#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
# clients	: PROTO ; PORT ; IFACE ; IFACE ; IFACE .... |
# servers	: PROTO ; PORT ; IFACE ; IFACE ; IFACE .... |

# Only intranet
local network="$network;0.0.0.0/0"

#				-- CLIENT --
# [ SSH ]
local clients="$clients|TCP	;ssh	"
local clients="$clients|TCP	;2200	"
local clients="$clients|TCP	;2201	"
local clients="$clients|TCP	;2202	"
# [ WEB & WHOIS ]
local clients="$clients|TCP	;http	"
local clients="$clients|TCP	;https	"
local clients="$clients|TCP	;http-alt	"
local clients="$clients|TCP	;whois	"
local clients="$clients|TCP	;git	"
# [ FTP ]
if [ -n "$(lsmod | grep ip_conntrack_ftp)" ];then
 modprobe ip_conntrack_ftp
 local clients="$clients|TCP	;ftp		"
 local clients="$clients|TCP	;ftp-data	"
 
 #iptables -A INPUT  -p tcp -m tcp --dport 21 -m conntrack --ctstate ESTABLISHED,NEW -j ACCEPT -m comment --comment "Allow ftp connections on port 21"
 #iptables -A OUTPUT -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -m comment --comment "Allow ftp connections on port 21"
 #iptables -A INPUT  -p tcp -m tcp --dport 20 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Allow ftp connections on port 20"
 #iptables -A OUTPUT -p tcp -m tcp --dport 20 -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "Allow ftp connections on port 20"
 #iptables -A INPUT  -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "Allow passive inbound connections"
 #iptables -A OUTPUT -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Allow passive inbound connections"
 local  ruleIn="$ruleIn	;ftp	| -d "$fwdNet"	-p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED"
 local ruleOut="$ruleOut	;ftp	| -s "$fwdNet"	-p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED"
fi

# [ MAIL ]
local clients="$clients|TCP	;imap	"
local clients="$clients|TCP	;imaps	"
local clients="$clients|TCP	;pop3	"
local clients="$clients|TCP	;pop3s	"
local clients="$clients|TCP	;smtp	"
local clients="$clients|TCP	;smtps	"
local clients="$clients|TCP	;auth	"
local clients="$clients|TCP	;submission	"
# [ LDAP ]
local clients="$clients|TCP	;ldap	"
# [ NTP ]
local clients="$clients|UDP	;ntp	"

local clients="$clients|TCP	;domain	"
local clients="$clients|UDP	;domain	"

# TPE CB
local clients="$clients|TCP	;1156	"

#				-- SERVER --
local servers="$servers|TCP	;ssh	"
local servers="$servers|TCP	;http	"
local servers="$servers|TCP	;https	"
local servers="$servers|TCP	;8443	"
local servers="$servers|TCP	;imap	"
local servers="$servers|TCP	;imaps	"
local servers="$servers|TCP	;pop3	"
local servers="$servers|TCP	;pop3s	"
local servers="$servers|TCP	;smtp	"
local servers="$servers|TCP	;smtps	"
local servers="$servers|TCP	;auth	"
local servers="$servers|TCP	;submission	"

local servers="$servers|TCP	;domain	"
local servers="$servers|UDP	;domain	"

local servers="$servers|TCP	;openvpn"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

for subnet in $(echo "$network" | tr -s ';' ' ');do
 # icmp (echo-reply:0/0, echo-request:8/0)
 local  ruleIn="$ruleIn	;icmp	| -d "$fwdNet" -s "$subnet" -p icmp --icmp-type 8/0 -m state --state ESTABLISHED,RELATED,NEW"
 local ruleOut="$ruleOut;icmp	| -s "$fwdNet" -d "$subnet" -p icmp --icmp-type 0/0 -m state --state ESTABLISHED,RELATED"
 local  ruleIn="$ruleIn	;icmp	| -d "$fwdNet" -s "$subnet" -p icmp --icmp-type 0/0 -m state --state ESTABLISHED,RELATED"
 local ruleOut="$ruleOut;icmp	| -s "$fwdNet" -d "$subnet" -p icmp --icmp-type 8/0 -m state --state ESTABLISHED,RELATED,NEW"
 # icmp (host-unreachable:3/1, port-unreachable:3/3, fragmentation-needed:3/4)
 local ruleOut="$ruleOut;icmp	| -s "$fwdNet" -d "$subnet" -p icmp --icmp-type 3/1 -m state --state ESTABLISHED,RELATED,NEW"
 local  ruleIn="$ruleIn	;icmp	| -d "$fwdNet" -s "$subnet" -p icmp --icmp-type 3/1 -m state --state ESTABLISHED,RELATED,NEW"
 local ruleOut="$ruleOut;icmp	| -s "$fwdNet" -d "$subnet" -p icmp --icmp-type 3/3 -m state --state ESTABLISHED,RELATED,NEW"
 local  ruleIn="$ruleIn	;icmp	| -d "$fwdNet" -s "$subnet" -p icmp --icmp-type 3/3 -m state --state ESTABLISHED,RELATED,NEW"
 local ruleOut="$ruleOut;icmp	| -s "$fwdNet" -d "$subnet" -p icmp --icmp-type 3/4 -m state --state ESTABLISHED,RELATED,NEW"
 local  ruleIn="$ruleIn ;icmp	| -d "$fwdNet" -s "$subnet" -p icmp --icmp-type 3/4 -m state --state ESTABLISHED,RELATED,NEW"
done