#!/bin/bash

### BEGIN INIT INFO
# Provides:          firewall-3g
# Required-Start:    $network $local_fs
# Required-Stop:     $network $local_fs
# Default-Start:     S
# Default-Stop:
# Short-Description: The iptables init (firewall)
# Description:       3gteam firewall initialization
### END INIT INFO

IPTABLES=/sbin/iptables
CFDIR=/etc/firewall/config

. $CFDIR/if.conf

# ----------------------------- init -------------------------------

fw_init() {

    echo -n " init"

    #modprobe ipt_LOG              
    #modprobe ipt_limit               

    #Turn on IP forwarding
    echo 1 >/proc/sys/net/ipv4/ip_forward

    # Reset tables
    $IPTABLES -F
    $IPTABLES -X
    $IPTABLES -t nat -F
    $IPTABLES -t nat -X
    $IPTABLES -t mangle -F
    $IPTABLES -t mangle -X

    # Defaults (DROP ALL)
    $IPTABLES -P INPUT  DROP
    $IPTABLES -P FORWARD DROP
    $IPTABLES -P OUTPUT DROP

# run global init scripts before any rules

    custom_init

# loopback filters

    $IPTABLES -N filter_in_loop
    $IPTABLES -A INPUT -j filter_in_loop
    $IPTABLES -A FORWARD -j filter_in_loop
    
    $IPTABLES -N filter_out_loop
    $IPTABLES -A OUTPUT -j filter_out_loop

# dropfilter (before filters, after loopback)

    $IPTABLES -N filter_drop
    $IPTABLES -A INPUT -j filter_drop
    $IPTABLES -A FORWARD -j filter_drop
    $IPTABLES -A OUTPUT -j filter_drop

# global filters (before adapters)

    $IPTABLES -N filter_in_global
    $IPTABLES -A INPUT -j filter_in_global
    $IPTABLES -A FORWARD -j filter_in_global
    
    $IPTABLES -N filter_out_global
    $IPTABLES -A OUTPUT -j filter_out_global

# filters per adapter

    for filter in $FILTERS; do

        $IPTABLES -N filter_in_$filter
        $IPTABLES -A INPUT -j filter_in_$filter
        $IPTABLES -A FORWARD -j filter_in_$filter
    
        $IPTABLES -N filter_out_$filter
        $IPTABLES -A OUTPUT -j filter_out_$filter

    done

# drop all remaining

    $IPTABLES -A INPUT -m state --state NEW,INVALID -j DROP
    $IPTABLES -A INPUT -j DROP
    $IPTABLES -A FORWARD -j DROP
    $IPTABLES -A OUTPUT -j DROP

# NAT

    # NAT (POSTROUTING)
    $IPTABLES -t nat -N route_post
    $IPTABLES -t nat -A POSTROUTING -j route_post

    # NAT (PREROUTING)
    $IPTABLES -t nat -N route_pre
    $IPTABLES -t nat -A PREROUTING -j route_pre

    # NAT (OUTPUT)
    $IPTABLES -t nat -N filter_out
    $IPTABLES -t nat -A OUTPUT -j filter_out

}

# ----------------------------- custom init rules -------------------------------

custom_init() {

    echo -n " custom ["

    CCFGS=`ls -1 $CFDIR/custom.d`

    for ccfg in $CCFGS; do

	echo -n " $ccfg"

	[ -f $CFDIR/custom.d/$ccfg ] && . $CFDIR/custom.d/$ccfg

    done

    echo -n " ]"

}

# ----------------------------- dropfilter chain -------------------------------

dropfilter() {

    echo -n " dropfilter"
    $IPTABLES -F filter_drop

    DROPLIST=/var/lib/droplist/drop.lasso

    if [ -f $DROPLIST ]; then
	cat "$DROPLIST" \
	| sed -e 's/;.*//' \
	| grep -v '^ *$' \
	| while read NB ; do
	    $IPTABLES -A filter_drop -s "$NB" -j DROP
	    $IPTABLES -A filter_drop -d "$NB" -j DROP
	done
    fi

}

# ----------------------------- filter chain -------------------------------

filter() {

    echo -n " filters ["

    CHAINS=`ls -1 $CFDIR/conf.d`

    for chain in $CHAINS; do

	echo -n " $chain"

	[ -f $CFDIR/conf.d/$chain ] && . $CFDIR/conf.d/$chain

    done

    echo -n " ]"

}


# ----------------------------------------------------------------------------------

case "$1" in
    start|restart)

	echo -n "Initializing firewall rules: "

	fw_init
	filter
	dropfilter

	echo " done."

	[ -f /var/run/fail2ban/fail2ban.pid ] && /etc/init.d/fail2ban restart
	exit 0
    ;;
    reload-all)

	echo -n "Reloading firewall filters: "

	filter
	dropfilter

	echo " done."
    ;;
    reload)

	echo -n "Reloading firewall filters: "

	filter

	echo " done."
    ;;
    stop)
	exit 0
    ;;
    *)
        echo "Usage: $0 {start|restart|reload|reload-all}"
        exit 1
    ;;
esac
