#!/bin/bash
####################################################
# FIREWALL MODIFICADO POR FERNANDO MICULAN (c)2013 #
####################################################

# DEFINICION DE VARIABLES
ipt="/sbin/iptables"
net="192.168.0"
net2="192.168.30"
listamac="/opt/mac.txt"

# LIMPIO TABLAS DE RUTEO
$ipt -F
$ipt -Z
$ipt -t nat -F
$ipt -t mangle -F

# POLITICA POR DEFAULT (DENIEGO TODO)
$ipt -P INPUT DROP
$ipt -P OUTPUT ACCEPT
$ipt -P FORWARD DROP

# PERMITO A LOCALHOST
$ipt -A INPUT -i lo -s 127.0.0.1 -j ACCEPT
$ipt -A OUTPUT -o lo -d 127.0.0.1 -j ACCEPT

#################################################
###### APERTURA DE PUERTOS DE USO COMUN #########
#################################################

# PERMITO VER REPORTES (SARG)- GATEWAY POR SQUID - WEBMIN
$ipt -A INPUT -s $net.0/24 -p tcp --dport 3128 -j ACCEPT
$ipt -A INPUT -s $net2.0/24 -p tcp --dport 3128 -j ACCEPT
$ipt -A INPUT -s 0/0 -p tcp --dport 443 -j ACCEPT
$ipt -A INPUT -p tcp --dport 10000 -j ACCEPT
$ipt -A INPUT -s 192.168.0.253 -p tcp --dport 139 -j ACCEPT
$ipt -A INPUT -s 192.168.0.253 -p tcp --dport 445 -j ACCEPT

# PERMITO SSH
#$ipt -A INPUT -s $iplan.0/24 -p tcp --dport 10200 -j ACCEPT
#$ipt -A INPUT -p tcp --dport 22 -j ACCEPT
$ipt -A INPUT -p tcp --dport 10200 -j ACCEPT
$ipt -A INPUT -p tcp --dport 5901 -j ACCEPT

# PERMITO SNMP
$ipt -A INPUT -s 192.168.0.231 -p udp --dport 161 -j ACCEPT
$ipt -A INPUT -s 192.168.0.231 -p udp --dport 162 -j ACCEPT
$ipt -A INPUT -s 192.168.0.194 -p udp --dport 161 -j ACCEPT
$ipt -A INPUT -s 192.168.0.194 -p udp --dport 162 -j ACCEPT
$ipt -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# HABILITO EL FORWARDING DE PAQUETES
echo "1" > /proc/sys/net/ipv4/ip_forward

########################################
########## EXCEPCIONES DEL FW ##########
########################################
# ATIENDO PING
$ipt -A FORWARD -p icmp -j ACCEPT
$ipt -A INPUT -s 192.168.0.231 -p icmp -j ACCEPT

# PUERTOS NOD32 ERAS SERVER
$ipt -A FORWARD -p tcp --dport 2222 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 2222 -j ACCEPT
$ipt -A FORWARD -p tcp --dport 2221 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 2221 -j ACCEPT

# PUERTO RDP MERCADO
$ipt -A FORWARD -p tcp --dport 25000 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 25000 -j ACCEPT

# TEAMVIEWER
$ipt -A FORWARD -p tcp --dport 5938 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 5938 -j ACCEPT

# HABILITO DOMAIN NAME SERVER
$ipt -A INPUT -p tcp --dport 53 -j ACCEPT
$ipt -A INPUT -p udp --dport 53 -j ACCEPT

# PUERTO RADIO SENASA - p/RACERBI
$ipt -A FORWARD -p tcp --dport 31193 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 31193 -j ACCEPT
$ipt -A FORWARD -p tcp --dport 1935 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 1935 -j ACCEPT

# CORREO ENTRANTE Y SALIENTE
$ipt -A FORWARD -p tcp --dport 25 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 25 -j ACCEPT
$ipt -A FORWARD -p tcp --dport 110 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 110 -j ACCEPT

# PUERTO SKYPE (SSL)
$ipt -A FORWARD -p tcp --dport 443 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 443 -j ACCEPT

# FILE SHARING
$ipt -A FORWARD -p tcp --dport 139 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 139 -j ACCEPT
$ipt -A FORWARD -p tcp --dport 138 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 138 -j ACCEPT
$ipt -A FORWARD -p tcp --dport 137 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 137 -j ACCEPT
$ipt -A FORWARD -p tcp --dport 445 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 445 -j ACCEPT

# PUERTO DROPBOX F.PAOLINI
$ipt -A FORWARD -p tcp --dport 80 -m mac --mac-source 00:21:97:D4:9A:92 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 80 -m mac --mac-source 00:21:97:D4:9A:92 -j ACCEPT
$ipt -A FORWARD -p tcp --dport 443 -m mac --mac-source 00:21:97:D4:9A:92 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 443 -m mac --mac-source 00:21:97:D4:9A:92 -j ACCEPT

# PUERTO TUNEL ADUANA 
$ipt -A FORWARD -p tcp --dport 1723 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 1723 -j ACCEPT
$ipt -A FORWARD -p tcp --dport 47 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 47 -j ACCEPT

# RELOJ REGISTRACIONES AVENIDA DE MAYO
$ipt -A FORWARD -p tcp --dport 3001 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 3001 -j ACCEPT

# PUERTO MYSQL p/ CYS
$ipt -A FORWARD -p tcp --dport 3306 -m mac --mac-source 00:E0:4C:73:7E:F6 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 3306 -m mac --mac-source 00:E0:4C:73:7E:F6 -j ACCEPT

# PUERTO REMOTE ADMIN
$ipt -A FORWARD -p tcp --dport 4899 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 4899 -j ACCEPT

# PUERTO REMOTE DESKTOP
$ipt -A FORWARD -p tcp --dport 3389 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 3389 -j ACCEPT

# PUERTO GOOGLE TALK
$ipt -A FORWARD -p tcp --dport 5222 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 5222 -j ACCEPT

# SISTEMA WEBCONTROL (SEGUIMIENTO DE CAMIONES)
$ipt -A FORWARD -p tcp --dport 7002 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 7002 -j ACCEPT

# PUERTO SKYPE p/LLAMADAS ENTRANTES
$ipt -A FORWARD -p tcp --dport 44018 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 44018 -j ACCEPT

# LEO ARCHIVO DE MAC ADDRESS HABILITADAS
for mac in `grep -v ^# $listamac | awk '{print $1}'`;
do
$ipt -A FORWARD -p tcp -m mac --mac-source $mac -j ACCEPT
done
 
$ipt -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

############## FIN ARCHIVO DE CONFIGURACION ##############