#!/bin/sh

# $Id: firewall.ini,v 1.6 2005/09/25 22:15:40 thomasez Exp $

# If you want the box to just act as a router, uncomment the 2 lines below
#echo 1 > /proc/sys/net/ipv4/ip_forward
#exit 0

#
# Firewall setup.
#
. /etc/config

#
# Do you want to do port forwaring to an internal server?
# Set the server IP here and sort out the port stuff later in this file.
#
SERVER_IP=10.42.42.42

#
# Stopping forwarding (this script may be run during normal uptime because
# for re-lease of HDCP or demand dialing / PPPoE.
#
echo "0" > /proc/sys/net/ipv4/ip_forward

#
# Overriding the /etc/config and adding additional information.
#
. /etc/outside.info
. /etc/inside.info

#
# Brad suggested this:
# And he suggested to check and maybe change the formatting.
# We'll do that later.
#
echo "Starting firewall with the following config:"
printf "\t\t   Inside\t\tOutside
 Physical device:  %-15s\t%-15s
  Logical device:  %-15s\t%-15s
\t Network:  %-15s\t%-15s
      IP Address:  %-15s\t%-15s
\t Netmask:  %-15s\t%-15s
       Broadcast:  %-15s\t%-15s
\t Gateway:  %-15s\t%-15s\n"	$INSIDE_DEV		$OUTSIDE_DEV \
				$INSIDE_DEVICE		$OUTSIDE_DEVICE \
				$INSIDE_NETWORK 	$OUTSIDE_NETWORK \
				$INSIDE_IP		$OUTSIDE_IP \
				$INSIDE_NETMASK		$OUTSIDE_NETMASK \
				$INSIDE_BROADCAST	$OUTSIDE_BROADCAST \
				"[None Set]"		$OUTSIDE_GATEWAY

#
# Flushing the chains.
#

iptables -F
iptables -X
iptables -Z
for i in `cat /proc/net/ip_tables_names`
  do 
   iptables -F -t $i 
   iptables -X -t $i 
   iptables -Z -t $i 
 done


#
# Policy for chains DROP everything
#

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

#
# SYN-Flooding protection
# Looks good and nicked from a firewall script mentioned on floppyfw.something.
# Didn't work that well.. 
#
iptables -N syn-flood
iptables -A INPUT -i ${OUTSIDE_DEVICE} -p tcp --syn -j syn-flood
iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
iptables -A syn-flood -j DROP
# Make sure NEW tcp connections are SYN packets
iptables -A INPUT -i ${OUTSIDE_DEVICE} -p tcp ! --syn -m state --state NEW -j DROP 


#
# Good old masquerading.
#
iptables -t nat -A POSTROUTING -s ${INSIDE_NETWORK}/${INSIDE_NETMASK} -o ${OUTSIDE_DEVICE} -j MASQUERADE
 
#
# Forwarding outside ports to an internal server.
# This used to be the ipchains / ipmasqadm portfw commad.
#
# SSH:

#iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP} --dport 22 -j DNAT --to ${SERVER_IP}:22 
#iptables -A FORWARD -p tcp -d ${SERVER_IP} --dport 22 -o ${INSIDE_DEVICE} -j ACCEPT


# Web:
#iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP} --dport 80 -j DNAT --to ${SERVER_IP}:80 
#iptables -A FORWARD -p tcp -d ${SERVER_IP} --dport 80 -o ${INSIDE_DEVICE} -j ACCEPT
# This rule helps the "I can't reach my web server from the inside" problem.
#iptables -A POSTROUTING -t nat -p tcp -d ${SERVER_IP} --dport 80 -s ${INSIDE_NETWORK}/${INSIDE_NETMASK} -j SNAT --to ${OUTSIDE_IP}

# FTP:

#iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP} --dport 21 -j DNAT --to ${SERVER_IP}:21 
#iptables -A FORWARD -p tcp -d ${SERVER_IP} --dport 21 -o ${INSIDE_DEVICE} -j ACCEPT

