#!/bin/bash

I_EXT=eth0
I_LAN=eth1
I_DMZ=eth2
I_VPN=tun0

LAN=192.168.1.0/24
DMZ=192.168.0.0/24
BRULIWEB=192.168.0.2
FIREWALL=192.168.1.1

PABLOPORTATIL=192.168.1.4
BRULI=192.168.1.2

case "$1" in
	start)
			
		#Limpieza de reglas.
		echo -n "Limpiando reglas iptables: "
		iptables -F
		iptables -X
		iptables -Z
		iptables -t nat -F
		echo "hecho."
		
		#Cargando modulos.
		echo -n "Cargando modulos: "
		/sbin/depmod -a
		modprobe ip_tables
		modprobe ip_conntrack
		modprobe iptable_filter
		modprobe iptable_nat
		modprobe ipt_state
		modprobe ipt_MASQUERADE
		modprobe ipt_ULOG
		modprobe tun
		echo "hecho."		


		#Forwarding.
		echo -n "Activando forwarding: "
		echo "1"> /proc/sys/net/ipv4/ip_forward
		echo "hecho."
		
		#Política por defecto.
		echo -n "Aplicando política: "
		iptables -P INPUT DROP
		iptables -P OUTPUT DROP
		iptables -P FORWARD DROP
		#iptables -t nat -P PREROUTING DROP
		#iptables -t nat -P POSTROUTING DROP
		echo "hecho."
		
		#NAT
		echo -n "Enmascarando la LAN y DMZ: "
		iptables -t nat -A POSTROUTING -s $LAN -o $I_EXT -j MASQUERADE
		iptables -t nat -A POSTROUTING -s $DMZ -o $I_EXT -j MASQUERADE
		echo "hecho."
		
		#Interfaz lo.
		echo -n "Activando interfaz lo: "
		iptables -A INPUT -i lo -j ACCEPT
		iptables -A OUTPUT -o lo -j ACCEPT
		echo "hecho."
		
		#Reglas.
		echo -n "Creando nuevas reglas: "
		iptables -N ext-lan
		iptables -N ext-firewall	
		iptables -N ext-dmz
		iptables -N lan-ext
		iptables -N lan-dmz
		iptables -N lan-firewall
		iptables -N dmz-lan
		iptables -N dmz-ext
		iptables -N firewall-lan
		iptables -N firewall-ext
		iptables -N server-web
		iptables -N server-mail
		iptables -N server-ssh
		iptables -N server-ssl
		iptables -N bloq-scan
		iptables -N flags-tcp
		iptables -N openvpn
		echo "hecho."	
# ----------------------------------		
		echo "Aplicando reglas de seguridad: "

		echo -n "--Definiendo regla blog-scan: "
		iptables -A bloq-scan -j DROP
		echo "hecho."

		echo -n "--Bloqueando y logeando escaneos NMAP-XMAS: "
		iptables -A flags-tcp -p tcp --tcp-flags ALL FIN,URG,PSH -m limit --limit 5/minute -j ULOG --ulog-nlgroup 1 --ulog-prefix "NMAP_XMAS_SCAN: "
		iptables -A flags-tcp -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
		echo "hecho."

		echo -n "--Bloqueando y logeando escaneos SYN/RST: "
		iptables -A flags-tcp -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/minute -j ULOG --ulog-nlgroup 1 --ulog-prefix "SYN/RST_SCAN:"
		iptables -A flags-tcp -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
		echo "hecho."

		echo -n "--Bloqueando y logeando escaneos SYN/FIN: "
		iptables -A flags-tcp -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/minute -j ULOG --ulog-nlgroup 1 --ulog-prefix "SYN/FIN_SCAN:"
		iptables -A flags-tcp -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
		echo "hecho."

		echo -n "--Bloqueando y logeando escaneos PSH/FIN: "
		iptables -A flags-tcp -p tcp --tcp-flags PSH,FIN PSH,FIN -m limit --limit 5/minute -j ULOG --ulog-nlgroup 1 --ulog-prefix "PSH/FIN_SCAN:"
		iptables -A flags-tcp -p tcp --tcp-flags PSH,FIN PSH,FIN -j DROP
		echo "hecho."

		echo -n "--Bloqueando y logeando el NULL SCAN: "
		iptables -A flags-tcp -p tcp --tcp-flags ALL NONE -m limit --limit 5/minute -j ULOG --ulog-nlgroup 1 --ulog-prefix "NULL_SCAN:"
		iptables -A flags-tcp -p tcp --tcp-flags ALL NONE -j DROP
		echo "hecho."

