#!/bin/sh

INTERFACE=eth0

iptables-restore <<-EOF;
	*filter
	:INPUT DROP [0:0]
	:FORWARD DROP [0:0]
	:OUTPUT ACCEPT [0:0]
	:${INTERFACE} - [0:0]
	:blacklist - [0:0]
	:whitelist - [0:0]

	# Drop invalid packets
	-A INPUT -m state --state INVALID -j DROP
	# Drop private subnets
	-A INPUT -s 10.0.0.0/8 -j DROP
	-A INPUT -s 172.16.0.0/12 -j DROP
	-A INPUT -s 192.168.0.0/16 -j DROP
	# Drop blackholed IP's
	-A INPUT -j blacklist

	# Allow ICMP traffic
	-A INPUT -p icmp -j ACCEPT
	# Allow loopback traffic
	-A INPUT -i lo -j ACCEPT
	-A OUTPUT -o lo -j ACCEPT
	# Process whitelist
	-A INPUT -j whitelist
	# Redirect external interface to seperate chain
	-A INPUT -i ${INTERFACE} -j ${INTERFACE}
	# Allow already established traffic to go through
	-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
	# Block all other new connections not made by glorious root
	-A OUTPUT -o ${INTERFACE} -m state --state NEW -m owner ! --uid-owner 0 -j DROP

	# Allow and throttle HTTP traffic
        -A ${INTERFACE} -p tcp --dport 80 -m state --state ESTABLISHED -j ACCEPT
        -A ${INTERFACE} -p tcp --dport 80 -m state --state NEW -m recent --set
        -A ${INTERFACE} -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 1 --hitcount 10 -j DROP
        -A ${INTERFACE} -p tcp --dport 80 -m state --state NEW -j ACCEPT

	# Blacklist port 22 traffic
	-A ${INTERFACE} -p tcp --dport 22 -j LOG --log-level debug --log-prefix "IPTABLES-ACCESS-PORT22: "

	# Allow and throttle SSH traffic
        -A ${INTERFACE} -p tcp --dport 3639 -m state --state ESTABLISHED -j ACCEPT
        -A ${INTERFACE} -p tcp --dport 3639 -m state --state NEW -m recent --set
        -A ${INTERFACE} -p tcp --dport 3639 -m state --state NEW -m recent --update --seconds 3600 --hitcount 3 -j DROP
        -A ${INTERFACE} -p tcp --dport 3639 -m state --state NEW -j ACCEPT

	# Allow IRCd traffic
	-A ${INTERFACE} -p tcp -m tcp --dport 6667 -j ACCEPT
	-A ${INTERFACE} -p tcp -m tcp --dport 6697 -j ACCEPT
	-A ${INTERFACE} -p tcp -m tcp --dport 7003 -j ACCEPT
	-A ${INTERFACE} -p tcp -m tcp --dport 7005 -j ACCEPT

	COMMIT
EOF

ip6tables-restore <<-EOF;
	*filter
	:INPUT DROP [0:0]
	:FORWARD DROP [0:0]
	:OUTPUT ACCEPT [0:0]
	:${INTERFACE} - [0:0]
	:blacklist - [0:0]
	:whitelist - [0:0]

	# Drop invalid packets
	-A INPUT -m state --state INVALID -j DROP
	# Drop blackholed IPs
	-A INPUT -j blacklist

	# Allow ICMP traffic
	-A INPUT -p icmpv6 -j ACCEPT
	# Allow loopback traffic
	-A INPUT -i lo -j ACCEPT
	-A OUTPUT -o lo -j ACCEPT
	# Process whitelist
	-A INPUT -j whitelist
	# Redirect external interface to seperate chain
	-A INPUT -i ${INTERFACE} -j ${INTERFACE}
	# Allow already established traffic to go through
	-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
	# Block all other new connections not made by glorious root
	-A OUTPUT -o ${INTERFACE} -m state --state NEW -m owner ! --uid-owner 0 -j DROP

	# Allow and throttle HTTP traffic
	-A ${INTERFACE} -p tcp --dport 80 -m state --state ESTABLISHED -j ACCEPT
	-A ${INTERFACE} -p tcp --dport 80 -m state --state NEW -m recent --set
	-A ${INTERFACE} -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 1 --hitcount 10 -j DROP
	-A ${INTERFACE} -p tcp --dport 80 -m state --state NEW -j ACCEPT

	# Blacklist port 22 traffic
	-A ${INTERFACE} -p tcp --dport 22 -j LOG --log-level debug --log-prefix "IPTABLES-ACCESS-PORT22: "

	# Allow and throttle SSH traffic
	-A ${INTERFACE} -p tcp --dport 3639 -m state --state ESTABLISHED -j ACCEPT
	-A ${INTERFACE} -p tcp --dport 3639 -m state --state NEW -m recent --set
	-A ${INTERFACE} -p tcp --dport 3639 -m state --state NEW -m recent --update --seconds 3600 --hitcount 3 -j DROP
	-A ${INTERFACE} -p tcp --dport 3639 -m state --state NEW -j ACCEPT

	# Allow IRCd traffic
	-A ${INTERFACE} -p tcp -m tcp --dport 6667 -j ACCEPT
	-A ${INTERFACE} -p tcp -m tcp --dport 6697 -j ACCEPT
	-A ${INTERFACE} -p tcp -m tcp --dport 7003 -j ACCEPT
	-A ${INTERFACE} -p tcp -m tcp --dport 7005 -j ACCEPT

	COMMIT
EOF

# Populate blacklist
. /etc/fw/blacklist.sh
# Populate whitelist
. /etc/fw/whitelist.sh

# Start the log inspector
/etc/fw/inspect