# SMTP (Internal mail server):
#iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP} --dport 25 -j DNAT --to ${SERVER_IP}:25 
#iptables -A FORWARD -p tcp -d ${SERVER_IP} --dport 25 -o ${INSIDE_DEVICE} -j ACCEPT
# This rule helps the "I can't reach my server from the inside" problem.
#iptables -A POSTROUTING -t nat -p tcp -d ${SERVER_IP} --dport 25 -s ${INSIDE_NETWORK}/${INSIDE_NETMASK} -j SNAT --to ${OUTSIDE_IP}

#
# Keep state and open up for outgoing connections.
#
iptables -A FORWARD -m state --state NEW -i ${INSIDE_DEVICE} -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state NEW,INVALID -i ${OUTSIDE_DEVICE} -j DROP

#
# This is mainly for PPPoE usage but it won't hurt anyway so we'll just
# keep it here.
#
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

#
# We don't like the NetBIOS and Samba leaking..
#
iptables -t nat -A PREROUTING -p TCP --dport 135:139 -j DROP
iptables -t nat -A PREROUTING -p UDP --dport 137:139 -j DROP
iptables -t nat -A PREROUTING -p TCP --dport 445 -j DROP
iptables -t nat -A PREROUTING -p UDP --dport 445 -j DROP


#
# We would like to ask for names from our floppyfw box
#
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Ping and friends.
iptables -A OUTPUT -p icmp -j ACCEPT # to both sides.
iptables -A INPUT  -p icmp -j ACCEPT 

# And also, DHCP, but we can basically accept anything from the inside.
iptables -A INPUT -i ${INSIDE_DEVICE} -j ACCEPT
iptables -A OUTPUT -o ${INSIDE_DEVICE} -j ACCEPT
# And also accept talking to ourself.
iptables -A INPUT -i lo -j ACCEPT

#
# If the user wants to have the fake identd running, the identd has to
# be able to answer.
#
if [ ${FAKEIDENT} ] 
then
  iptables -A INPUT -p TCP --dport 113 -i ${OUTSIDE_DEVICE} -j ACCEPT
else
  iptables -A INPUT -p TCP --dport 113 -i ${OUTSIDE_DEVICE} -j REJECT --reject-with tcp-reset
fi

#
# Forwarding SIP and VoIP rtp ports for PHONE_IP in config
# 
if [ -n "$PHONE_IP" ] && [ "$WONDER_SHAPER" = "y" ] && [ -n "$RT10" ]
then
  if [ -n "$INTPORTS" ] && [ "$FORWARD_SIP" = "y" ]
   then
   echo "Enabling port forwarding for SIP INTPORTS setup in config"
    for a in $INTPORTS
    do
     iptables -A PREROUTING -t nat -p UDP -d ${OUTSIDE_IP} --dport $a -j DNAT --to ${PHONE_IP}:$a
     iptables -A FORWARD -p UDP -d ${PHONE_IP} --dport $a -o ${INSIDE_DEVICE} -j ACCEPT
    done
  fi
  if [ -n "$LO_RTPPORT" ] && [ -n "$HI_RTPPORT" ] && [ "$FORWARD_RTP" = "y" ]
   then
   echo "Enabling port forwarding for RTP port range setup in config"
    iptables -A PREROUTING -t nat -p UDP -d ${OUTSIDE_IP} --dport "$LO_RTPPORT":"$HI_RTPPORT" -j DNAT --to ${PHONE_IP}:"$LO_RTPPORT"-"$HI_RTPPORT"
    iptables -A FORWARD -p UDP -d ${PHONE_IP} --dport "$LO_RTPPORT":"$HI_RTPPORT" -o ${INSIDE_DEVICE} -j ACCEPT
  fi
else
 echo "VOIP support disabled, PHONE_IP or RT10 not set or WONDER_SHAPER=n in config."
fi

