#!/bin/bash

##### DROP ALL POLICY
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

##### Flush all rules then enable forwarding and nating
/sbin/iptables -F
/sbin/iptables -F PREROUTING -t nat
sbin/iptables -t nat -F POSTROUTING
/bin/echo "1" > /proc/sys/net/ipv4/ip_forward
/bin/echo "0" > /proc/sys/net/ipv4/ip_dynaddr

## DROP IPV6 and DISABLE IF WE DONT USE
/bin/echo 1 > /proc/sys/net/ipv6/conf/ens32/disable_ipv6
/bin/echo 1 > /proc/sys/net/ipv6/conf/lo/disable_ipv6
/usr/sbin/sysctl -w net.ipv6.conf.all.disable_ipv6=1

## STATEFUL RULES

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

##### DROP ALL CRAZY KIDDIE HACKS LIKE SYN FLOODS, FRAGMENTED & CHRISMAS TREE STUFF

# Drop new connections unless they are SYN

/sbin/iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

# Drop fragmented packets

/sbin/iptables -A INPUT -f -j DROP

# Drop XMAS packets

/sbin/iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

# Drop NULL packets

/sbin/iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

# SUPREMLY DUMB SPAMMERS - THEY ARE ON MY S-LIST

iptables -A INPUT -s 75.102.22.112  -j DROP
iptables -A FORWARD -s 75.102.22.112 -j DROP

#BLOCK DUMB SPAMMERS AND HACKERS

iptables -A INPUT -s 193.173.46.196 -j DROP
iptables -A INPUT -s 80.69.67.4 -j DROP
iptables -A INPUT -s 72.166.181.37 -j DROP
iptables -A INPUT -s 59.0.0.0/8 -j LOG --log-prefix "HACKIP-59.0.0.0"
iptables -A INPUT -s 216.82.0.0/16 -j DROP
iptables -A INPUT -s 216.82.42.34 -j DROP
iptables -A INPUT -s 59.0.0.0/8 -j DROP
iptables -A INPUT -s 89.0.0.0/8 -j DROP 
iptables -A INPUT -s 88.0.0.0/8 -j DROP
iptables -A INPUT -s 87.0.0.0/8 -j DROP
iptables -A INPUT -s 86.0.0.0/8 -j DROP
iptables -A INPUT -s 85.0.0.0/8 -j DROP
iptables -A INPUT -s 84.0.0.0/8 -j DROP
iptables -A INPUT -s 83.0.0.0/8 -j DROP
iptables -A INPUT -s 82.0.0.0/8 -j DROP
iptables -A INPUT -s 81.0.0.0/8 -j DROP
iptables -A INPUT -s 0.0.0.0/8 -j DROP
iptables -A INPUT -s 1.0.0.0/8 -j DROP
iptables -A INPUT -s 2.0.0.0/8 -j DROP
iptables -A INPUT -s 5.0.0.0/8 -j DROP
iptables -A INPUT -s 23.0.0.0/8 -j DROP
iptables -A INPUT -s 27.0.0.0/8 -j DROP
iptables -A INPUT -s 31.0.0.0/8 -j DROP
iptables -A INPUT -s 36.0.0.0/8 -j DROP
iptables -A INPUT -s 37.0.0.0/8 -j DROP
iptables -A INPUT -s 39.0.0.0/8 -j DROP
iptables -A INPUT -s 42.0.0.0/8 -j DROP
iptables -A INPUT -s 46.0.0.0/8 -j DROP
iptables -A INPUT -s 49.0.0.0/8 -j DROP
iptables -A INPUT -s 50.0.0.0/8 -j DROP
iptables -A INPUT -s 100.0.0.0/8 -j DROP
iptables -A INPUT -s 101.0.0.0/8 -j DROP
iptables -A INPUT -s 102.0.0.0/8 -j DROP
iptables -A INPUT -s 103.0.0.0/8 -j DROP
iptables -A INPUT -s 104.0.0.0/8 -j DROP
iptables -A INPUT -s 105.0.0.0/8 -j DROP
iptables -A INPUT -s 106.0.0.0/8 -j DROP
iptables -A INPUT -s 107.0.0.0/8 -j DROP
iptables -A INPUT -s 108.0.0.0/8 -j DROP
iptables -A INPUT -s 109.0.0.0/8 -j DROP
iptables -A INPUT -s 110.0.0.0/8 -j DROP
iptables -A INPUT -s 111.0.0.0/8 -j DROP
iptables -A INPUT -s 112.0.0.0/8 -j DROP
iptables -A INPUT -s 113.0.0.0/8 -j DROP
iptables -A INPUT -s 114.0.0.0/8 -j DROP
iptables -A INPUT -s 115.0.0.0/8 -j DROP
iptables -A INPUT -s 127.0.0.0/8  -i ens32 -j DROP
iptables -A INPUT -s 174.0.0.0/8 -j DROP
iptables -A INPUT -s 175.0.0.0/8 -j DROP
iptables -A INPUT -s 176.0.0.0/8 -j DROP
iptables -A INPUT -s 177.0.0.0/8 -j DROP
iptables -A INPUT -s 178.0.0.0/8 -j DROP
iptables -A INPUT -s 179.0.0.0/8 -j DROP
iptables -A INPUT -s 180.0.0.0/8 -j DROP
iptables -A INPUT -s 181.0.0.0/8 -j DROP
iptables -A INPUT -s 182.0.0.0/8 -j DROP
iptables -A INPUT -s 183.0.0.0/8 -j DROP
iptables -A INPUT -s 184.0.0.0/8 -j DROP
iptables -A INPUT -s 185.0.0.0/8 -j DROP
iptables -A INPUT -s 192.0.2.0/24 -j DROP
iptables -A INPUT -s 197.0.0.0/8 -j DROP
iptables -A INPUT -s 198.18.0.0/15 -j DROP
iptables -A INPUT -s 200.0.0.0/8 -j DROP
iptables -A INPUT -s 201.0.0.0/8 -j DROP
iptables -A INPUT -s 216.82.0.0/16 -j DROP
iptables -A INPUT -s 216.82.42.34 -j DROP
iptables -A INPUT  -i ens32 -s 223.0.0.0/8 -j DROP
iptables -A INPUT  -i ens32 -s 224.0.0.0/3 -j DROP

