#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
# clients	: PROTO ; PORT ; IFACE ; IFACE ; IFACE .... |
# servers	: PROTO ; PORT ; IFACE ; IFACE ; IFACE .... |

# Only intranet
local network="$network;::/0"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

for theNet in $fwdNet $srcNet;do
 for subnet in $(echo "$network" | tr -s ';' ' ');do
  # icmp (echo-reply:0/0, echo-request:8/0)
  local  ruleIn="$ruleIn	;icmp	| -d "$theNet" -s "$subnet" -p icmpv6 --icmpv6-type 128/0 -m state --state ESTABLISHED,RELATED,NEW"
  local ruleOut="$ruleOut;icmp	| -s "$theNet" -d "$subnet" -p icmpv6 --icmpv6-type 129/0 -m state --state ESTABLISHED,RELATED"
  local  ruleIn="$ruleIn	;icmp	| -d "$theNet" -s "$subnet" -p icmpv6 --icmpv6-type 129/0 -m state --state ESTABLISHED,RELATED"
  local ruleOut="$ruleOut;icmp	| -s "$theNet" -d "$subnet" -p icmpv6 --icmpv6-type 128/0 -m state --state ESTABLISHED,RELATED,NEW"
  # icmp (Type 1 - Destination Unreachable)
  for code in $(seq 0 8);do
   local ruleOut="$ruleOut;icmp	| -s "$theNet" -d "$subnet" -p icmpv6 --icmpv6-type 1/"$code" -m state --state ESTABLISHED,RELATED,NEW"
   local  ruleIn="$ruleIn ;icmp	| -d "$theNet" -s "$subnet" -p icmpv6 --icmpv6-type 1/"$code" -m state --state ESTABLISHED,RELATED,NEW"
  done
  # icmp (Type 2 - Packet Too Big , code 0)
  local ruleOut="$ruleOut;icmp	| -s "$theNet" -d "$subnet" -p icmpv6 --icmpv6-type 2/0 -m state --state ESTABLISHED,RELATED,NEW"
  local  ruleIn="$ruleIn ;icmp	| -d "$theNet" -s "$subnet" -p icmpv6 --icmpv6-type 2/0 -m state --state ESTABLISHED,RELATED,NEW"
 done
done
#local  dropOut="$dropOut ;drop_prises	| -s "$theNet" -d "$subnet" -p udp --sport 1026 --dport 1025 -m state --state NEW"
#local  dropIn="$dropIn  ;drop_dhcp	| -d 255.255.255.255	-s 0.0.0.0	-p udp --sport bootpc --dport bootps -m state --state NEW"
#local  dropIn="$dropIn  ;drop_igmp	| -d 224.0.0.1		-s 0.0.0.0	-p igmp"

# [ NTP ]
local clients="$clients|UDP	;ntp	"
local servers="$servers|UDP	;ntp	"

# [ SSH ]
local clients="$clients|TCP	;ssh	"
local servers="$servers|TCP	;ssh	"
#local clients="$clients|TCP	;2200	"
#local servers="$servers|TCP	;2200	"
#local clients="$clients|TCP	;2201	"
#local servers="$servers|TCP	;2201	"
#local clients="$clients|TCP	;2202	"
#local servers="$servers|TCP	;2202	"

# [ WEB & WHOIS ]
local clients="$clients|TCP	;http	"
local servers="$servers|TCP	;http	"
local clients="$clients|TCP	;https	"
local servers="$servers|TCP	;https	"
local clients="$clients|TCP	;http-alt	"
local servers="$servers|TCP	;http-alt	"
local clients="$clients|TCP	;8443	"
local servers="$servers|TCP	;8443	"
local clients="$clients|TCP	;whois	"
local servers="$servers|TCP	;whois	"
local clients="$clients|TCP	;git	"
local servers="$servers|TCP	;git	"

# [ MAIL ]
local clients="$clients|TCP	;imap	"
local servers="$servers|TCP	;imap	"
local clients="$clients|TCP	;pop3	"
local servers="$servers|TCP	;pop3	"
local clients="$clients|TCP	;smtp	"
local servers="$servers|TCP	;smtp	"
local clients="$clients|TCP	;auth	"
local servers="$servers|TCP	;auth	"
local clients="$clients|TCP	;imaps	"
local servers="$servers|TCP	;imaps	"
local clients="$clients|TCP	;pop3s	"
local servers="$servers|TCP	;pop3s	"
local clients="$clients|TCP	;smtps	"
local servers="$servers|TCP	;smtps	"
local clients="$clients|TCP	;submission	"
local servers="$servers|TCP	;submission	"

# [ DOMAIN ]
local clients="$clients|TCP	;domain	"
local servers="$servers|TCP	;domain	"
local clients="$clients|UDP	;domain	"
local servers="$servers|UDP	;domain	"

# [ OPENVPN ]
local clients="$clients|UDP	;openvpn"
local servers="$servers|TCP	;openvpn"

# [ LDAP / CNAMTS ]
local clients="$clients|TCP	;ldap	"

# [ FTP ]
#if [ -n "$( lsmod | grep ip_conntrack_ftp )" ];then modprobe ip_conntrack_ftp;fi
# local clients="$clients|TCP	;ftp		"
# local servers="$servers|TCP	;ftp		"
# local clients="$clients|TCP	;ftp-data	"
# local servers="$servers|TCP	;ftp-data	"
#
# 
# #iptables -A INPUT  -p tcp -m tcp --dport 21 -m conntrack --ctstate ESTABLISHED,NEW -j ACCEPT -m comment --comment "Allow ftp connections on port 21"
# #iptables -A OUTPUT -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -m comment --comment "Allow ftp connections on port 21"
# #iptables -A INPUT  -p tcp -m tcp --dport 20 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Allow ftp connections on port 20"
# #iptables -A OUTPUT -p tcp -m tcp --dport 20 -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "Allow ftp connections on port 20"
# #iptables -A INPUT  -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "Allow passive inbound connections"
# #iptables -A OUTPUT -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Allow passive inbound connections"
# local  ruleIn="$ruleIn	;ftp	| -d "$theNet"	-p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED"
# local ruleOut="$ruleOut	;ftp	| -s "$theNet"	-p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED"