root@gw5:~# cat /etc/network/if-pre-up.d/firewall
#! /bin/sh
TH="192.168.0.65,80.247.XXX.XXX,80.247.99.XXX,109.202.X.XXX"    # Trusted hosts debug,imex,avantel,hz
IPT="/sbin/iptables"
EXT_IF="eth0"
INT_IF1="eth1"
INT_IF2="eth2"
INT_IF3="eth3"

NET_WAN="194.150.156.115"

NET_LAN1="192.168.1.0/24"
NET_LAN2="192.168.2.0/24"
NET_LAN3="192.168.0.0/24"

squid3="3128"

DNS_SEARCH="search rotor.ru"

# LAN DNS
DNS="192.168.0.27" # local DNS on Ms Windows

echo "\n\t[+] Setting up dns-nameservers to DC..."
echo $DNS_SEARCH'\nnameserver '$DNS > /etc/resolv.conf # it's work if no nameservers in /etc/network/interfaces file

echo "\t[+] Changing NTP-server to DC in LAN..."
sed -i 's/^server.*/server '$DNS'/g' /etc/ntp.conf

echo "\t[+] Flashing all usr rules..."
$IPT -t mangle -F && $IPT -t filter -F && $IPT -t nat -F && $IPT -F && $IPT -X

echo "\t[+] Enabling ipv4 routing feauture..."
echo 1 > /proc/sys/net/ipv4/ip_forward

echo "\t[+] Seting global policy to DROP ALL..."
$IPT -P INPUT DROP && $IPT -P OUTPUT DROP && $IPT -P FORWARD DROP
# -----------------------------------------------------------------------------

###### INPUT chain ######
echo "\t[+] Setting up INPUT chain..."

### state tracking rules
# $IPT -A INPUT -m conntrack --ctstate INVALID -j LOG --log-prefix "DROP INVALID INPUT PKT " --log-ip-options --log-tcp-options
$IPT -A INPUT -m conntrack --ctstate INVALID -j DROP
$IPT -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

### anti-spoofing rules (inside initialired lan2lan routing accepteed)
# $IPT -A INPUT -i $INT_IF1 ! -s $NET_LAN1 -j LOG --log-prefix "DROP SPOOFED INPUT[1] PKT "     # FG conpany lan
$IPT -A INPUT -i $INT_IF1 ! -s $NET_LAN1 -j DROP
#
# $IPT -A INPUT -i $INT_IF2 ! -s $NET_LAN2 -j LOG --log-prefix "DROP SPOOFED INPUT[2] PKT "     # AF conpany lan
$IPT -A INPUT -i $INT_IF2 ! -s $NET_LAN2 -j DROP
#
# $IPT -A INPUT -i $INT_IF3 ! -s $NET_LAN3 -j LOG --log-prefix "DROP SPOOFED INPUT[3] PKT "     # empty lan
$IPT -A INPUT -i $INT_IF3 ! -s $NET_LAN3 -j DROP

### ACCEPT rules [ssh,www,webmin,ping]
# > [WAN]
$IPT -A INPUT -i $EXT_IF -s $TH -p tcp -m multiport --dport ssh,www,webmin,3333,3335,3336,3389,6666 -m tcp --syn -m conntrack --ctstate NEW -j ACCEPT

# > [LAN]
$IPT -A INPUT ! -i $EXT_IF -p tcp -m multiport --dport ssh,$squid3,webmin -m conntrack --ctstate NEW -j ACCEPT # allow to connect proxy and ssh from LAN's ip

# > [ANY]
$IPT -A INPUT -p icmp --icmp-type any -j ACCEPT

### default INPUT LOG rule
# $IPT -A INPUT ! -i lo -j LOG --log-prefix "DROP NO-LOOPBACK INPUT PKT " --log-ip-options --log-tcp-options

### make sure that loopback traffic is accepted

$IPT -A INPUT -i lo -j ACCEPT
# -----------------------------------------------------------------------------

###### OUTPUT chain ######
echo "\t[+] Setting up OUTPUT chain..."

### state tracking rules
# $IPT -A OUTPUT -m conntrack --ctstate INVALID -j LOG --log-prefix "DROP INVALID OUTPUT PKT " --log-ip-options --log-tcp-options
$IPT -A OUTPUT -m conntrack --ctstate INVALID -j DROP
$IPT -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

### ACCEPT rules for allowing connections out [ftp,ssh,www,ntp,https,dns,ping]
$IPT -A OUTPUT -o $EXT_IF -s $NET_WAN -p tcp -m multiport --dport ftp-data,ftp,ssh,www,ntp,https,aol,xmpp-client -m conntrack --ctstate NEW -j ACCEPT
$IPT -A OUTPUT -o $EXT_IF -s $NET_WAN -p udp -m multiport --dport ssh,www,ntp,https,aol,xmpp-client -m conntrack --ctstate NEW -j ACCEPT

$IPT -A OUTPUT -o $EXT_IF -p tcp --dport domain -m conntrack --ctstate NEW -j ACCEPT # DNS tcp/udp
$IPT -A OUTPUT -o $EXT_IF -p udp --dport domain -m conntrack --ctstate NEW -j ACCEPT

$IPT -A OUTPUT -s $NET_LAN1,$NET_LAN2,$NET_LAN3 -p tcp -m multiport --dport domain,ssh,ntp -m conntrack --ctstate NEW -j ACCEPT # allow ssh,dns from LAN
$IPT -A OUTPUT -s $NET_LAN1,$NET_LAN2,$NET_LAN3 -p udp -m multiport --dport domain,ssh,ntp -m conntrack --ctstate NEW -j ACCEPT # allow ssh,dns from LAN

