#!/bin/bash
 
#  
office=192.168.0.2
 
# 
admin=192.168.0.5
 
# 
server0=192.168.0.1
server1=10.15.1.2
 
#     mp3  video
#video_serv=172.18.1.2
 
#    
iface_cli=eth1
 
#     
iface_world=eth0
 
#    
#iface_int=etheth2
 
#,      
conf_port=5555
user_port1=5555
user_port2=5555
 
#     
#   ,    
#    ,    - 
#   ,   
echo "1" > /proc/sys/net/ipv4/ip_forward
 
#   
iptables -t filter -F
iptables -t filter -X
iptables -t nat -F
iptables -t nat -X
 
#    DROP:  ӣ 
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP

#      
iptables -t filter -A INPUT -p icmp -j ACCEPT
iptables -t filter -A FORWARD -p icmp -j ACCEPT
iptables -t filter -A OUTPUT -p icmp -j ACCEPT
 
#  ӣ   
iptables -t filter -A INPUT -d 127.0.0.1 -j ACCEPT
iptables -t filter -A OUTPUT -s 127.0.0.1 -j ACCEPT

#      
iptables -t filter -A INPUT -i $iface_world -j ACCEPT
iptables -t filter -A OUTPUT -o $iface_world -j ACCEPT
 
#  -      
#iptables -t filter -A INPUT -s $video_serv -j ACCEPT
# iptables -t filter -A FORWARD -s $video_serv -j ACCEPT
# iptables -t filter -A FORWARD -d $video_serv -j ACCEPT
# iptables -t filter -A OUTPUT -d $video_serv -j ACCEPT
 
# DNS. ,     TCP   UDP
iptables -t filter -A INPUT -p tcp --sport 53 -j ACCEPT
iptables -t filter -A FORWARD -p tcp --sport 53 -j ACCEPT
iptables -t filter -A FORWARD -p tcp --dport 53 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p udp --sport 53 -j ACCEPT
iptables -t filter -A FORWARD -p udp --sport 53 -j ACCEPT
iptables -t filter -A FORWARD -p udp --dport 53 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
 
# SSH
iptables -t filter -A INPUT -p tcp -s $office -d $server0 --dport 22 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp -d $office -s $server0 --sport 22 -j ACCEPT
iptables -t filter -A INPUT -p tcp -s $admin -d $server0 --dport 22 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp -d $admin -s $server0 --sport 22 -j ACCEPT


 
# Stargazer configurator
iptables -t filter -A INPUT -p tcp -s 192.168.0.0/24 -d $server0 --dport $conf_port -j ACCEPT
iptables -t filter -A OUTPUT -p tcp -d 192.168.0.0/24 -s $server0 --sport $conf_port -j ACCEPT
 
# UDP stargazer InetAccess
iptables -t filter -A INPUT -p udp -s 192.168.0.0/24 --sport $user_port2 -d $server0 --dport $user_port1 -j ACCEPT
iptables -t filter -A OUTPUT -p udp -d 192.168.0.0/24 --dport $user_port1 -s $server0 -j ACCEPT

#All local
iptables -t filter -A INPUT -p tcp -s 192.168.0.0/24 -d $server0 -j ACCEPT                                
iptables -t filter -A OUTPUT -p tcp -d 192.168.0.0/24 -s $server0 -j ACCEPT
 
#
iptables -t nat -A POSTROUTING -d 0.0.0.0/0 -j MASQUERADE
#iptables -t nat -A POSTROUTING -s 0.0.0.0/0 -o eth0 -j MASQUERADE