# SPOOFING RULES
/sbin/iptables -A INPUT -s 192.168.200.0/24 -i ens32 -j LOG --log-prefix "DROP SPOOFING192.168.200.0/24"
/sbin/iptables -A INPUT -s 192.168.200.0/24 -i ens32 -j DROP

/sbin/iptables -A INPUT -s 172.16.0.0/12 -i ens32 -j LOG --log-prefix "DROP SPOOFING172.16.15.0.0/16"
/sbin/iptables -A INPUT -s 172.16.0.0/12 -i ens32 -j DROP

/sbin/iptables -A INPUT -s 169.254.0.0/16 -i ens32 -j LOG --log-prefix "DROP SPOOFING"
iptables -A INPUT -s 169.254.0.0/16 -i ens32 -j DROP

#HIDE NAT or MASQ
/sbin/iptables -t nat -A POSTROUTING -o ens32 -s 192.168.200.0/24 ! -d 10.5.100.0/24 -j MASQUERADE


# INBOUND ALLOWED FROM WORLD 

# WORLD OPENSWAN VPN IN AND OUT
/sbin/iptables -A INPUT -p udp --sport 500 --dport 500 -m state --state NEW -j ACCEPT
/sbin/iptables -A INPUT -p udp --dport 4500 -m state --state NEW -j ACCEPT
/sbin/iptables -A OUTPUT -p udp --sport 500 --dport 500 -m state --state NEW -j ACCEPT
/sbin/iptables -A OUTPUT -p udp --dport 4500 -m state --state NEW -j ACCEPT
/sbin/iptables -A INPUT -p 51 -j ACCEPT
/sbin/iptables -A OUTPUT -p 51 -j ACCEPT

# WORLD INBOUND SSH ------- IMPORTANT!!!! US ONLY FOR RSA and OHTER CONFERENCES
/sbin/iptables -A INPUT -p tcp  --dport 22 -m state --state NEW -j ACCEPT


# WORLD INBOUND SSH
/sbin/iptables -N LOGDROP
/sbin/iptables -A LOGDROP -j LOG --log-prefix "SSH BRUTE FORCE ATTEMPT "
/sbin/iptables -A LOGDROP -j DROP
/sbin/iptables -A INPUT -p tcp -s 192.168.200.0/24 --dport 22 -m state --state NEW -m recent --set --name SSH
/sbin/iptables -A INPUT -p tcp -s 192.168.200.0/24 --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 --rttl --name SSH -j LOGDROP
/sbin/iptables -A INPUT -p tcp -s 192.168.200.0/24 --dport 22 -m state --state NEW -j LOG --log-prefix "NEW SSH CONN "
/sbin/iptables -A INPUT -p tcp -s 192.168.200.0/24 --dport 22 -m state --state NEW -j ACCEPT

