-192.168.1.31 -m state --state NEW,ESTABLISHED -j DROP
/sbin/iptables -I FORWARD -p all -m iprange --src-range 192.168.1.28-192.168.1.31 -m state --state NEW,ESTABLISHED -j DROP
/sbin/iptables -I INPUT -p all -m iprange --src-range 192.168.1.50-192.168.255.255 -m state --state NEW,ESTABLISHED -j DROP
/sbin/iptables -I FORWARD -p all -m iprange --src-range 192.168.1.50-192.168.255.255 -m state --state NEW,ESTABLISHED -j DROP






#/sbin/ethtool -s $IFOUT speed 10 duplex full

sleep 1

#/var/www/maincp/tools/ws10 stop

/var/www/maincp/fire/virt

echo " OK . Verifique que lo que se aplica con: iptables -L -n"


# Fin del script
sleep 1






}
stop() {

#Flush all rules
/sbin/iptables -F
/sbin/iptables -F -t nat
/sbin/iptables -F -t mangle

## FLUSH de reglas
/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -Z
/sbin/iptables -t nat -F

 

}

RETVAL=0
# See how we were called.
case "$1" in
	start)
		start
		;;
	stop)
		stop
		;;
	restart)
		stop
		start
		;;
	*)
		echo $"Usage: $prog {start|stop|restart}"
		RETVAL=1
esac

exit $RETVAL







 
