#!/bin/bash
### BEGIN INIT INFO
# Provides:          tic
# Required-Start:    $all
# Required-Stop:     $all
# Default-Start:     2 3 4 5
# Default-Stop:	     0 1 6	
# Short-Description: tic
# Description: Enable iptables firewall rules 
### END INIT INFO


IFEXT="ppp0"
IFINT="eth1"
REDEINT="192.168.0.0/255.255.255.0"

/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp

if [ "$1" == "stop" ]; then
        iptables -F
        iptables -Z
        iptables -X
        iptables -t nat -F
 	iptables -t nat -Z
 	iptables -t nat -X
        iptables -P INPUT ACCEPT
        iptables -P FORWARD ACCEPT
        iptables -P OUTPUT ACCEPT
        exit
fi

##########################################################################
#                              TABELA FILTER                             #
##########################################################################

#------------------------------------------------------------------------#
#LIMPANDO REGRAS                                                         #
#------------------------------------------------------------------------#
iptables -F
iptables -Z
iptables -X
iptables -t nat -F
iptables -t nat -Z
iptables -t nat -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

#------------------------------------------------------------------------#
#HABILITANDO ACESSO SSH                                                  #
#------------------------------------------------------------------------#
iptables -A INPUT -p TCP --dport 1046 -j ACCEPT
iptables -A INPUT -p TCP --dport 22 -j ACCEPT

#------------------------------------------------------------------------#
#LIBERANDO A CHAIN INPUT PARA O localhost E REDE LOCAL                   #
#------------------------------------------------------------------------#
iptables -A INPUT -p ALL -s 127.0.0.1 -i lo -j ACCEPT


#------------------------------------------------------------------------#
#MANTENDO CONEXOES ATIVAS                                                #
#------------------------------------------------------------------------#
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

#------------------------------------------------------------------------#
#LIBERANDO ALGUNS ACESSOS POR PING:                                      #
#------------------------------------------------------------------------#
iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 0 -j ACCEPT
                                
##########################################################################
#                                PROTECOES                               #
##########################################################################

#------------------------------------------------------------------------#
#DESCARTANDO PACOTES FREGMENTADOS                                        #
#------------------------------------------------------------------------#
iptables -A INPUT -i $IFEXT -f -j DROP

#------------------------------------------------------------------------#
#BLOQUEANDO ATAQUES DO TIPO SPOOF DE IP PARA INTERFACES EXTERNAS         #
#------------------------------------------------------------------------#
iptables -A INPUT -i $IFEXT -s 10.0.0.0/8 -j DROP
iptables -A INPUT -i $IFEXT -s 172.16.0.0/12 -j DROP
iptables -A INPUT -i $IFEXT -s 192.168.0.0/16 -j DROP
iptables -A INPUT -i $IFEXT -s 224.0.0.0/4 -j DROP
iptables -A INPUT -i $IFEXT -s 240.0.0.0/5 -j DROP

#------------------------------------------------------------------------#
#DESCARTANDO PACOTES INVALIDOS:                                          #
#------------------------------------------------------------------------#
iptables -A FORWARD -m state --state INVALID -j DROP

##########################################################################
#                             Regras FORWARD                             #
##########################################################################


#------------------------------------------------------------------------#
#HABILITANDO O ROTEAMENTO DE PACOTES:                                    #
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

#------------------------------------------------------------------------#
#MANTENDO CONEXOES ATIVAS:                                               #
#------------------------------------------------------------------------#
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT  

#------------------------------------------------------------------------#
#LIBERANDO ACCESSO A DNS DE FORA                                         #
#------------------------------------------------------------------------#
iptables -A FORWARD -p udp --dport 53 -j ACCEPT

#------------------------------------------------------------------------#
#LIBERANDO PING                                                          #
#------------------------------------------------------------------------#
iptables -A FORWARD -p icmp -j ACCEPT

#------------------------------------------------------------------------#
#LIBERA ACESSO SMTP E POP                                                #
#------------------------------------------------------------------------#
iptables -A FORWARD -p tcp --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp --dport 110 -j ACCEPT
	
#------------------------------------------------------------------------#
#FAZENDO O MASCARAMENTO DE ENDERECOS IP #NAO NAT#                        #
#------------------------------------------------------------------------#
iptables -t nat -A POSTROUTING -o $IFEXT -j MASQUERADE

##########################################################################
# REGRAS DE REDIRECIONAMENTO
##########################################################################

# Ativa o Proxy Transparente
#__________________________________________________________________________________________
iptables -I INPUT -p tcp --dport 3128 -j DROP
#iptables -I INPUT -i eth1 -p tcp -s $REDEINT --dport 3128 -j ACCEPT
#iptables -t nat -A PREROUTING -i $IFINT -s $REDEINT -p tcp --dport 80 -j REDIRECT --to-port 3128

