#!/bin/bash

[ -x $IPTABLES ] || exit 43

# ----------------------------- filter inetif:out chain -------------------------------

    $IPTABLES -F filter_out_inet

    # filter all SMTP packets
    # filter output packets (port 25 - apache)
    # $IPTABLES -A filter_out_inet ! -d 127.0.0.1 -p tcp -m tcp --dport 25 -m owner --uid-owner 33 -j DROP
    $IPTABLES -A filter_out_inet -o $INETIF -p tcp -m tcp --dport 25 -m owner --uid-owner 33 -j DROP
    #$IPTABLES -A filter_out_inet -o $INETIF -p tcp -m tcp --dport 465 -m owner --uid-owner 33 -j DROP
    #$IPTABLES -A filter_out_inet -o $INETIF -p tcp -m tcp --dport 587 -m owner --uid-owner 33 -j DROP
    #$IPTABLES -A filter_out_inet -o $INETIF -p tcp -m tcp --dport 10024:10027 -m owner --uid-owner 33 -j DROP

    #$IPTABLES -A filter_out_inet -o $INETIF -m u32 -p udp --sport 53 --u32 "28&0x0000F00F=0x8005" -j DROP

    # enable everything else
    $IPTABLES -A filter_out_inet -o $INETIF -p all -j ACCEPT

# ------------------------------ filter inetif:in chain -------------------------------

    $IPTABLES -F filter_in_inet

    # Protect against fake LAN/loopback connections from INET
    SPOOF_INET="0.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16"
    for spoofip in $SPOOF_INET; do
	$IPTABLES -A filter_in_inet -i $INETIF -p all -s $spoofip -j DROP
    done

    # drop all that's not addressed to the subnet
    #$IPTABLES -A filter_in_inet -i $INETIF -p all ! -d $INETSUB -j DROP

# -----------------------------------------------------------------------------

    #SSH
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 222 -j ACCEPT

    #FTP & SFTP server
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 21 -j ACCEPT
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 20 -j ACCEPT
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 121 -j ACCEPT
    # FTP passive port range
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 49200:50200 -j ACCEPT

    #DNS Server
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 53 -j ACCEPT
    $IPTABLES -A filter_in_inet -i $INETIF -p udp --dport 53 -j ACCEPT

    #SMTP
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 25 -j ACCEPT
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 587 -j ACCEPT
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 2525 -j ACCEPT
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 465 -j ACCEPT

    #POP3 + POP3-SSL
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 110 -j ACCEPT
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 995 -j ACCEPT

    #IMAP + IMAP-SSL
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 143 -j ACCEPT
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 993 -j ACCEPT

    #SIEVE-MANAGESIEVE
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 2000 -j ACCEPT

    # Admin HTTP (SSL)
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 8443 -j ACCEPT

    #WWW + WWW-SSL
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 80 -j ACCEPT
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 443 -j ACCEPT
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 44301:44310 -j ACCEPT
    #TEST (direct apache)
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 8084 -j ACCEPT
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 8080 -j ACCEPT
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 8081 -j ACCEPT

    #MySQL [SSL Tunneled on port 33306]
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 33306 -j ACCEPT

    #Rsync [SSL tunneled on port 8873]
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 8873 -j ACCEPT

    #OpenVPN
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 1194 -j ACCEPT
    $IPTABLES -A filter_in_inet -i $INETIF -p udp --dport 1194 -j ACCEPT

    # RAID status for nagios
    $IPTABLES -A filter_in_inet -i $INETIF -p tcp --dport 34000 -m limit --limit 1/s -j ACCEPT

    # ping from Nagios
    $IPTABLES -A filter_in_inet -i $INETIF -s 88.151.97.186 -p icmp --icmp-type echo-request -j ACCEPT

# The rest  -----------------------------------------------------------------------------

    $IPTABLES -A filter_in_inet -i $INETIF -m state --state RELATED,ESTABLISHED -j ACCEPT

    $IPTABLES -A filter_in_inet -i $INETIF -m state --state NEW,INVALID -j DROP
    $IPTABLES -A filter_in_inet -i $INETIF -j DROP