#!/bin/bash echo 0 > /proc/sys/net/ipv4/ip_forward
echo "variabelen definieren..."
IPT=/sbin/iptables
wan=eth0
lan=eth1
dmz=eth2
echo "iptables flushen"
$ipt -F
$ipt -X
$ipt -t nat -F
$ipt -t nat -X
$ipt -t mangle -F
$ipt -t mangle -X
$ipt -t raw -F
$ipt -t raw -X
echo "Default policy Drop"
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP
echo "ICMP verkeer toestaan voor troubleshooting"
$IPT -A FORWARD -i $lan -o $wan -p icmp -j ACCEPT
$IPT -A FORWARD -i $lan -o $dmz -p icmp -j ACCEPT
$IPT -A FORWARD -i $wan -o $lan -p icmp -j ACCEPT
$IPT -A FORWARD -i $wan -o $dmz -p icmp -j ACCEPT
$IPT -A FORWARD -i $dmz -o $lan -p icmp -j ACCEPT
$IPT -A FORWARD -i $dmz -o $wan -p icmp -j ACCEPT
echo "ssh toestaan tussen router en lan"
$IPT -A INPUT -i $lan -p tcp --dport 22 -j ACCEPT
$IPT -A OUTPUT -o $lan -p tcp --sport 22 -j ACCEPT
echo "ssh toestaan tussen lan en dmz"
$IPT -A FORWARD -i $lan -o $dmz -p tcp --dport 22 -j ACCEPT
$IPT -A FORWARD -i $dmz -o $lan -p tcp --sport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT
echo "webverkeer toestaan tussen lan en dmz"
$IPT -A FORWARD -i $lan -o $dmz -p tcp --dport 80 -j ACCEPT
$IPT -A FORWARD -i $dmz -o $lan -p tcp --sport 80 -m state --state ESTABLISHED,RELATED -j ACCEPT
echo "webverkeer tussen wan en dmz toestaan"
$IPT -A FORWARD -i $wan -o $dmz -p tcp --dport 80 -j ACCEPT
$IPT -A FORWARD -i $dmz -o $wan -p tcp --sport 80 -m state --state ESTABLISHED,RELATED -j ACCEPT
echo "dns regels uitvoeren"
$IPT -A INPUT -i $wan -p tcp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -i $wan -p udp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -i $wan -p tcp --dport 53 -j ACCEPT
$IPT -A OUTPUT -i $wan -p udp --dport 53 -j ACCEPT
$IPT -A INPUT -i $lan -p tcp --sport 53 -j ACCEPT
$IPT -A INPUT -i $lan -p udp --sport 53 -j ACCEPT
$IPT -A OUTPUT -i $lan -p tcp --dport 53 -j ACCEPT
$IPT -A OUTPUT -i $lan -p udp --dport 53 -j ACCEPT
$IPT -A INPUT -i $dmz -p tcp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -i $dmz -p udp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -i $dmz -p tcp --dport 53 -j ACCEPT
$IPT -A OUTPUT -i $dmz -p udp --dport 53 -j ACCEPT
$IPT -A FORWARD -i $lan -o $wan -p tcp --dport 53 -j ACCEPT
$IPT -A FORWARD -i $lan -o $wan -p udp --dport 53 -j ACCEPT
$IPT -A FORWARD -i $wan -o $lan -p tcp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $wan -o $lan -p tcp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
echo "proxy http/https verkeer naar buiten"
$IPT -A OUTPUT -o $wan -p tcp --dport 80 -j ACCEPT
$IPT -A OUTPUT -o $wan -p tcp --dport 443 -j ACCEPT
$IPT -A INPUT -i $wan -p tcp --sport 80 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -i $wan -p tcp --sport 443 -m state --state ESTABLISHED,RELATED -j ACCEPT
echo "squid poort 3128 naar het lan open zetten"
$IPT -A INPUT -i $lan -p tcp --dport 3128 -j ACCEPT
$IPT -A OUTPUT -o $lan -p tcp --sport 3128 -j ACCEPT
echo "nat regels"
$IPT -A PREROUTING -t nat -i $wan -p tcp --dport 80 -j DNAT --to-destination 172.16.0.2
echo "masquerade voor al het uitgaande verkeer"
$IPT -t nat -A POSTROUTING -o $wan -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
echo "firewall actief"