#!/bin/sh
# fBuilder firewall script
# Script created Wed Apr  5 08:50:26 2000

# Set up /proc for masq...
echo 1 > /proc/sys/net/ipv4/ip_forward

# Set up variables
INTERNALIP="xxx.xxx.xxx.xxx"
EXTERNALIP="xxx.xxx.xxx.xxx"
LOOPBACK="127.0.0.1"
INETWORKIP="xxx.xxx.xxx.0"
ENETWORKIP="xxx.xxx.xxx.0"
ANYWHERE="0.0.0.0/0"
PORTS="1024:65535"

# Flush chains
./fBuilder_chains -F

TCP_ALLOWIN="ftp-data ftp ssh telnet smtp nameserver whois domain www pop-3 auth https x"
TCP_ALLOWOUT="ftp-data ftp ssh telnet smtp time nameserver whois domain finger www pop-3 auth x"
MASQ_ALLOWIN=""

#  =====================================
#  ========== Incoming Rules ===========
#  =====================================

# Set default policy to deny
./fBuilder_chains -P input DENY

# Unlimited traffic within the local networks
./fBuilder_chains -A input -j ACCEPT -s "$INETWORKIP" -d "$ANYWHERE"

./fBuilder_chains -A input -j ACCEPT -s "$ENETWORKIP" -d "$ANYWHERE"

./fBuilder_chains -A input -j ACCEPT -s "$ANYWHERE" -i lo

# Allow fBuilder traffic...
./fBuilder_chains -A input -j ACCEPT -p tcp -s "$ANYWHERE" "$PORTS" -d "$EXTERNALIP" 8000

# Target
for SERVICES in `echo $TCP_ALLOWIN` ; do
      ./fBuilder_chains -A input -j ACCEPT -p tcp -s "$ANYWHERE" \
        "$PORTS" -d "$EXTERNALIP" "$SERVICES" 
done

# Return
for SERVICES in `echo $TCP_ALLOWOUT` ; do
	./fBuilder_chains -A input -j ACCEPT -p tcp -s "$ANYWHERE" "$SERVICES" \
	-d "$EXTERNALIP" "$PORTS" 
done

# Allow packets to $PORTS only if connection
# originated from our network (only if ack bit is set)
./fBuilder_chains -A input -j ACCEPT -p tcp ! -y -s "$ANYWHERE" "$PORTS" \
        -d "$EXTERNALIP" "$PORTS" 

# Allow ping requests
./fBuilder_chains -A input -j ACCEPT -p icmp

# DNS and routing
./fBuilder_chains -A input -j ACCEPT -p udp -s "$ANYWHERE" \
	domain
./fBuilder_chains -A input -j ACCEPT -p udp -s "$ANYWHERE" \
	route
# Log the rest
./fBuilder_chains -A input -j DENY -s "$ANYWHERE" -d "$ANYWHERE" -l

#  =====================================
#  ========== Outgoing Rules ===========
#  =====================================

# Set default policy to deny
./fBuilder_chains -P output DENY

# Unlimited traffic within the local network
./fBuilder_chains -A output -j ACCEPT -s "$ANYWHERE" -d "$INETWORKIP" 

# Target
for SERVICES in `echo $TCP_ALLOWOUT`; do
	./fBuilder_chains -A output -j ACCEPT -p tcp -s "$EXTERNALIP" "$PORTS" \
	-d "$ANYWHERE" "$SERVICES" 

done

# Return
for SERVICES in `echo $TCP_ALLOWIN`; do
	./fBuilder_chains -A output -j ACCEPT -p tcp -s "$EXTERNALIP" "$SERVICES" \
	-d "$ANYWHERE" "$PORTS"
done

# DNS
./fBuilder_chains -A output -j ACCEPT -p udp -s "$EXTERNALIP" \
    -d "$ANYWHERE" 
./fBuilder_chains -A output -j ACCEPT -s "$ANYWHERE" -d "$ANYWHERE" 

# Allow ping requests
./fBuilder_chains -A output -j ACCEPT -p icmp

# Log the rest
./fBuilder_chains -A output -j DENY -s "$ANYWHERE" -d "$ANYWHERE" -l

#  ======================================
#  ========== Forwarded Rules ===========
#  ======================================

# Set default policy to deny
./fBuilder_chains -P forward DENY

