1. #!/bin/bash -v
  2. 
  3. echo "Bringing up firewall..."
  4. echo ""
  5. 
  6. EXTERNAL_IFACE='eth0'
  7. INTERNAL_IFACE='eth1'
  8. WIRELESS_IFACE='eth2'
  9. IPTABLES=`which iptables`
  10. EXTERNAL_IP=`ifconfig ${EXTERNAL_IFACE} | grep "inet addr" | cut -d \: -f 2 | cut -d ' ' -f 1`
  11. INTERNAL_IP='192.168.1.0/24' # /24 covers both subnets
  12. # These numbers must match the numbers in the classes.sh file
  13. VOIP='10'
  14. WWW='11'
  15. GAMES='12'
  16. P2P='13'
  17. OTHER='14'
  18. 
  19. # Clear old rules
  20. ${IPTABLES} -F
  21. ${IPTABLES} -F -t nat
  22. ${IPTABLES} -F -t mangle
  23. 
  24. # Our default policy is to DROP packets
  25. ${IPTABLES} -P INPUT DROP
  26. 
  27. ### Configure classes ###
  28. ${IPTABLES} -t mangle -A PREROUTING -j CONNMARK --restore-mark
  29. ${IPTABLES} -t mangle -A PREROUTING -m mark ! --mark 0 -j ACCEPT # If we have already marked it then accept it
  30. 
  31. # We need to classify packets on all ethernet devices except lo, both incoming and outgoing.
  32. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --dst ${EXTERNAL_IP} -m mark --mark 0 -p udp \
  33. --dport 10000:20000 -j MARK --set-mark ${VOIP}
  34. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --src ${INTERNAL_IP} -m mark --mark 0 -p udp \
  35. --dport 10000:20000 -j MARK --set-mark ${VOIP} # VoIP
  36. 
  37. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --dst ${EXTERNAL_IP} -m mark --mark 0 -p udp \
  38. --dport 53 -j MARK --set-mark ${WWW}
  39. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --src ${INTERNAL_IP} -m mark --mark 0 -p udp \
  40. --dport 53 -j MARK --set-mark ${WWW} # DNS
  41. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --dst ${EXTERNAL_IP} -m mark --mark 0 -p tcp \
  42. -m multiport --dport 80,443 -j MARK --set-mark ${WWW}
  43. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --src ${INTERNAL_IP} -m mark --mark 0 -p tcp \
  44. -m multiport --dport 80,443 -j MARK --set-mark ${WWW} # HTTP/HTTPS
  45. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --dst ${EXTERNAL_IP} -m mark --mark 0 -p tcp \
  46. --dport 5900:5901 -j MARK --set-mark ${WWW}
  47. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --src ${INTERNAL_IP} -m mark --mark 0 -p tcp \
  48. --dport 5900:5901 -j MARK --set-mark ${WWW} # VNC
  49. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --dst ${EXTERNAL_IP} -m mark --mark 0 -p tcp \
  50. --dport 22 -j MARK --set-mark ${WWW}
  51. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --src ${INTERNAL_IP} -m mark --mark 0 -p tcp \
  52. --dport 22 -j MARK --set-mark ${WWW} # SSH
  53. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --dst ${EXTERNAL_IP} -m mark --mark 0 -p tcp \
  54. --dport 21 -j MARK --set-mark ${WWW}
  55. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --src ${INTERNAL_IP} -m mark --mark 0 -p tcp \
  56. --dport 21 -j MARK --set-mark ${WWW} # FTP
  57. 
  58. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --dst ${EXTERNAL_IP} -m mark --mark 0 -p tcp \
  59. --dport 3724 -j MARK --set-mark ${GAMES}
  60. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --src ${INTERNAL_IP} -m mark --mark 0 -p tcp \
  61. --dport 3724 -j MARK --set-mark ${GAMES} # World of Warcraft
  62. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --dst ${EXTERNAL_IP} -m mark --mark 0 -p tcp \
  63. --dport 6112 -j MARK --set-mark ${GAMES}
  64. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --src ${INTERNAL_IP} -m mark --mark 0 -p tcp \
  65. --dport 6112 -j MARK --set-mark ${GAMES} # Guild Wars
  66. 
  67. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --dst ${EXTERNAL_IP} -m mark --mark 0 -p tcp \
  68. --dport 7000:7100 -j MARK --set-mark ${P2P} # BitTorrent
  69. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --dst ${EXTERNAL_IP} -m mark --mark 0 -p tcp \
  70. --dport 6112 -j MARK --set-mark ${P2P}
  71. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --dst ${EXTERNAL_IP} -m mark --mark 0 -p tcp \
  72. --dport 6881:6999 -j MARK --set-mark ${P2P} # WoW downloader
  73. 
  74. # All other packets, on the tcp and udp protocols, need to be classified as "other".
  75. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --dst ${EXTERNAL_IP} -m mark --mark 0 \
  76. -j MARK --set-mark ${OTHER}
  77. ${IPTABLES} -t mangle -A PREROUTING -i ! lo --src ${INTERNAL_IP} -m mark --mark 0 \
  78. -j MARK --set-mark ${OTHER} # Everything else
  79. 
  80. ${IPTABLES} -t mangle -A PREROUTING -j CONNMARK --save-mark # Save the mark to the connection tracking.
  81. ## Classes configured ##
  82. 
  83. ## Forward ports ##
  84. ${IPTABLES} -t nat -A PREROUTING --dst ${EXTERNAL_IP} -p udp --dport 10000:20000 -j DNAT --to 192.168.1.3
  85. ${IPTABLES} -t nat -A PREROUTING --dst ${EXTERNAL_IP} -p tcp --dport 22 -j DNAT --to 192.168.1.5
  86. ${IPTABLES} -t nat -A PREROUTING --dst ${EXTERNAL_IP} -p tcp --dport 5900 -j DNAT --to 192.168.1.5
  87. ${IPTABLES} -t nat -A PREROUTING --dst ${EXTERNAL_IP} -p tcp --dport 7000 -j DNAT --to 192.168.1.5
  88. ${IPTABLES} -t nat -A PREROUTING --dst ${EXTERNAL_IP} -p tcp --dport 5901 -j DNAT --to 192.168.1.6
  89. ## ##
  90. 
  91. ## Setup filters ##
  92. ${IPTABLES} -A INPUT --dst ${EXTERNAL_IP} -p icmp --icmp-type echo-request -m limit \
  93. --limit 10 -j ACCEPT # Sure, let's reply to pings.
  94. ${IPTABLES} -A INPUT --dst ${EXTERNAL_IP} -m state \
  95. --state INVALID -j DROP # We don't want any invalid packets.
  96. ${IPTABLES} -A INPUT --dst ${EXTERNAL_IP} -m state \
  97. --state ESTABLISHED,RELATED -j ACCEPT # Only connections that were initiated from the inside.
  98. ${IPTABLES} -A INPUT --src ${INTERNAL_IP} -j ACCEPT # Accept connections from the LAN.
  99. ## Filters configured ##
  100. 
  101. # Make all outbound packets look like they are coming from one IP
  102. ${IPTABLES} -t nat -A POSTROUTING -o ${EXTERNAL_IFACE} -j MASQUERADE
  103. # Enable packet forwarding
  104. echo "1" > /proc/sys/net/ipv4/ip_forward