# 
# Running extra scripts.
#
for i in /etc/firewall/*
 do
  if [ -f $i ]
   then
    sh $i $1
  fi
done

#
# This will also help:
# It does look weird but it is explained here:
# http://lartc.org/howto/lartc.qdisc.classless.html
#
# The "240Kbit" rate should be set at "a tad less than the speedn you have"
# 240Kbit is for my 256Kbit "upload"-link.
#
# tc qdisc add dev $OUTSIDE_DEVICE root tbf rate 240kbit latency 50ms burst 1540

# Or maybe you chose to use Wondershaper?
if [ $WONDER_SHAPER = "y" ]
then
  /sbin/wshaper.htb
else
  #
  # And, some attempt to get interactive sesions a bit more interactive
  # under load:
  #
  iptables -A PREROUTING -t mangle -p tcp --sport ssh  -j TOS --set-tos Minimize-Delay
  iptables -A PREROUTING -t mangle -p tcp --sport ftp -j TOS --set-tos Minimize-Delay
  # iptables -A PREROUTING -t mangle -p tcp --sport ftp-data -j TOS --set-tos Maximize-Throughput

fi

#
# Finally, list what we have
# 
#
iptables -L

# If broken DNS:
#iptables -L -n

# 
#  The insert stuff into the kernel (ipsysctl) - section:
#
# Some of there goes under the "Better safe than sorry" - banner.
#


#
# This enables dynamic IP address following
#
echo 7 > /proc/sys/net/ipv4/ip_dynaddr

#
# trying to stop some smurf attacks.
#
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# 
# Don't accept source routed packets. 
#
/bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route

#
# Syncookies (if they are really needed any more?)
#
echo "1" > /proc/sys/net/ipv4/tcp_syncookies

#
# We don't like IP spoofing,
#
if [ -f /proc/sys/net/ipv4/conf/all/rp_filter ] 
 then
  # These two are redundant but I'll kepp'em here for now.
  # Will remind me that I can add the first one somewhere smart later.
  echo "1" > /proc/sys/net/ipv4/conf/default/rp_filter
  echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter

#   while read filter
#    do 
#     echo "1" > $filter
#   done < `find /proc/sys/net/ipv4/conf -name rp_filter -print`
 else
  echo "Anti spoofing is not available, the author of this floppy spoofed, mail him."
fi

# 
# nor ICMP redirect,
#

if [ -f /proc/sys/net/ipv4/conf/all/accept_redirects ] 
 then
  echo "0" > /proc/sys/net/ipv4/conf/default/accept_redirects
  echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects

  # while read accr
  #  do 
  #   echo -n "fil"
  #   echo $accr
  #   echo "fil2"
  #   echo "0" > $accr
  # done < `find /proc/sys/net/ipv4/conf -name accept_redirects -print`

 else
  echo "Anti spoofing is not available, the author of this floppy spoofed, mail him."
fi

#stop arp request from other interfaces
for i in /proc/sys/net/ipv4/conf/*
do
  echo 1 > $i/arp_filter
done


#
# Enable bad error message protection.
#
/bin/echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses 

# Maximum limit of ip_conntrack
# This is RAM dependant so be careful with this.
# The max, which is the valuehere, needs around 32M RAM to work properly.
# echo "65535" > /proc/sys/net/ipv4/ip_conntrack_max

# This is commented out and will be an option when we have a "LOG_STUFF" 
# config option.
# /bin/echo "1" > /proc/sys/net/ipv4/conf/all/log_martians

# Ming-Ching Tiew <mingching.tiew@remove.this.redtone.com>
# Made this one for me.

# The amount to reserve is an option in config.
reserve=`expr $RESERVE_MB \* 1048576`
#bytes per conntrack, should be kernel specific
per_con=328
curmax=` cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max `
set -- ` cat /proc/meminfo`
incre=` expr \( $10 - $reserve \) / $per_con`
new_max=` expr $curmax + $incre`
[ $new_max -ge 65535 ] && new_max=65535
echo "Setting ip_conntrack_max to $new_max"
echo $new_max  > /proc/sys/net/ipv4/netfilter/ip_conntrack_max

#
# Rules set, we can enable forwarding in the kernel.
#
echo "Enabling IP forwarding."

echo "1" > /proc/sys/net/ipv4/ip_forward