#!/bin/bash

# IP Masquerade & Firewall Setup for iptables
# Author: Brian Bothwell (sysrage@sysrage.net)

echo 1 > /proc/sys/net/ipv4/ip_forward

## Flush chains
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD

## Set Default Policies
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

## Create LOGDROP chain.
iptables -F LOGDROP 2>/dev/null
iptables -X LOGDROP 2>/dev/null
iptables -N LOGDROP
iptables -A LOGDROP -j LOG
iptables -A LOGDROP -j DROP

## IPMasq Rule
iptables -t nat -F PREROUTING
iptables -t nat -F POSTROUTING
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to 64.81.39.24


## Firewall Rules
#* Enable stateful tracking
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

#* FTP, SSH, Telnet Ports
iptables -A INPUT --proto tcp -i eth0 --destination-port 20:23 -j ACCEPT

#* Mail Ports
iptables -A INPUT --proto tcp -i eth0 --destination-port 25 -j ACCEPT
iptables -A INPUT --proto tcp -i eth0 --destination-port 110 -j ACCEPT

#* HTTP & HTTPS Ports
iptables -A INPUT --proto tcp -i eth0 --destination-port 80 -j ACCEPT
iptables -A INPUT --proto tcp -i eth0 --destination-port 443 -j ACCEPT

#* IDENTD Port
iptables -A INPUT --proto tcp -i eth0 --destination-port 113 -j ACCEPT

#* User Ports
iptables -A INPUT --proto tcp -i eth0 --destination-port 1024:65535 -j ACCEPT
iptables -A INPUT --proto udp -i eth0 --destination-port 1024:65535 -j ACCEPT

#* Needed for DNS lookups.
iptables -A INPUT --proto tcp -i eth0 --destination-port 53 -j ACCEPT
iptables -A INPUT --proto udp -i eth0 --destination-port 53 -j ACCEPT
iptables -A INPUT --proto tcp -i eth0 --destination-port 137:138 -j ACCEPT
iptables -A INPUT --proto udp -i eth0 --destination-port 137:138 -j ACCEPT

#* Talk Port
iptables -A INPUT --proto udp -i eth0 --destination-port 517:518 -j ACCEPT

#* ICMP Replies
iptables -A INPUT -i eth0 --proto icmp --jump ACCEPT

iptables -A OUTPUT --proto tcp --destination-port 2611 -j LOGDROP

#* Deny everything else.
iptables -A INPUT -i eth0 -j LOGDROP

## Port Forwarding For NAT
#* ICQ
iptables -A PREROUTING -t nat -p udp -d 64.81.39.24 --dport 4000 -j DNAT --to 192.168.1.2
iptables -A PREROUTING -t nat -p tcp -d 64.81.39.24 --dport 20020:20039 -j DNAT --to 192.168.1.2

#* WebCam Software
iptables -A PREROUTING -t nat -p tcp -d 64.81.39.24 --dport 2047:2048 -j DNAT --to 192.168.1.1
iptables -A PREROUTING -t nat -p udp -d 64.81.39.24 --dport 2047:2048 -j DNAT --to 192.168.1.1
iptables -A PREROUTING -t nat -p udp -d 64.81.39.24 --dport 1972 -j DNAT --to 192.168.1.1

# Unreal Tournament
iptables -A PREROUTING -t nat -p tcp -d 64.81.39.24 --dport 7600:7900 -j DNAT --to 192.168.1.1
iptables -A PREROUTING -t nat -p udp -d 64.81.39.24 --dport 7600:7900 -j DNAT --to 192.168.1.1


iptables -A PREROUTING -t nat -p udp -d 64.81.39.24 --dport 3782 -j DNAT --to 192.168.1.2