#iptables -t nat -A PREROUTING -i $IFINT1 -s $REDEINT1 -d 64.233.171.85 -p tcp --dport 443 -j REDIRECT --to-port 8080
#iptables -A INPUT -i $IFEXT -p tcp --dport 8080 -s ! 192.168.10.0 -j DROP	

# Redirecionamento 
#__________________________________________________________________________________________
#servidor windows aplicacao web
iptables -t nat -A PREROUTING -d 187.120.137.9 -p TCP --dport 80 -j DNAT --to 192.168.0.185:80

#Redirecionamento do TS no servidor windows
iptables -t nat -A PREROUTING -i $IFEXT -p tcp --dport 3303 -j DNAT --to-destination 192.168.0.185:3389
#Servidor que esta conectado no PABX via serial
iptables -t nat -A PREROUTING -i $IFEXT -p tcp --dport 3304 -j DNAT --to-destination 192.168.0.190:3389
iptables -t nat -A PREROUTING -i $IFEXT -p tcp --dport 61080 -j DNAT --to-destination 192.168.0.190:61080


#Redirecionamento cameras
iptables -t nat -A PREROUTING -d 187.120.137.9 -p TCP --dport 8080 -j DNAT --to 192.168.0.108:8080
iptables -t nat -A PREROUTING -d 187.120.137.9 -p TCP --dport 37777 -j DNAT --to 192.168.0.108:37777
iptables -t nat -A PREROUTING -d 187.120.137.9 -p TCP --dport 37776 -j DNAT --to 192.168.0.109:37776
iptables -t nat -A PREROUTING -d 187.120.137.9 -p TCP --dport 61080 -j DNAT --to 192.168.0.190:61080
iptables -t nat -A PREROUTING -d 187.120.137.9 -p TCP --dport 1433 -j DNAT --to 192.168.0.116:1433
iptables -t nat -A PREROUTING -d 187.120.137.9 -p TCP --dport 9009 -j DNAT --to 192.168.0.79:9009
iptables -t nat -A PREROUTING -i $IFEXT -p TCP --dport 9009 -j DNAT --to 192.168.0.79


#Alarme
iptables -t nat -A PREROUTING -i $IFEXT -p TCP --dport 9010 -j DNAT --to 192.168.0.185
iptables -t nat -A PREROUTING -i $IFEXT -p UDP --dport 9010 -j DNAT --to 192.168.0.185
iptables -t nat -A PREROUTING -i $IFEXT -p tcp --dport 9010 -j DNAT --to-destination 192.168.0.185:9010
iptables -t nat -A PREROUTING -i $IFEXT -p udp --dport 9010 -j DNAT --to-destination 192.168.0.185:9010








#iptables -t nat -A PREROUTING -i $IFEXT -p tcp --dport 80 -j DNAT --to-destination 192.168.0.3:80
#iptables -t nat -A PREROUTING -i $IFEXT0 -p TCP --dport 1 -j DNAT --to 192.168.0.5



#Liberando acesso IP


#VPN
#iptables -A FORWARD -i eth0 -o ppp+ -m state --state NEW -p gre -j ACCEPT
#iptables -A FORWARD -i ppp+ -o eth0 -m state --state NEW -p gre -j ACCEPT
#

#iptables -t nat -A POSTROUTING -p tcp -s 192.168.10.3 --dport 47 -j MASQUERADE
#iptables -t nat -A POSTROUTING -p tcp -s 192.168.10.3 --dport 1723 -j MASQUERADE

#iptables -t nat -A PREROUTING -i $IFEXT -m multiport -p tcp --port 1723,47 -j DNAT --to-destination 192.168.10.3:1723
#iptables -A FORWARD -m multiport -p tcp --port 1723,47 -j ACCEPT

#iptables -t nat -A PREROUTING -p tcp --dport 47 -j DNAT --to 192.168.10.3:47
#iptables -t nat -A PREROUTING -p tcp --dport 1723 -j DNAT --to 192.168.10.3:1723
#iptables -t nat -A PREROUTING -p tcp --dport 127 -j DNAT --to 192.168.10.3:127

#iptables -t nat -A POSTROUTING -d 187.39.17.190 -p tcp --dport 6000 -j SNAT --to-source 192.168.10.3

#iptables -t nat -A PREROUTING -i $IFEXT -p tcp -s 177.34.238.7 -j DNAT --to 192.168.10.3
#iptables -t nat -A PREROUTING -i $IFEXT -p tcp --dport 47 -j DNAT --to 192.168.10.3

#iptables -t nat -A PREROUTING -i $IFEXT -p udp --dport 1723 -j DNAT --to 192.168.10.3
#iptables -t nat -A PREROUTING -i $IFEXT -p udp --dport 47 -j DNAT --to 192.168.10.3

#iptables -t nat -A PREROUTING -d 187.39.17.190 -p tcp --dport 1723 -j DNAT --to 192.168.10.3
#iptables -t nat -A PREROUTING -d 187.39.17.190 -p tcp --dport 47 -j DNAT --to 192.168.10.3

