#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# forward	: PROTO ; PORT |

# Only intranet
local network="$net"

#				-- CLIENT --
#local clients="$clients|TCP	;smtp		;Debian-exim/Debian-exim"

#				-- SERVER --
#local servers="$servers|UDP	;domain		;bind/bind"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

firewallInitActiveTftp
# [ TCP ] TFTP
#local filterOut="$filterOut;tftp	| -p tcp --sport tftp	-m state --state NEW -m owner --uid-owner root --gid-owner root"
#local  filterIn="$filterIn ;tftp	| -p tcp --dport tftp	-m state --state ESTABLISHED"
#local filterOut="$filterOut;tftp_sp	| -p tcp --dport 1024: --sport 1024: -m state --state ESTABLISHED -m owner --uid-owner root --gid-owner root"
#local  filterIn="$filterIn ;tftp_sp	| -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED,NEW"
#local filterOut="$filterOut;tftp_sp	| -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED ! --syn"
#local  filterIn="$filterIn ;tftp_sp	| -p tcp --dport 1024: --sport 1024: -m state --state ESTABLISHED ! --syn"

# [ UDP ] TFTP
local ruleOut="$ruleOut;tftp	| -d $net -s $ip -p udp --dport tftp -m state --state NEW -m owner --uid-owner root --gid-owner root"
local  ruleIn="$ruleIn ;tftp	| -s $net -d $ip -p udp --sport tftp -m state --state ESTABLISHED"
local ruleOut="$ruleOut;tftp_sp	| -d $net -s $ip -p udp --dport 1024: --sport 1024: -m state --state ESTABLISHED -m owner --uid-owner root --gid-owner root"
local  ruleIn="$ruleIn ;tftp_sp	| -s $net -d $ip -p udp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED,NEW"

# for port in $(netstat -ap 2>/dev/null | grep "rpc" | grep "\*:\*" | grep "$proto" | sed -n 's/ \+/\t/gp' | cut -f4 | cut -d ':' -f2);do
#  if [ "tcp" = "$proto" ];then
#   # [ TCP ] RPC
#   local ruleOut="$ruleOut;rpcbind| -d $net -s $ip -p tcp --dport $port -m state --state NEW -m owner --uid-owner root --gid-owner root"
#   local  ruleIn="$ruleIn ;rpcbind| -s $net -d $ip -p tcp --sport $port -m state --state ESTABLISHED,RELATED"
#   local  ruleIn="$ruleIn ;rpcbind| -s $net -d $ip -p tcp --sport $port -m state --state ESTABLISHED,RELATED,NEW ! --syn"
#   local ruleOut="$ruleOut;rpcbind| -d $net -s $ip -p tcp --dport $port -m state --state ESTABLISHED,RELATED,NEW ! --syn"
#  else
#   # [ UDP ] RPC
#   local ruleOut="$ruleOut;rpcbind| -d $net -s $ip -p udp --dport $port -m state --state NEW -m owner --uid-owner root --gid-owner root"
#   local  ruleIn="$ruleIn ;rpcbind| -s $net -d $ip -p udp --sport $port -m state --state ESTABLISHED,RELATED"
#  fi
# done
#done