		iptables -A FORWARD -p tcp -j flags-tcp
		iptables -A INPUT -p tcp -j flags-tcp
		iptables -A OUTPUT -p tcp -j flags-tcp

		echo -n "--Activando protección anti smurf: "
		echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
		echo "hecho."

		echo -n "--Activando protección contra source route spoofing: "
		echo 0 >/proc/sys/net/ipv4/conf/all/accept_source_route
		echo "hecho."

		echo -n "--Registrando direcciones marcianas: "
		echo 1 >/proc/sys/net/ipv4/conf/all/log_martians
		echo "hecho."
#-------------------------------------
		echo "Iniciando reglas de redirecciones:"		

		echo -n "--Redirección http: "
		iptables -t nat -A PREROUTING -i $I_EXT -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j DNAT --to $BRULIWEB:80
		iptables -A FORWARD -i $I_EXT -p tcp --dport 80 -j server-web
		iptables -A FORWARD -o $I_EXT -p tcp --sport 80 -j server-web
		iptables -A server-web -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
		iptables -A server-web -j ULOG --ulog-nlgroup 1 --ulog-prefix "SERVER-WEB:"
		iptables -A server-web -j DROP
		echo "hecho."

		echo -n "--Redirección mail: "
		iptables -t nat -A PREROUTING -i $I_EXT -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j DNAT --to $BRULIWEB:25
		iptables -A FORWARD -i $I_EXT -p tcp --dport 25 -j server-mail
		iptables -A FORWARD -o $I_EXT -p tcp --sport 25 -j server-mail
		iptables -A server-mail -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
		iptables -A server-mail -j ULOG --ulog-nlgroup 1 --ulog-prefix "SERVER-MAIL:"
		iptables -A server-mail -j DROP
		echo "hecho."

		echo -n "--Redirección ssh: "
		iptables -t nat -A PREROUTING -i $I_EXT -p tcp --dport 560 -m state --state NEW,ESTABLISHED,RELATED -j DNAT --to $BRULI:22
		iptables -A FORWARD -i $I_EXT -p tcp --dport 22 -j server-ssh
		iptables -A FORWARD -o $I_EXT -p tcp --sport 22 -j server-ssh
		iptables -A server-ssh -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT	
		iptables -A server-ssh -j ULOG --ulog-nlgroup 1 --ulog-prefix "SERVER-SSH:"
		iptables -A server-ssh -j DROP
		echo "hecho."

		echo -n "--Redirección https: "
		iptables -t nat -A PREROUTING -i $I_EXT -p tcp --dport 443 -m state --state NEW,ESTABLISHED,RELATED -j DNAT --to $BRULIWEB:443
		iptables -A FORWARD -i $I_EXT -p tcp --dport 443 -j server-ssl
		iptables -A FORWARD -o $I_EXT -p tcp --sport 443 -j server-ssl
		iptables -A server-ssl -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
		iptables -A server-ssl -j ULOG --ulog-nlgroup 1 --ulog-prefix "SERVER-SSL:"
		iptables -A server-ssl -j DROP
		echo "hecho."		
# -------------------------------------	
		echo "Introduciendo valores y políticas a las reglas: "

		echo -n "--Regla ext-lan: "
		iptables -A FORWARD -i $I_EXT -o $I_LAN	 -j ext-lan
		iptables -A ext-lan -m state --state ESTABLISHED,RELATED -j ACCEPT
		iptables -A ext-lan -j ULOG --ulog-nlgroup 1 --ulog-prefix "EXT->LAN:"
		iptables -A ext-lan -j DROP
		echo "hecho."

		echo -n "--Regla ext-firewall: "
		iptables -A INPUT -i $I_EXT -j ext-firewall
		iptables -A ext-firewall -s  ! $LAN -m state --state ESTABLISHED,RELATED -j ACCEPT
		iptables -A ext-firewall -s  ! $DMZ -m state --state ESTABLISHED,RELATED -j ACCEPT
 		iptables -A ext-firewall -j ULOG --ulog-nlgroup 1 --ulog-prefix "EXT->FIREWALL:"
		iptables -A ext-firewall -j DROP
		echo "hecho."

		echo -n "--Regla ext-dmz: "
		iptables -A FORWARD -i $I_EXT -o $I_DMZ -j ext-dmz
		iptables -A ext-dmz -m state --state ESTABLISHED,RELATED -j ACCEPT
		iptables -A ext-dmz -j ULOG --ulog-nlgroup 1 --ulog-prefix "EXT->DMZ:"
		iptables -A ext-dmz -j DROP
		echo "hecho."

