#!/bin/bash

PATH='/sbin'

case $1 in
	start)
		#limpando as regras
		iptables -F
		iptables -X
		iptables -t nat -F
		iptables -t nat -X

		#restrição para INPUT e FORWARD
		iptables -P INPUT DROP
		iptables -P FORWARD DROP

		###INPUT###
		iptables -A INPUT -i lo -j ACCEPT
		iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
		iptables -A INPUT -p icmp -j ACCEPT

		#portas para DNS local
		iptables -A INPUT -p tcp --dport 53 -j ACCEPT
		iptables -A INPUT -p udp --dport 53 -j ACCEPT
		iptables -A INPUT -p udp --sport 53 -j ACCEPT

		#portas para NTP
		iptables -A INPUT -p udp --dport 123 -j ACCEPT
		iptables -A INPUT -p udp --sport 123 -j ACCEPT

		#portas para DHCP
		iptables -A INPUT -i eth1 -p udp --dport 67 -j ACCEPT
		iptables -A INPUT -i eth1 -p udp --dport 68 -j ACCEPT

		#permissões para o SSH
		iptables -A INPUT -p tcp --dport 22 -j ACCEPT


		###FORWARD###
		iptables -A FORWARD -p icmp -j ACCEPT
		iptables -A FORWARD -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

		#encaminhar pacotes HTTP e HTTPS da rede local
		iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 80 -j ACCEPT
		iptables -A FORWARD -s 192.168.1.0/24 -p udp --dport 80 -j ACCEPT
		iptables -A FORWARD -d 192.168.1.0/24 -p udp --sport 80 -j ACCEPT
		iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 443 -j ACCEPT
		iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 8080 -j ACCEPT

		#encaminhar pacotes NTP
		iptables -A FORWARD -s 192.168.1.0/24 -p udp --dport 123 -j ACCEPT
		iptables -A FORWARD -d 192.168.1.0/24 -p udp --sport 123 -j ACCEPT
		iptables -A FORWARD -s 192.168.1.0/24 -p udp --dport 53 -j ACCEPT
		iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 53 -j ACCEPT
		iptables -A FORWARD -d 192.168.1.0/24 -p udp --sport 53 -j ACCEPT

		#encaminhar pacotes SSH
		iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT
		iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 2222 -j ACCEPT


		###NAT###
		#mascarando pacotes de saída
		iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

	;;

	stop)
		#firewall liberado
		iptables -F
		iptables -t nat -F
		iptables -P INPUT ACCEPT
		iptables -P FORWARD ACCEPT
		iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
	;;


	*)
		echo "Opção inválida, ex: /etc/firewall.sh <start|stop>"
	;;

esac

exit 0