#CRITICAL: Enable IP forwarding since it is disabled by default.
echo "1" > /proc/sys/net/ipv4/ip_forward

#Clear all chains of rule
iptables -F
iptables -X allowed
iptables -X icmp_packets
iptables -t nat -F

# Chain Policies gets set up before any bad packets gets through
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# the allowed chain for TCP connections, utilized in the FORWARD chain
iptables -N allowed
iptables -A allowed -p TCP --syn -j ACCEPT
iptables -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A allowed -p TCP -j DROP

# ICMP rules, utilized in the FORWARD chain
iptables -N icmp_packets
iptables -A icmp_packets -p ICMP -s 0/0 --icmp-type 0 -j ACCEPT
iptables -A icmp_packets -p ICMP -s 0/0 --icmp-type 3 -j ACCEPT
iptables -A icmp_packets -p ICMP -s 0/0 --icmp-type 5 -j ACCEPT
iptables -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT

# POSTROUTING chain in the nat table : Enable IP SNAT for all internal networks trying to get out on the Internet
iptables -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP

# PREROUTING chain in the nat table

          # Do some checks for obviously spoofed IP's
iptables -t nat -A PREROUTING -i $INET_IFACE -s 192.168.0.0/16 -j DROP
iptables -t nat -A PREROUTING -i $INET_IFACE -s 10.0.0.0/8 -j DROP
iptables -t nat -A PREROUTING -i $INET_IFACE -s 172.16.0.0/12 -j DROP
iptables -t nat -A PREROUTING -i $INET_IFACE -s $INET_IP -j DROP

          # Enable IP Destination NAT for DMZ zone (Inbound NAT)
iptables -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $HTTP_IP --dport 80 -j DNAT --to-destination $DMZ_HTTP_IP
iptables -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $DNS_IP --dport 53 -j DNAT --to-destination $DMZ_DNS_IP
iptables -t nat -A PREROUTING -p UDP -i $INET_IFACE -d $DNS_IP --dport 53 -j DNAT --to-destination $DMZ_DNS_IP

          # Enable Internal network connect to DMZ HTTP and DMZ DNS by public IP (update by Adisorn)
iptables -t nat -A PREROUTING -p TCP -i $LAN_IFACE -d $HTTP_IP --dport 80 -j DNAT --to-destination $DMZ_HTTP_IP
iptables -t nat -A PREROUTING -p TCP -i $LAN_IFACE -d $DNS_IP --dport 53 -j DNAT --to-destination $DMZ_DNS_IP
iptables -t nat -A PREROUTING -p UDP -i $LAN_IFACE -d $DNS_IP --dport 53 -j DNAT --to-destination $DMZ_DNS_IP

          #Redirect all http from internal network (not DMZ http destination) to Proxy Server (Transparent Proxy) (update by sorn)
iptables -t nat -A PREROUTING -p TCP -i $LAN_IFACE -s 192.168.1.0/24 -d ! $DMZ_HTTP_IP --dport 80 -j DNAT --to-dest 192.168.2.4:3128

# FORWARD chain

          # Get rid of bad TCP packets
iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP

          # DMZ section : General rules
iptables -A FORWARD -i $DMZ_IFACE -o $INET_IFACE -j ACCEPT
iptables -A FORWARD -i $INET_IFACE -o $DMZ_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $LAN_IFACE -o $DMZ_IFACE -j ACCEPT
iptables -A FORWARD -i $DMZ_IFACE -o $LAN_IFACE -j ACCEPT

          # DMZ section : HTTP server
iptables -A FORWARD -p TCP -i $INET_IFACE -o $DMZ_IFACE -d $DMZ_HTTP_IP --dport 80 -j allowed
iptables -A FORWARD -p ICMP -i $INET_IFACE -o $DMZ_IFACE -d $DMZ_HTTP_IP -j icmp_packets         

          #DMZ section : DNS server
iptables -A FORWARD -p TCP -i $INET_IFACE -o $DMZ_IFACE -d $DMZ_DNS_IP --dport 53 -j allowed
iptables -A FORWARD -p UDP -i $INET_IFACE -o $DMZ_IFACE -d $DMZ_DNS_IP --dport 53 -j ACCEPT
iptables -A FORWARD -p ICMP -i $INET_IFACE -o $DMZ_IFACE -d $DMZ_DNS_IP -j icmp_packets                   

          # LAN section
iptables -A FORWARD -i $LAN_IFACE -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

          # LOG all packets reaching here
iptables -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "

# Firewall rules

          # INPUT chain

                    #Get rid of bad packets
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

                    # Packets from the Internet to this box
iptables -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets

                    # Packets from LAN, DMZ or LOCALHOST

                              # From DMZ Interface to DMZ firewall IP
iptables -A INPUT -p ALL -i $DMZ_IFACE -d $DMZ_IP -j ACCEPT

                              # From LAN Interface to LAN firewall IP
iptables -A INPUT -p ALL -i $LAN_IFACE -d $LAN_IP -j ACCEPT
iptables -A INPUT -p ALL -i $LAN_IFACE -d $LAN_BCAST_ADRESS -j ACCEPT

                              # From Localhost interface to Localhost IP
iptables -A INPUT -p ALL -i $LO_IFACE -d $LO_IP -j ACCEPT

                    # All established and related packets incoming from the internet to the firewall
iptables -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED -j ACCEPT

                    # Logging rule
iptables -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "

          # OUTPUT chain

                    # Get rid of bad TCP packets
iptables -A OUTPUT -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
iptables -A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP

                    # Allow ourself to send packets not spoofed everywhere
iptables -A OUTPUT -p ALL -o $LO_IFACE -s $LO_IP -j ACCEPT
iptables -A OUTPUT -p ALL -o $LAN_IFACE -s $LAN_IP -j ACCEPT
iptables -A OUTPUT -p ALL -o $INET_IFACE -s $INET_IP -j ACCEPT