#!/bin/bash
echo "##################################################"
echo "#### Firewall Feito por data.      ###"
echo "#### Dia 24/04/2009                            ###"   
echo "#### Contato:wilson.magalhaes@gmail.com        ###"
echo "##################################################"

IPT="/sbin/iptables"

IFACE_LOCAL="eth1" 
IFACE_INET="eth0"



function zera_tabelas()
{
        for tb in filter nat mangle
        do
                $IPT -t $tb -F
        done
}

$IPT -P INPUT   DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT  ACCEPT

zera_tabelas 

echo "1" > /proc/sys/net/ipv4/ip_forward

iptables -A INPUT -p TCP --dport 22 --sport 1024: -j ACCEPT
iptables -A INPUT -p TCP --dport 1024: --sport 22 -j ACCEPT
$IPT -A INPUT -p ALL -i lo -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type 8  -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type 0  -j ACCEPT
$IPT -A FORWARD -p icmp --icmp-type 8  -j ACCEPT
$IPT -A FORWARD -p icmp --icmp-type 0  -j ACCEPT






#Liberando portas locais 
PORTAS_TCP_IN="20 21 53 1434 80 443 3128"
for PT_TCP in $PORTAS_TCP_IN
do
        $IPT -A INPUT -p TCP  --dport $PT_TCP --sport 1024:    -j ACCEPT
        $IPT -A INPUT -p TCP --dport 1024:   --sport $PT_TCP  -j ACCEPT
done

PORTAS_UDP_IN="20 21 53 443 "
for PT_TCP in $PORTAS_UDP_IN
do
        $IPT -A INPUT -p UDP  --dport $PT_TCP --sport 1024:    -j ACCEPT
        $IPT -A INPUT -p UDP  --dport 1024:   --sport $PT_TCP  -j ACCEPT
done


# Liberando porta para Forward

PORTAS_TCP="20 21 22 1433 23 25 443 53 80 110 2631 3389 61639"
for PT_TCP in $PORTAS_TCP
do
        $IPT -A FORWARD -p TCP  --dport $PT_TCP --sport 1024:    -j ACCEPT
        $IPT -A FORWARD -p TCP  --dport 1024:   --sport $PT_TCP  -j ACCEPT
done


PORTAS_UDP="20 21 25 53 110"
for PT_UDP in $PORTAS_UDP
do
        $IPT -A FORWARD -p UDP  --dport $PT_UDP --sport 1024:    -j ACCEPT
        $IPT -A FORWARD -p UDP  --dport 1024:   --sport $PT_UDP  -j ACCEPT
done

# Redirecionamento de portas 
$IPT -t nat  -A PREROUTING  -p TCP -s 0/0 -i $IFACE_INET --dport 3389 -j DNAT --to-destination 192.168.0.254:3389

$IPT -t nat -A POSTROUTING -o $IFACE_INET -s 192.168.0.0/24 -j MASQUERADE

$IPT -t nat -A PREROUTING -p TCP -i $IFACE_LOCAL -d ! 200.201.0.0/16 --dport 80 -j REDIRECT --to-ports 3128
