#!/bin/sh

#
# Sep 2014 - initial version.
# Nov 2014 - strange: NAT worked without nat rule.
# Nov 2014 - removes reass and allow-established (broken NAT).
# Dec 2014 - enabled BADNETS table
#

echo	"`date +\"%Y-%m(%b)-%d(%a), %Hh:%Mm:%Ss\"`-$0" >> /opt/var/log/debuglog

. /opt/etc/globals

# Private and link-local IP addresses
RFC1918_TID=1
RFC1918_DATA="10.0.0.0/8 127.0.0.0/8 172.16.0.0/12 192.168.0.0/16 \
	169.254.0.0/16"

# Trusted network. FIXME: not used
TRUSTED_TID=2
TRUSTED_DATA="10.1.5.0/24 10.5.5.0/24 10.1.7.0/24"

$fw flush
$fw nat flush
$fw table all flush
$fw pipe flush
$fw queue flush

# Update extra tables
if [ -x $UPDATE_TABLES ]; then
	$UPDATE_TABLES
fi

for NET in $RFC1918_DATA; do
	$fw table $RFC1918_TID add $NET
done

$fw nat 1 config if $WAN_D_IF same_ports reset

RULENO_WAN_B_TRAFFIC=6000
RULENO_WAN_S_TRAFFIC=6500
RULENO_WAN_D_IN_TRAFFIC=10000
RULENO_LAST=60000

$fw add check-state

# These two rules break NAT. Why?
# $fw add reass all from any to any in
# $fw add allow all from any to any established

$fw add allow all from any to any via lo0

$fw add // Filter outbound traffic via PPPoE \(IP: $WAN_D_GATEWAY_IP\)
$fw add allow all from any to $WAN_D_GATEWAY_IP out xmit $WAN_D_IF
$fw add unreach net-unknown all from any to table\($RFC1918_TID\) out xmit $WAN_D_IF

CLOSEPORTS="22,23,25,53,111,123,137-139,445,2049,3389,4899,5900-6000,9091"
# CLOSEPORTS="22,23,25,111,123,137-139,445,2049,3389,4899,5900-6000,9091"

# Inclusion of 123 in $CLOSEPORTS breaks NTP even if only recv packets are denied.
$fw add allow udp from any to me 123 in
$fw add deny all from any to any $CLOSEPORTS in recv $WAN_D_IF
$fw add deny all from table\($BADNETS_TID\) to any
$fw add deny all from any to table\($BADNETS_TID\)

$fw add count all from 93.94.152.163 to table\($RFC1918_TID\) via tun10

$fw add // Filter inbound traffic via PPPoE \(goto: $RULENO_WAN_D_IN_TRAFFIC\)

$fw add skipto	$RULENO_WAN_D_IN_TRAFFIC all from any to any via $WAN_D_IF

$fw add // Multihomed server magic is here
$fw add skipto	$RULENO_WAN_S_TRAFFIC tag 11 all from 10.0.0.0/16 to me in recv $LAN_IF keep-state
$fw add skipto	$RULENO_WAN_B_TRAFFIC tag 10 all from not $LAN to me in recv $LAN_IF keep-state
$fw add skipto	$RULENO_LAST all from any to any
$fw add deny	all from any to any

$fw add $RULENO_WAN_B_TRAFFIC allow recv $LAN_IF
$fw add fwd 10.1.5.254 ip from any to any tagged 10
$fw add	deny all from any to any

$fw add $RULENO_WAN_S_TRAFFIC allow recv $LAN_IF
$fw add fwd 10.1.5.2 ip from any to any tagged 11
$fw add	deny all from any to any

$fw add $RULENO_WAN_D_IN_TRAFFIC deny all from table\($RFC1918_TID\) to any in recv $WAN_D_IF
$fw add nat 1	all from any to any via $WAN_D_IF


$fw add allow all from any to any out
$fw add allow all from any to any in

$fw add deny all from any to any in via $WAN_D_IF

$fw add $RULENO_LAST allow all from any to any

# FTP passthough
# $fw add allow tcp from me to any 20,21 via $WAN_D_IF setup
# $fw add allow tcp from me to any 1024-65535 via $WAN_D_IF setup
# $fw add allow tcp from any to any established

