#!/bin/sh
### BEGIN INIT INFO
# Provides: custom firewall
# Required-Start: $remote_fs $syslog $network
# Required-Stop: $remote_fs $syslog $network
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: firewall initscript
# Description: Custom Firewall
### END INIT INFO
IPT=/sbin/iptables
case "$1" in
start)
# bestehende Verbindungen
$IPT -A INPUT -i venet0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Ãœber Loopback alles erlauben
$IPT -I INPUT -i lo -j ACCEPT
$IPT -I OUTPUT -o lo -j ACCEPT
# SSH
$IPT -A INPUT -i venet0 -p tcp --dport 22222 -j ACCEPT
# APACHE2/CACTI
#$IPT -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
# APACHE2/MONITORIX
#$IPT -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT
# OSCAM WEB1
$IPT -A INPUT -i venet0 -p tcp --dport 8888 -j ACCEPT
# OSCAM WEB2
#$IPT -A INPUT -i eth0 -p tcp --dport 17002 -j ACCEPT
# OSCAM WEB3
#$IPT -A INPUT -i eth0 -p tcp --dport 17003 -j ACCEPT
# CCCAM1
$IPT -A INPUT -i venet0 -p tcp --dport 4835 -j ACCEPT
# CCCAM2
#$IPT -A INPUT -i eth0 -p tcp --dport 55445 -j ACCEPT
# CCCAM3
#$IPT -A INPUT -i eth0 -p tcp --dport 55446 -j ACCEPT
# CS378x
#$IPT -A INPUT -i eth0 -p tcp --dport 50000 -j ACCEPT
#$IPT -A INPUT -i eth0 -p tcp --dport 50001 -j ACCEPT
#FTP-Server
#$IPT -A INPUT -i eth0 -p tcp --dport 21 -j ACCEPT
#$IPT -A INPUT -i eth0 -p tcp --dport 49152 -j ACCEPT
#$IPT -A INPUT -i eth0 -p tcp --dport 65534 -j ACCEPT
# CCCAM WEB
#$IPT -A INPUT -i venet0 -p tcp --dport 16001 -j ACCEPT
# CS378X
#$IPT -A INPUT -i venet0 -p tcp --dport 12345 -j ACCEPT
# CAMD35
#$IPT -A INPUT -i venet0 -p udp --dport 12345 -j ACCEPT
# PING SPERRE
#### VPN
#iptables -A INPUT -i eth0 -m state --state NEW -p udp --dport 47126 -j ACCEPT
#iptables -A INPUT -i tun+ -j ACCEPT
#iptables -A FORWARD -i tun+ -j ACCEPT
#iptables -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
#iptables -A OUTPUT -o tun+ -j ACCEPT
####
$IPT -A INPUT -i venet0 -j REJECT
#Asis
#iptables -I INPUT -s 83.246.103.36 -j DROP
#####
# SICHERHEIT
$IPT -A INPUT -p icmp -m icmp --icmp-type 8 -j DROP
$IPT -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
$IPT -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
$IPT -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s
echo "Firewall wurde aktiviert, der Server ist geschützt"
exit 0
;;
stop)
$IPT -F INPUT
echo "Achtung, Firewall wurde gestoppt, der Server ist ungeschützt"
exit 0
;;
restart|reload|force-reload)
$0 stop
sleep 1
$0 start
exit 0
;;
*)
echo "Usage: $0 {start|stop|restart|reload|force-reload}"
exit 1
;;
esac