#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
local network="0.0.0.0/0"

# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |

# [ FTP ]
#modprobe ip_conntrack_ftp
#modprobe nf_conntrack_ftp
firewallInitActiveFtp

local clients="$clients|TCP	;ftp		;root/root"
local clients="$clients|TCP	;ftp-data	;root/root"
local servers="$servers|TCP	;ftp		;root/root"
local servers="$servers|TCP	;ftp-data	;root/root"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

#iptables -A INPUT  -p tcp -m tcp --dport 21 -m conntrack --ctstate ESTABLISHED,NEW -j ACCEPT -m comment --comment "Allow ftp connections on port 21"
#iptables -A OUTPUT -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -m comment --comment "Allow ftp connections on port 21"
#iptables -A INPUT  -p tcp -m tcp --dport 20 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Allow ftp connections on port 20"
#iptables -A OUTPUT -p tcp -m tcp --dport 20 -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "Allow ftp connections on port 20"
#iptables -A INPUT  -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "Allow passive inbound connections"
#iptables -A OUTPUT -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Allow passive inbound connections"
local  ruleIn="$ruleIn	;ftp	| -d "${ip}"	-p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED"
local ruleOut="$ruleOut	;ftp	| -s "${ip}"	-p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED"
local ruleOut="$ruleOut;ftp	| -s "${ip}"	-p tcp --sport 1024: --dport 1024: -m state --state NEW --syn"