#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
# clients	: PROTO ; PORT ; IFACE ; IFACE ; IFACE .... |
# servers	: PROTO ; PORT ; IFACE ; IFACE ; IFACE .... |

# Only intranet
local network="$network;$net"

# [ LDAP ]
local clients="$clients|UDP	;ldap	"
local servers="$servers|UDP	;ldap	"
local clients="$clients|TCP	;ldap	"
local servers="$servers|TCP	;ldap	"
# [ MICROSOFT RDP ]
local clients="$clients|TCP	;3389	"
local servers="$servers|TCP	;3389	"

# SAMBA
local clients="$clients|UDP	;netbios-ns	"
local servers="$servers|UDP	;netbios-ns	"
local clients="$clients|UDP	;netbios-dgm	"
local servers="$servers|UDP	;netbios-dgm	"
local clients="$clients|TCP	;microsoft-ds	"
local servers="$servers|TCP	;microsoft-ds	"
local clients="$clients|TCP	;netbios-ssn	"
local servers="$servers|TCP	;netbios-ssn	"
local clients="$clients|TCP	;loc-srv	"
local servers="$servers|TCP	;loc-srv	"
# SAMBA - kerberos
local clients="$clients|UDP	;kerberos	"
local servers="$servers|UDP	;kerberos	"
local clients="$clients|TCP	;kerberos	"
local servers="$servers|TCP	;kerberos	"
# SAMBA - ...
local clients="$clients|TCP	;3268	"
local servers="$servers|TCP	;3268	"
local clients="$clients|TCP	;1024	"
local servers="$servers|TCP	;1024	"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

#netbios-ns      137/tcp                         # NETBIOS Name Service
#netbios-ns      137/udp
#netbios-dgm     138/tcp                         # NETBIOS Datagram Service
#netbios-dgm     138/udp

#[17826.143785] NETFILTER_INPUTIN=eth0.2 OUT= MAC=ff:ff:ff:ff:ff:ff:dc:4a:3e:e6:8d:2d:08:00
# SRC=10.83.10.7 DST=10.83.10.255 LEN=229 TOS=0x00 PREC=0x00 TTL=128 ID=35616 PROTO=UDP SPT=138 DPT=138 LEN=209 MARK=0xe
local  ruleFwd="$ruleIn ;samba	| -s "$net" -d "$broadcast"	-p udp --sport netbios-dgm --dport netbios-dgm -m state --state NEW"

#SRC=192.168.1.111 DST=239.255.255.250 LEN=165 TOS=0x00 PREC=0x00 TTL=4 ID=18367 PROTO=UDP SPT=56774 DPT=1900 LEN=145
#local ruleFwd="$ruleFwd;upnp_igmp	| -s "$net"	-d 239.255.255.250/32	-p udp --dport 1900"
#if [ -n "$gw" ];then
# local ruleFwd="$ruleFwd;upnp_igmp	| -s "$gw"	-d "$net"	-p tcp"
# local ruleFwd="$ruleFwd;upnp_igmp	| -s "$net"	-d "$gw"	-p tcp"
#fi