		echo -n "--Regla lan-ext: "
		iptables -A FORWARD -i $I_LAN -o $I_EXT -j lan-ext
		iptables -A lan-ext -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
		iptables -A lan-ext -j ULOG --ulog-nlgroup 1 --ulog-prefix "LAN->EXT:"
		iptables -A lan-ext -j DROP
		echo "hecho."

		echo -n "--Regla lan-dmz: "
		iptables -A FORWARD -i $I_LAN -o $I_DMZ -j lan-dmz
		iptables -A lan-dmz -s $LAN -d $DMZ -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
		iptables -A lan-dmz -j ULOG --ulog-nlgroup 1 --ulog-prefix "LAN->DMZ:"
		iptables -A lan-dmz -j DROP
		echo "hecho."

		echo -n "--Regla lan-firewall: "
		iptables -A INPUT -i $I_LAN -j lan-firewall
		iptables -A lan-firewall -s $LAN -d $FIREWALL -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
		iptables -A lan-firewall -j ULOG --ulog-nlgroup 1 --ulog-prefix "LAN->FIREWALL:"
		iptables -A lan-firewall -j DROP
		echo "hecho."

		echo -n "--Regla dmz-lan: "
		iptables -A FORWARD -i $I_DMZ -o $I_LAN -j dmz-lan
		iptables -A dmz-lan -s $DMZ -d $LAN -m state --state ESTABLISHED,RELATED -j ACCEPT
		iptables -A dmz-lan -j ULOG --ulog-nlgroup 1 --ulog-prefix "DMZ->LAN:"
		iptables -A dmz-lan -j DROP
		echo "hecho."

		echo -n "--Regla dmz-ext: "
		iptables -A FORWARD -i $I_DMZ -o $I_EXT -j dmz-ext
		iptables -A dmz-ext -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
		iptables -A dmz-ext -j ULOG --ulog-nlgroup 1 --ulog-prefix "DMZ->EXT:"
		iptables -A dmz-ext -j DROP
		echo "hecho."

		echo -n "--Regla firewall-lan: "
		iptables -A OUTPUT -o $I_LAN -j firewall-lan
		iptables -A firewall-lan -s $FIREWALL -d $LAN -m state --state ESTABLISHED,RELATED -j ACCEPT
		iptables -A firewall-lan -j ULOG --ulog-nlgroup 1 --ulog-prefix "FIREWALL->LAN:"
		iptables -A firewall-lan -j DROP
		echo "hecho."

		echo -n "--Regla firewall-ext: "
		iptables -A OUTPUT -o $I_EXT -j firewall-ext
		iptables -A firewall-ext -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
		iptables -A firewall-ext -j ULOG --ulog-nlgroup 1 --ulog-prefix "FIREWALL->EXT:"
		iptables -A firewall-ext -j DROP
		echo "hecho."

		echo -n "--Regla openvpn: "
		iptables -A INPUT -i $I_VPN -j openvpn
		iptables -A OUTPUT -o $I_VPN -j openvpn
		iptables -A FORWARD -i $I_VPN -j openvpn
		iptables -A FORWARD -o $I_VPN -j openvpn
		iptables -A openvpn -j ACCEPT
		iptables -A openvpn -j ULOG --ulog-nlgroup 1 --ulog-prefix "OPENVPN: "
		iptables -A openvpn -j DROP
		echo "hecho."
# --------------------------------------
		##Cerrar
		#Conexiones no necesarias. 
		echo -n "Cerrando conexiones no necesarias: "
		iptables -A INPUT -i $I_EXT -m state --state NEW,INVALID -j DROP
				
		iptables -A OUTPUT -o $I_EXT -m state --state NEW,INVALID -j DROP
				
		iptables -A FORWARD -i $I_EXT -m state --state NEW,INVALID -j DROP
		echo "hecho."
		;;
		
	stop)
		echo -n "Parando el firewall: "
		iptables -F INPUT
		iptables -F OUTPUT
		iptables -F FORWARD
		iptables -t INPUT
		iptables -t OUTPUT
		iptables -t FORWARD
		iptables -t nat -F
		iptables -P INPUT ACCEPT
		iptables -P OUTPUT ACCEPT
		iptables -P FORWARD ACCEPT
		echo "hecho."
		;;
		
	restart)
		$0 stop
		echo -n "Reiniciando el firewall: "
		sleep 2
		$0 start
		echo "hecho."
		;;
		
	status)
		iptables -L -n
		;;
	*)
		echo "usar: $0 {start|stop|restart|status}"
		exit 1
esac
exit 0