# DATE: 2015-05-07
# This is the iptables. To enable it, su to root and run the script.
# This replace the current iptables. Then issue
#               /sbin/service iptables save
# to save the configuration to /etc/sysconfig/iptables.
#

hostIps="192.168.2.157/32"
hostIps="59.125.131.3/32"
mtIps="59.125.131.1/32 59.125.131.2/32 59.125.131.3/32 59.125.131.151/32 59.125.131.152/32 59.125.131.153/32 60.249.151.181/32 60.249.151.182/32 60.249.151.183/32 60.249.151.184/32 60.249.151.185/32 60.249.151.186/32"
localhostIps="127.0.0.0/8"
privateIps="10.0.0.0/8 172.16.0.0/12 192.168.0.0/16"



defaultAcceptedIps="${localhostIps} ${hostIps}"
sshAcceptedIps="${privateIps} ${mtIps}"
tomcatRedirectedIps="${localhostIps} ${hostIps}"
pgAcceptedIps="${localhostIps}"
pingAcceptedIps="${privateIps} ${mtIps}"


#
#
# First we flush out the current INPUT chain and  PREROUTING
/sbin/iptables -F INPUT
/sbin/iptables -t nat -F PREROUTING
/sbin/iptables -t nat -F OUTPUT
/sbin/iptables -t mangle -F PREROUTING


#
# default accepting
#
/sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i lo -j ACCEPT
for ip in $defaultAcceptedIps
do
        /sbin/iptables -A INPUT -s "${ip}" -j ACCEPT
done


#
# additional rules before default 
#


#
# SSH: ok from private and MT
#
for ip in $sshAcceptedIps
do
        /sbin/iptables -A INPUT -s "${ip}" -d 0/0 -p tcp --dport ssh -j ACCEPT
done


#FTP: file upload via ftp for ez teamwork
/sbin/iptables -A INPUT -s 0/0 -d 0/0 -p tcp --dport ftp -j ACCEPT


#
# tomcat  (HTTP, HTTPS): map port 80 to 8080
#       No outsider can access the admin port, use ssh tunnel instead.
#
for ip in $tomcatRedirectedIps
do
        /sbin/iptables -t nat -A PREROUTING -d "${ip}" -p tcp --dport 80 -j REDIRECT --to-port 8080
        /sbin/iptables -t nat -A PREROUTING -d "${ip}" -p tcp --dport 443 -j REDIRECT --to-port 8443
#        /sbin/iptables -t nat -A PREROUTING -d "${ip}" -p tcp --dport 8080 -j DROP
#        /sbin/iptables -t nat -A PREROUTING -d "${ip}" -p tcp --dport 8443 -j DROP
#        /sbin/iptables -t mangle -A PREROUTING -d "${ip}" -p tcp --dport 8080 -j DROP
#        /sbin/iptables -t mangle -A PREROUTING -d "${ip}" -p tcp --dport 8443 -j DROP
        /sbin/iptables -t nat -A OUTPUT -d "${ip}" -p tcp --dport 80 -j REDIRECT --to-ports 8080
        /sbin/iptables -t nat -A OUTPUT -d "${ip}" -p tcp --dport 443 -j REDIRECT --to-ports 8443

done
/sbin/iptables -A INPUT -s 0/0 -d 0/0 -p tcp --dport 8080 -j ACCEPT
/sbin/iptables -A INPUT -s 0/0 -d 0/0 -p tcp --dport 8443 -j ACCEPT


#
# Postgresql (5432): accept only localhost, no external access
#
for ip in $pgAcceptedIps
do
	/sbin/iptables -A INPUT -s "${ip}" -d 0/0 -p tcp --dport 5432 -j ACCEPT
done



#
# SMTP: no smtp fom outside the private network.  In production, we should
#       accept from localhost only.
#
/sbin/iptables -A INPUT -i lo -s 0/0 -d 0/0 -p tcp --dport smtp -j ACCEPT


#
# ICMP: drop echo-request only
#
for ip in $pingAcceptedIps
do
        /sbin/iptables -A INPUT -s "${ip}" -p icmp --icmp-type echo-request -j ACCEPT
done
/sbin/iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
/sbin/iptables -A INPUT -p icmp -j ACCEPT


#
# additional rules after default 
#


#
# drop everthing we don't know
#
/sbin/iptables -A INPUT -j DROP


#
# show the currnet rules
#
/sbin/iptables -v -L INPUT
/sbin/iptables -v -t nat -L PREROUTING
/sbin/iptables -v -t nat -L OUTPUT
/sbin/iptables -v -t mangle -L PREROUTING
