#!/bin/sh

##################################################
# Initialize
##################################################

#LoadModule
modprobe iptable_nat
modprobe ip_nat_ftp
modprobe ip_conntrack_ftp  

#Enable IP Forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

#Enable Dynamic IP
echo 1 > /proc/sys/net/ipv4/ip_dynaddr

#Measure of SYN flood
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

#Measure of Broadcast ping
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

#Refusal of Source-routed packets
for i in /proc/sys/net/ipv4/conf/*/accept_source_route;do
	echo 0 > $i
done

#Refusal of ICMP redirect
for i in /proc/sys/net/ipv4/conf/*/accept_redirects;do
	echo 0 > $i
done

#Setup of a variable
WAN_IF=eth0
LAN_IF=eth1
LOOPBACK_ADDR=127.0.0.0/8
PRV_CLASS_A_ADDR=10.0.0.0/8
PRV_CLASS_B_ADDR=172.16.0.0/12
PRV_CLASS_C_ADDR=192.168.0.0/16
CLASS_E_ADDR=240.0.0.0/5
ANY_ADDR=0.0.0.0/0
WAN_ADDR=`ifconfig eth0 | sed -e 's/^.*inet addr:\([0-9.]*\).*/\1/p' -e d`

#Flush All Chain
iptables -F
iptables -t nat -F 
iptables -X
iptables -Z

#Default Filtering Chain
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

##################################################
# Make New Chain
##################################################

#wan_server : WAN--->Server                  
#lan_server : LAN--->Server
#server_wan : Server--->WAN
#server_lan : Server--->LAN
#wan_lan : WAN--->LAN
#lan_wan : LAN--->WAN

#New Filtering_Chain
iptables -N wan_server
iptables -N lan_server
iptables -N server_wan
iptables -N server_lan
iptables -N wan_lan
iptables -N lan_wan
iptables -A INPUT -i $WAN_IF -j wan_server
iptables -A INPUT -i $LAN_IF -j lan_server
iptables -A OUTPUT -o $WAN_IF -j server_wan
iptables -A OUTPUT -o $LAN_IF -j server_lan
iptables -A FORWARD -i $WAN_IF -o $LAN_IF -j wan_lan
iptables -A FORWARD -i $LAN_IF -o $WAN_IF -j lan_wan

#New Loging_Drop_Chain
iptables -N log_drop
iptables -A log_drop -m limit --limit 1/s -j LOG
iptables -A log_drop -j DROP

##################################################
# Private,ClassE,Loopback,Bcast,Spoofing
##################################################

#Server-->WAN
for i in $PRV_CLASS_A_ADDR $PRV_CLASS_B_ADDR $PRV_CLASS_C_ADDR $CLASS_E_ADDR $LOOPBACK_ADDR
do
    iptables -A server_wan -d $i -j log_drop
done

#WAN--->Server
for i in $PRV_CLASS_A_ADDR $PRV_CLASS_B_ADDR $PRV_CLASS_C_ADDR $CLASS_E_ADDR $LOOPBACK_ADDR
do
    iptables -A wan_server -s $i -j log_drop
done

#LAN-->WAN
for i in $PRV_CLASS_A_ADDR $PRV_CLASS_B_ADDR $PRV_CLASS_C_ADDR $CLASS_E_ADDR $LOOPBACK_ADDR
do
    iptables -A lan_wan -d $i -j log_drop
done

#WAN-->LAN
for i in $PRV_CLASS_A_ADDR $PRV_CLASS_B_ADDR $PRV_CLASS_C_ADDR $CLASS_E_ADDR $LOOPBACK_ADDR
do
    iptables -A wan_lan -s $i -j log_drop
done

#Broadcast
iptables -A wan_server -d 255.255.255.255/32 -j log_drop

#Spoofing WAN_ADDR
iptables -A wan_server -s $WAN_ADDR -j log_drop

#Ident
iptables -A wan_server -p tcp --dport ident -j REJECT --reject-with tcp-reset

##################################################
# LAN--->WAN IP Masquerade
##################################################

#IPMasquerade
iptables -t nat -A POSTROUTING -o $WAN_IF -j MASQUERADE

##################################################
# lo Policy
##################################################

iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

##################################################
# Server--->LAN Policy
##################################################

iptables -A server_lan -j ACCEPT

##################################################
# LAN--->Server Policy
##################################################

iptables -A lan_server -j ACCEPT

##################################################
# Server--->WAN Policy
##################################################

#The packet to which connection establishes or relates
iptables -A server_wan  -m state --state ESTABLISHED,RELATED -j ACCEPT

#ICMP(Ping)
iptables -A server_wan -p icmp --icmp-type 8 -j ACCEPT

#SMTP(25/TCP)
iptables -A server_wan -p tcp --dport 25 -j ACCEPT

#DNS(53/UDP)
iptables -A server_wan -p udp --dport 53 -j ACCEPT

#NTP(123/UDP)
iptables -A server_wan -p udp --dport 123 -j ACCEPT

#Except the above
iptables -A server_wan -j log_drop

##################################################
# WAN--->Server Policy
##################################################

#The packet to which connection establishes or relates
iptables -A wan_server  -m state --state ESTABLISHED,RELATED -j ACCEPT

#ICMP(Ping)
iptables -A wan_server -p icmp --icmp-type 0 -j ACCEPT

#FTP-data(20/TCP)
iptables -A wan_server -p tcp --dport 20 -j ACCEPT

#FTP(21/TCP)
iptables -A wan_server -p tcp --dport 21 -j ACCEPT

#SMTP(25/TCP)
iptables -A wan_server -p tcp --dport 25 -j ACCEPT

#HTTP(80/TCP)
iptables -A wan_server -p tcp --dport 80 -j ACCEPT

#POP3(110/TCP)
iptables -A wan_server -p tcp --dport 110 -j ACCEPT

#Except the above
iptables -A wan_server -j log_drop

##################################################
# LAN--->WAN Policy.....ACCEPT
##################################################

#The packet to which connection establishes or relates
iptables -A lan_wan -m state --state ESTABLISHED,RELATED -j ACCEPT

#ICMP(Ping)
iptables -A lan_wan -p icmp --icmp-type 8 -j ACCEPT

#FTP-data(20/TCP)
iptables -A lan_wan -p tcp --dport 20 -j ACCEPT

#FTP(21/TCP)
iptables -A lan_wan -p tcp --dport 21 -j ACCEPT 

#SMTP(25/TCP)
iptables -A lan_wan -p tcp --dport 25 -j ACCEPT

#HTTP(80/TCP)
iptables -A lan_wan -p tcp --dport 80 -j ACCEPT
iptables -A lan_wan -p tcp --dport 8080 -j ACCEPT

#POP3(110/TCP)
iptables -A lan_wan -p tcp --dport 110 -j ACCEPT

#NTP(123/UDP)
iptables -A lan_wan -p udp --dport 123 -j ACCEPT

#HTTPS(443/TCP)
iptables -A lan_wan -p tcp --dport 443 -j ACCEPT

#Except the above
iptables -A lan_wan -j log_drop

##################################################
# WAN--->LAN Policy.....ACCEPT
##################################################

#The packet to which connection establishes or relates
iptables -A wan_lan -m state --state ESTABLISHED,RELATED -j ACCEPT

#ICMP(Ping)
iptables -A wan_lan -p icmp --icmp-type 0 -j ACCEPT

#Except the above
iptables -A wan_lan -j log_drop