#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
local network="0.0.0.0/0"

# clients	: PROTO ; PORT ; IFACE ; IFACE ; IFACE .... |
# servers	: PROTO ; PORT ; IFACE ; IFACE ; IFACE .... |

# [ DOMAIN ]
local clients="$clients|UDP	;domain	"
local servers="$servers|UDP	;domain	"
local clients="$clients|TCP	;domain	"
local servers="$servers|TCP	;domain	"

# [ NTP ]
local clients="$clients|UDP	;ntp	"
local servers="$servers|UDP	;ntp	"

# [ SSH ]
local clients="$clients|TCP	;ssh	"
local servers="$servers|TCP	;ssh	"

# [ WEB & WHOIS ]
local clients="$clients|TCP	;http	"
local servers="$servers|TCP	;http	"
local clients="$clients|UDP	;http	"
local servers="$servers|UDP	;http	"
local clients="$clients|TCP	;https	"
local servers="$servers|TCP	;https	"
local clients="$clients|UDP	;https	"
local servers="$servers|UDP	;https	"

# [ El-Bahja connexion => HTTP/RDP up to 30000 ]
local clients="$clients|TCP	;30080	"
local clients="$clients|UDP	;30080	"
local clients="$clients|TCP	;30389	"
local clients="$clients|UDP	;30389	"

local clients="$clients|UDP	;http	"
local servers="$servers|UDP	;http	"
local clients="$clients|UDP	;https	"
local servers="$servers|UDP	;https	"

local clients="$clients|TCP	;http-alt	"
local servers="$servers|TCP	;http-alt	"
local clients="$clients|TCP	;8443	"
local servers="$servers|TCP	;8443	"
local clients="$clients|TCP	;whois	"
local servers="$servers|TCP	;whois	"
local clients="$clients|TCP	;git	"
local servers="$servers|TCP	;git	"

# [ MAIL ]
local clients="$clients|TCP	;imap	"
local servers="$servers|TCP	;imap	"
local clients="$clients|TCP	;pop3	"
local servers="$servers|TCP	;pop3	"
local clients="$clients|TCP	;smtp	"
local servers="$servers|TCP	;smtp	"
local clients="$clients|TCP	;auth	"
local servers="$servers|TCP	;auth	"
local clients="$clients|TCP	;imaps	"
local servers="$servers|TCP	;imaps	"
local clients="$clients|TCP	;pop3s	"
local servers="$servers|TCP	;pop3s	"
local clients="$clients|TCP	;smtps	"
local servers="$servers|TCP	;smtps	"
local clients="$clients|TCP	;submission	"
local servers="$servers|TCP	;submission	"

# [ DOMAIN ]
local clients="$clients|TCP	;domain	"
local servers="$servers|TCP	;domain	"
local clients="$clients|UDP	;domain	"
local servers="$servers|UDP	;domain	"

# [ OPENVPN ]
local clients="$clients|UDP	;openvpn"
local servers="$servers|TCP	;openvpn"

# [ TELETRANS ]
local clients="$clients|TCP	;35256"
local clients="$clients|TCP	;30100"

# [ LDAP / CNAMTS ]
local clients="$clients|TCP	;ldap	"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

for subnet in $(echo "$network" | tr -s ';' ' ');do
 # icmp (echo-reply:0/0, echo-request:8/0)
 local  ruleIn="$ruleIn	;icmp	| -d "$fwdNet" -s "$subnet" -p icmp --icmp-type 8/0 -m state --state ESTABLISHED,RELATED,NEW"
 local ruleOut="$ruleOut;icmp	| -s "$fwdNet" -d "$subnet" -p icmp --icmp-type 0/0 -m state --state ESTABLISHED,RELATED"
 local  ruleIn="$ruleIn	;icmp	| -d "$fwdNet" -s "$subnet" -p icmp --icmp-type 0/0 -m state --state ESTABLISHED,RELATED"
 local ruleOut="$ruleOut;icmp	| -s "$fwdNet" -d "$subnet" -p icmp --icmp-type 8/0 -m state --state ESTABLISHED,RELATED,NEW"
 # icmp (host-unreachable:3/1, port-unreachable:3/3, fragmentation-needed:3/4)
 local ruleOut="$ruleOut;icmp	| -s "$fwdNet" -d "$subnet" -p icmp --icmp-type 3/1 -m state --state ESTABLISHED,RELATED,NEW"
 local  ruleIn="$ruleIn	;icmp	| -d "$fwdNet" -s "$subnet" -p icmp --icmp-type 3/1 -m state --state ESTABLISHED,RELATED,NEW"
 local ruleOut="$ruleOut;icmp	| -s "$fwdNet" -d "$subnet" -p icmp --icmp-type 3/3 -m state --state ESTABLISHED,RELATED,NEW"
 local  ruleIn="$ruleIn	;icmp	| -d "$fwdNet" -s "$subnet" -p icmp --icmp-type 3/3 -m state --state ESTABLISHED,RELATED,NEW"
 local ruleOut="$ruleOut;icmp	| -s "$fwdNet" -d "$subnet" -p icmp --icmp-type 3/4 -m state --state ESTABLISHED,RELATED,NEW"
 local  ruleIn="$ruleIn ;icmp	| -d "$fwdNet" -s "$subnet" -p icmp --icmp-type 3/4 -m state --state ESTABLISHED,RELATED,NEW"
done

#local  dropOut="$dropOut ;drop_prises	| -s "$fwdNet" -d "$subnet" -p udp --sport 1026 --dport 1025 -m state --state NEW"
#local  dropIn="$dropIn  ;drop_dhcp	| -d 255.255.255.255	-s 0.0.0.0	-p udp --sport bootpc --dport bootps -m state --state NEW"
#local  dropIn="$dropIn  ;drop_igmp	| -d 224.0.0.1		-s 0.0.0.0	-p igmp"