#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
# clients	: PROTO ; PORT ; IFACE ; IFACE ; IFACE .... |
# servers	: PROTO ; PORT ; IFACE ; IFACE ; IFACE .... |

# Only intranet
local network="$network;0.0.0.0/0"

# [ FTP ]
#modprobe ip_conntrack_ftp
#modprobe nf_conntrack_ftp
firewallInitActiveFtp

local clients="$clients|TCP	;ftp		"
local clients="$clients|TCP	;ftp-data	"
local servers="$servers|TCP	;ftp		"
local servers="$servers|TCP	;ftp-data	"
 
#iptables -A INPUT  -p tcp -m tcp --dport 21 -m conntrack --ctstate ESTABLISHED,NEW -j ACCEPT -m comment --comment "Allow ftp connections on port 21"
#iptables -A OUTPUT -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -m comment --comment "Allow ftp connections on port 21"
#iptables -A INPUT  -p tcp -m tcp --dport 20 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Allow ftp connections on port 20"
#iptables -A OUTPUT -p tcp -m tcp --dport 20 -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "Allow ftp connections on port 20"
#iptables -A INPUT  -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "Allow passive inbound connections"
#iptables -A OUTPUT -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Allow passive inbound connections"
local  ruleIn="$ruleIn	;ftp	| -d "$fwdNet"	-p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED"
local ruleOut="$ruleOut;ftp	| -s "$fwdNet"	-p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED"
local ruleOut="$ruleOut;ftp	| -s "$fwdNet"	-p tcp --sport 1024: --dport 1024: -m state --state NEW --syn"
#local ruleFwd="$ruleFwd;ftp-gw	| -s "$fwdNet"	-d "$net"	-p udp --sport 3702"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

#for subnet in $(echo "$network" | tr -s ';' ' ');do
# # icmp (echo-reply:0/0, echo-request:8/0)
# local  ruleIn="$ruleIn	;icmp	| -d "$fwdNet" -s "$subnet" -p icmp --icmp-type 8/0 -m state --state ESTABLISHED,RELATED,NEW"
# local ruleOut="$ruleOut;icmp	| -s "$fwdNet" -d "$subnet" -p icmp --icmp-type 0/0 -m state --state ESTABLISHED,RELATED"
# local  ruleIn="$ruleIn	;icmp	| -d "$fwdNet" -s "$subnet" -p icmp --icmp-type 0/0 -m state --state ESTABLISHED,RELATED"
# local ruleOut="$ruleOut;icmp	| -s "$fwdNet" -d "$subnet" -p icmp --icmp-type 8/0 -m state --state ESTABLISHED,RELATED,NEW"
# # icmp (host-unreachable:3/1, port-unreachable:3/3, fragmentation-needed:3/4)
# local ruleOut="$ruleOut;icmp	| -s "$fwdNet" -d "$subnet" -p icmp --icmp-type 3/1 -m state --state ESTABLISHED,RELATED,NEW"
# local  ruleIn="$ruleIn	;icmp	| -d "$fwdNet" -s "$subnet" -p icmp --icmp-type 3/1 -m state --state ESTABLISHED,RELATED,NEW"
# local ruleOut="$ruleOut;icmp	| -s "$fwdNet" -d "$subnet" -p icmp --icmp-type 3/3 -m state --state ESTABLISHED,RELATED,NEW"
# local  ruleIn="$ruleIn	;icmp	| -d "$fwdNet" -s "$subnet" -p icmp --icmp-type 3/3 -m state --state ESTABLISHED,RELATED,NEW"
# local ruleOut="$ruleOut;icmp	| -s "$fwdNet" -d "$subnet" -p icmp --icmp-type 3/4 -m state --state ESTABLISHED,RELATED,NEW"
# local  ruleIn="$ruleIn ;icmp	| -d "$fwdNet" -s "$subnet" -p icmp --icmp-type 3/4 -m state --state ESTABLISHED,RELATED,NEW"
#done