#!/bin/sh
#
# Fichier de configuration du pare-feu
#
### BEGIN INIT INFO
# Provides:          firewall.sh
# Required-Start:    $syslog $network
# Required-Stop:     $syslog $network
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Start firewall daemon at boot time
# Description:       Custom Firewall script
### END INIT INFO
 
fw_start () {

  iptables -t filter -P INPUT DROP
  iptables -t filter -P FORWARD DROP
  iptables -t filter -P OUTPUT DROP
  iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
  iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
  iptables -t filter -A INPUT -i lo -j ACCEPT
  iptables -t filter -A OUTPUT -o lo -j ACCEPT
  iptables -t filter -A INPUT -p tcp --dport <port ssh> -j ACCEPT
  iptables -t filter -A OUTPUT -p tcp --dport <port ssh> -j ACCEPT
  iptables -t nat -A POSTROUTING -s 10.42.42.0/27 -j MASQUERADE
  iptables -A INPUT -p tcp --dport 500 -j ACCEPT
  iptables -A INPUT -p tcp --dport 4500 -j ACCEPT

}
 
fw_stop () {

  iptables -F
  iptables -X
  iptables -t nat -F
  iptables -t nat -X
  iptables -t mangle -F
  iptables -t mangle -X
  iptables -P INPUT ACCEPT
  iptables -P FORWARD ACCEPT
  iptables -P OUTPUT ACCEPT

}
 
fw_clear () {

  iptables -F
  iptables -t nat -F
  iptables -t mangle -F
  iptables -P INPUT ACCEPT
  iptables -P FORWARD ACCEPT
  iptables -P OUTPUT ACCEPT

}
 
case "$1" in
start|restart)
  echo -n "Démarrage du pare-feu..."
  fw_stop 
  fw_start
  echo "done."
  ;;
stop)
  echo -n "Arrêt du pare-feu..."
  fw_stop
  echo "done."
  ;;
clear)
  echo -n "RAZ des règles..."
  fw_clear
  echo "done."
  ;;
*)
  echo "Usage: $0 {start|stop|restart|clear}"
  exit 1
  ;;
esac
exit 0

service firewall start

while true; do test=""; read  -t 20 -p "OK? " test ; \ [ -z "$test" ] && /etc/init.d/firewall clear && exit ; done