# INBOUND ALLOWED FROM INTERNAL
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A INPUT -p tcp -s 192.168.200.0/24 --dport 22 -m state --state NEW -j ACCEPT

# INBOUND ICMP ALLOW
iptables -A INPUT -p ICMP -m limit --limit 10/minute --limit-burst 3 -j ACCEPT


## SERVICE NATS

/sbin/iptables -t nat -A PREROUTING -p udp -m udp  -i ens32 -d 192.168.100.87 \
                --dport 514 -m state --state NEW -j DNAT --to 192.168.200.20:514

## SPLUNK RULE FROM OUTSIDE
# /sbin/iptables -t nat -A PREROUTING -p tcp -m tcp  -i ens32 -d 192.168.100.87 \
#                --dport 8000 -m state --state NEW -j DNAT --to 192.168.200.20:8000

/sbin/iptables -t nat -A PREROUTING -p tcp -m tcp  -i ens32 -d 192.168.100.87 \
                --dport 80 -m state --state NEW -j DNAT --to 192.168.200.80:80

/sbin/iptables -t nat -A PREROUTING -p tcp -m tcp  -i ens32 -d 192.168.100.87 \
                --dport 443 -m state --state NEW -j DNAT --to 192.168.200.80:443

## CISCO IPSEC
/sbin/iptables -t nat -A PREROUTING -p udp -m tcp  -i ens32 -d 192.168.100.87 \
                --dport 500 -m state --state NEW -j DNAT --to 192.168.200.250:500
# /sbin/iptables -t nat -A PREROUTING -p 50 -m tcp  -i ens32 -d 192.168.100.87 \
#                -m state --state NEW -j DNAT --to 192.168.200.250
# /sbin/iptables -t nat -A PREROUTING -p 51 -m tcp  -i ens32 -d 192.168.100.87 \
#                -m state --state NEW -j DNAT --to 192.168.200.250

####################SYMANTEC ENDPOINT PROTECTION PORT##################
/sbin/iptables -t nat -A PREROUTING -p tcp -m tcp  -i ens32 -d 192.168.100.87 \
                --dport 8014 -m state --state NEW -j DNAT --to 192.168.200.93:8014

####################ldap directory service for DOGTAG##################
/sbin/iptables -t nat -A PREROUTING -p tcp -m tcp  -i ens32 -d 192.168.100.87 \
                --dport 389 -m state --state NEW -j DNAT --to 192.168.200.85:389

###################Facilitates the VPN connection - VPN server 192.168.200.250
/sbin/iptables -t nat -A PREROUTING -p tcp -m tcp  -i ens32 -d 192.168.100.87 \
                --dport 8443 -m state --state NEW -j DNAT --to 192.168.200.250:443

/sbin/iptables -t nat -A PREROUTING -p tcp -m tcp  -i ens32 -d 192.168.100.87 \
                --dport 8080 -m state --state NEW -j DNAT --to 192.168.200.73:8080

/sbin/iptables -t nat -A PREROUTING -p tcp -m tcp  -i ens32 -d 192.168.100.87 \
                 --dport 53 -m state --state NEW -j DNAT --to 192.168.200.85:53

/sbin/iptables -t nat -A PREROUTING -p udp -m udp  -i ens32 -d 192.168.100.87 \
                 --dport 53 -m state --state NEW -j DNAT --to 192.168.200.85:53

/sbin/iptables -t nat -A PREROUTING -p udp -m udp  -i ens32 -d 192.168.100.87 \
                --dport 1812 -m state --state NEW -j DNAT --to 192.168.200.252:1812

/sbin/iptables -t nat -A PREROUTING -p udp -m udp  -i ens32 -d 192.168.100.87 \
                --dport 1813 -m state --state NEW -j DNAT --to 192.168.200.222:1813

## FORWARD RULES - 

iptables -A FORWARD -p tcp  -m state --state NEW -j ACCEPT
iptables -A FORWARD -p udp  -m state --state NEW -j ACCEPT
iptables -A FORWARD -p ICMP -j ACCEPT

#### CLEAN UP RULES
/sbin/iptables -A INPUT -m limit --limit 10/minute --limit-burst 3 -j LOG --log-prefix "INPUT CLEANUP RULE"
/sbin/iptables -A FORWARD -m limit --limit 10/minute --limit-burst 3 -j LOG --log-prefix "FORWARD CLEANUP RULE"
/sbin/iptables -A OUTPUT -m limit --limit 10/minute --limit-burst 3 -j LOG --log-prefix "OUTPUT CLEANUP RULE"