$IPT -A OUTPUT -p icmp --icmp-type any -j ACCEPT

### default OUTPUT LOG rule
# $IPT -A OUTPUT ! -o lo -j LOG --log-prefix "DROP NO-LOOPBACK OUTPUT PKT " --log-ip-options --log-tcp-options

### make sure that loopback traffic is accepted
$IPT -A OUTPUT -o lo -j ACCEPT
# -----------------------------------------------------------------------------

###### FORWARD chain ######
#
echo "\t[+] Setting up FORWARD chain..."

### state tracking rules
$IPT -A FORWARD -m conntrack --ctstate INVALID -j LOG --log-prefix "DROP INVALID FORWARD PKT " --log-ip-options --log-tcp-options
$IPT -A FORWARD -m conntrack --ctstate INVALID -j DROP
$IPT -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

### anti-spoofing rules
# $IPT -A FORWARD -i $INT_IF1 ! -s $NET_LAN1 -j LOG --log-prefix "DROP SPOOFED FORWARD[1] PKT "           # FG company lan
$IPT -A FORWARD -i $INT_IF1 ! -s $NET_LAN1 -j DROP
#
# $IPT -A FORWARD -i $INT_IF2 ! -s $NET_LAN2 -j LOG --log-prefix "DROP SPOOFED FORWARD[2] PKT "           # AF company lan
$IPT -A FORWARD -i $INT_IF2 ! -s $NET_LAN2 -j DROP
#
# $IPT -A FORWARD -i $INT_IF3 ! -s $NET_LAN3 -j LOG --log-prefix "DROP SPOOFED FORWARD[3] PKT "           # empty lan
$IPT -A FORWARD -i $INT_IF3 ! -s $NET_LAN3 -j DROP
#
# allow to forward: [rdp's, escom_8080],[mail only from lan-s_ip]
$IPT -A FORWARD -i $EXT_IF -s $TH -p tcp -m multiport --dport 3333,3335,3389,6666,http-alt -m tcp --syn -m conntrack --ctstate NEW -j ACCEPT
$IPT -A FORWARD -s $NET_LAN1,$NET_LAN2,$NET_LAN3 -p tcp -m multiport --dport smtp,pop3,ntp -m conntrack --ctstate NEW -j ACCEPT         # MAIL fwd from LAN's accept
$IPT -A FORWARD -s $NET_LAN1,$NET_LAN2,$NET_LAN3 -p udp -m multiport --dport ntp -m conntrack --ctstate NEW -j ACCEPT   # time fwd from LAN's$

#

# $IPT -A FORWARD -p tcp -m multiport --dport domain,ntp -m conntrack --ctstate NEW -j ACCEPT                   # DNS, NTP tcp/udp fwd
$IPT -A FORWARD -p udp -m multiport --dport domain,ntp,123 -m conntrack --ctstate NEW -j ACCEPT
$IPT -A FORWARD -p icmp --icmp-type any -j ACCEPT
#
### default LOG rule
# $IPT -A FORWARD ! -i lo -j LOG --log-prefix "DROP LOOPBACK FORWARD PKT " --log-ip-options --log-tcp-options
# -----------------------------------------------------------------------------

###### NAT rules ######
#
echo "\t[+] Setting up NAT rules..."

$IPT -t nat -A PREROUTING -p tcp --dport 3333 -i $EXT_IF -j DNAT --to 192.168.1.250:3389        # RTS (and DMZ)
$IPT -t nat -A PREROUTING -p tcp --dport 3335 -i $EXT_IF -j DNAT --to 192.168.1.4:3389          # Machine D2
$IPT -t nat -A PREROUTING -p tcp --dport 3389 -i $EXT_IF -j DNAT --to 192.168.1.2:3389          # ADDC name: XXX1
$IPT -t nat -A PREROUTING -p tcp --dport 6666 -i $EXT_IF -j DNAT --to 192.168.1.2:8080          # escom remote mycompany -> enemy1

# Tune Up (troubleshooting's)
$IPT -t nat -A PREROUTING -s $NET_LAN1,$NET_LAN2,$NET_LAN3 -p tcp -m multiport --dport ftp,ftp-data,www,https,aol,xmpp-client -j REDIRECT --to-ports $squid3 # add www,https
$IPT -t nat -A PREROUTING -s $NET_LAN1,$NET_LAN2,$NET_LAN3 -p udp -m multiport --dport www,https,aol,xmpp-client -j REDIRECT --to-ports $squid3 # add www,https
# http,https,icq,qip.ru redirect to -> squid3

# -----------------------------------------------------------------------------

##### MASCARADING #####
#
echo "\t[+] Mascarade require traffic...\n"
$IPT -t nat -A POSTROUTING -s $NET_LAN1,$NET_LAN2,$NET_LAN3 -o $EXT_IF -j MASQUERADE            # enable acces LAN's -> WAN
#
echo INTERNET:'\t'$NET_WAN '('$EXT_IF')'
echo NETWORKS:'\n\t\t'$NET_LAN1 '('$INT_IF1')\n\t\t'$NET_LAN2 '('$INT_IF2')\n\t\t'$NET_LAN3 '('$INT_IF3')'
root@gw5:~#