CHAINS=`cat /proc/net/ip_tables_names 2>/dev/null`
 for i in $CHAINS;
 do
  $IPTABLES -t $i -F
 done
 for i in $CHAINS;
 do
  $IPTABLES -t $i -X
 done

echo "1" > /proc/sys/net/ipv4/ip_forward
#echo "1" > /proc/sys/net/ipv4/tcp_syncookies
#echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

#
# 3.2 Non-Required proc configuration
#

echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp
#echo "1" > /proc/sys/net/ipv4/ip_dynaddr

#
# 4.1.1 Set policies
#

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP

#
# 4.1.2 Create userspecified chains
#
#
# Create chain for bad tcp packets
#

$IPTABLES -N bad_tcp_packets

#
# Create separate chains for ICMP, TCP and UDP to traverse
#

$IPTABLES -N allowed
$IPTABLES -N tcp_packets
$IPTABLES -N udp_packets
$IPTABLES -N icmp_packets

#
# 4.1.3 Create content in userspecified chains
#

#
# bad_tcp_packets chain
#

$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-level DEBUG --log-prefix "IPT New Not SYN: "
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP

#
# allowed chain
#

$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP -j DROP

#
# TCP ports
#

#permit all LAN
$IPTABLES -A tcp_packets -p TCP -s $LAN_IP_RANGE -j allowed

#$IPTABLES -A tcp_packets -p TCP -s $LAN_IP_RANGE --dport 21 -j allowed
#$IPTABLES -A tcp_packets -p TCP -s $LAN_IP_RANGE --dport 20 -j allowed
#$IPTABLES -A tcp_packets -p TCP -s $LAN_IP_RANGE --dport 22 -j allowed
#$IPTABLES -A tcp_packets -p TCP -s $LAN_IP_RANGE --dport 53 -j allowed
#$IPTABLES -A tcp_packets -p TCP -s $LAN_IP_RANGE --dport 80 -j allowed
#$IPTABLES -A tcp_packets -p TCP -s $LAN_IP_RANGE --dport 113 -j allowed
#$IPTABLES -A tcp_packets -p TCP -s $LAN_IP_RANGE --dport 139 -j allowed
#$IPTABLES -A tcp_packets -p TCP -s $LAN_IP_RANGE --dport 445 -j allowed
#$IPTABLES -A tcp_packets -p TCP -s $LAN_IP_RANGE --dport 443 -j allowed

#
# UDP ports
#

$IPTABLES -A udp_packets -p UDP -s $LAN_IP_RANGE -j ACCEPT

#$IPTABLES -A udp_packets -p UDP -s $LAN_IP_RANGE --dport 53 -j ACCEPT
#$IPTABLES -A udp_packets -p UDP -s $LAN_IP_RANGE --dport 137 -j ACCEPT
#$IPTABLES -A udp_packets -p UDP -s $LAN_IP_RANGE --dport 138 -j ACCEPT
#$IPTABLES -A udp_packets -p UDP -s $LAN_IP_RANGE --dport 7550 -j DROP



#
# In Microsoft Networks you will be swamped by broadcasts. These lines
# will prevent them from showing up in the logs.
#

$IPTABLES -A udp_packets -p UDP -i $BUSP_IFACE -d $BUSP_BROADCAST --dport 135:139 -j DROP

#
# If we get DHCP requests from the Outside of our network, our logs will
# be swamped as well. This rule will block them from getting logged.
#
#$IPTABLES -A udp_packets -p UDP -i $BUSP_IFACE -d 255.255.255.255 --dport 67:68 -j DROP

#
# ICMP rules
#
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 3 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 0 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT

#
# 4.1.4 INPUT chain
#

#
# Bad TCP packets we don't want.
#

$IPTABLES -A INPUT -p tcp -j bad_tcp_packets

#
# Rules for special networks not part of the Internet
#

$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT

$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $BUSP_IP -j ACCEPT

#
# Rules for incoming packets from BUSP net.
#

$IPTABLES -A INPUT -p ALL -d $BUSP_IP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p TCP -j tcp_packets
$IPTABLES -A INPUT -p UDP -j udp_packets
$IPTABLES -A INPUT -p ICMP -j icmp_packets

#
# If you have a Microsoft Network on the outside of your firewall, you may
# also get flooded by Multicasts. We drop them so we do not get flooded by
# logs

$IPTABLES -A INPUT -i $BUSP_IFACE -d 224.0.0.0/8 -j DROP
$IPTABLES -A INPUT -i $BUSP_IFACE -d 255.255.255.255 -j DROP

#
# Log weird packets that don't match the above.
#

$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "

#
# 4.1.5 FORWARD chain
#

#
# Bad TCP packets we don't want
#

$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets

#
# Accept the packets we actually want to forward
#

#Forwarding all
$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT

# Hard forwarding to MSSQL and TECHSVR servers from LAN
$IPTABLES -A FORWARD -i $LAN_IFACE -d $MSSQL_IP -j ACCEPT
$IPTABLES -A FORWARD -i $LAN_IFACE -d $TECHSVR_IP -j ACCEPT
$IPTABLES -A FORWARD -i $LAN_IFACE -d $ADCSRV_IP -j ACCEPT

$IPTABLES -A FORWARD -i $LAN_IFACE -d 192.169.100.105 -j ACCEPT

$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT


#
# Log weird packets that don't match the above.
#
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "

#
# 4.1.6 OUTPUT chain
#

#
# Bad TCP packets we don't want.
#

$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets

#
# Special OUTPUT rules to decide which IP's to allow.
#

$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $BUSP_IP -j ACCEPT

#
# Log weird packets that don't match the above.
#

$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "

#
# 4.2.4 PREROUTING chain
#

#
# 4.2.5 POSTROUTING chain
#
#
# Enable simple IP Forwarding and Network Address Translation
#

$IPTABLES -t nat -A POSTROUTING -o $BUSP_IFACE -j SNAT --to-source $BUSP_IP

#$IPTABLES -t nat -A POSTROUTING -o $BUSP_IFACE -j MASQUERADE