S05syslog
S06masq
S10network
S15nut
S20random
S25keytable
S35bootstrap-console
S35oidentd
S36masq
S37network
S40crond
S40hdparm
S50dhcpcd
S50xinetd
S55dnscache
S55imap
S55ippp
S55ntpd
S55popd
S55tinydns
S57diald
S57pppoe
S60lpd
S65dhcpd
S80ldap
S80ntpd
S80qmail
S85httpd-e-smith
S85smtpfront-qmail
S85sshd
S86httpd-admin
S90mysqld
S90squid
S91atalk
S91smb
S99local
S99mysql.init

#!/bin/sh
#------------------------------------------------------------
# DO NOT MODIFY THIS FILE! It is updated automatically by the
# SME Server software. Instead, modify the source template in
# an /etc/e-smith/templates-custom directory. For more
# information, see http://www.e-smith.org/custom/
#
# copyright (C) 1999-2003 Mitel Networks Corporation
#------------------------------------------------------------
 
 
 
    INTERNALIF=eth0
    OUTERIF=eth1
    OUTERNET=$(/sbin/e-smith/db configuration get ExternalIP)
    if [ -z "$OUTERNET" ]
    then
 # Make sure that OUTERNET value is set to syntactly valid value
 # to ensure that iptables syntax is at least correct
 OUTERNET=1.2.3.4
    fi
 
adjust_tcp_in() {
    local dport=$1
    local target=$2
    local chain=$3
    local dnet=$4
    # Add the rule requested.
    rule="/sbin/iptables --append $chain --protocol tcp --dport $dport"
    if [ -n "$dnet" ]; then
        rule="$rule --destination $dnet"
    fi
    rule="$rule --in-interface $OUTERIF --jump $target"
    $rule
    }
 
adjust_udp_in() {
    local dport=$1
    local target=$2
    local chain=$3
    local dnet=$4
    # Add the rule requested.
    rule="/sbin/iptables --append $chain --protocol udp --dport $dport"
    if [ -n "$dnet" ]; then
        rule="$rule --destination $dnet"
    fi
    rule="$rule --in-interface $OUTERIF --jump $target"
    $rule
    }
 
get_safe_id() {
    # Expect arguments of, chain_name, table, mode, where mode can be either
    # find or new
    local chain_name=$1
    local table=$2
    local mode=$3
 
    # Find the existing numbered chain.
    current=$(/sbin/iptables --table $table --list $chain_name --numeric |\
        sed -n '3s/ .*//p')
    if [ "x$current" = "x" ]; then
        # We didn't find it.
        echo "ERROR: Cannot find chain $chain_name in table $table" 1>&2
        exit 1
    fi
 
    # If we're in find mode, return this chain.
    case "$mode" in
    find)  
        echo $current ;;
 
    new)
        # Make sure the number on this chain doesn't conflict with our
        # process ID.
        current_id=$(echo $current |\
        sed -n -e "s/^$chain_name//" -e "s/^_//p" )
        if [ "x$current_id" = "x" ]
        then
        echo "ERROR: Cannot find process ID on chain name" 1>&2
        exit 1
        fi
        # If it conflicts with our process ID, add one to ours.
        if [ $current_id -eq $$ ]
        then
        echo ${chain_name}_$(expr $$ + 1)
        else
        echo ${chain_name}_$$
        fi
    ;;
    esac
}
 
case "$1" in
 
 start)
    echo -n "Enabling IP masquerading: "
 
    /sbin/iptables -F -t filter
    /sbin/iptables -F -t nat
    /sbin/iptables -F -t mangle
    /sbin/iptables -X -t filter
    /sbin/iptables -X -t nat
    /sbin/iptables -X -t mangle
    /sbin/iptables --flush  FORWARD
    /sbin/iptables --flush  INPUT
    /sbin/iptables --flush  OUTPUT
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_conntrack_ftp
 
    /sbin/iptables --new-chain denylog
    /sbin/iptables --append denylog --jump DROP
    /sbin/iptables --append denylog --jump DROP
    /sbin/iptables --append denylog --jump DROP
    /sbin/iptables --append denylog --jump DROP
    /sbin/iptables --append denylog --jump DROP
    # Set telnet, www, smtp, pop3 and FTP for minimum delay  
    for port in 21 22 23 25 80 110
    do
        /sbin/iptables --table mangle --append OUTPUT \
     --protocol tcp --dport $port \
     -j TOS --set-tos Minimize-Delay
    done
 
    # Set ftp-data for maximum throughput
    /sbin/iptables --table mangle --append OUTPUT \
     --protocol tcp --dport 20 \
     -j TOS --set-tos Maximize-Throughput
    # TODO - this hasn't yet been converted for iptables - does it
    # need to be?
 
    # set timeouts for tcp tcpfin udp
    #/sbin/iptables --masquerading --set 14400 60 600
 
    /sbin/iptables --table nat --new-chain SMTPProxy
    /sbin/iptables --table nat --append PREROUTING\
 -p tcp --dport 25 -j SMTPProxy
    /sbin/iptables --table nat --append SMTPProxy \
 --destination 127.0.0.1 --jump ACCEPT
    /sbin/iptables --table nat --append SMTPProxy \
 --destination 192.168.1.1 --jump ACCEPT
    /sbin/iptables --table nat --append SMTPProxy \
 --destination $OUTERNET --jump ACCEPT
    /sbin/iptables --table nat --append SMTPProxy\
 -p TCP -j DNAT --to 192.168.1.1:25
 
    /sbin/iptables --table nat --new-chain TransProxy
    /sbin/iptables --table nat --append PREROUTING\
 -p tcp --dport 80 -j TransProxy
    /sbin/iptables --table nat --append TransProxy \
 --destination 127.0.0.1 --jump ACCEPT
    /sbin/iptables --table nat --append TransProxy \
 --destination 192.168.1.1 --jump ACCEPT
    /sbin/iptables --table nat --append TransProxy \
 --destination $OUTERNET --jump ACCEPT
    /sbin/iptables --table nat --append TransProxy\
 -p TCP -j DNAT --to 192.168.1.1:3128
 
 
    /sbin/iptables --new-chain state_chk
    # Allow any already established or related connection
    /sbin/iptables --append state_chk -m state --state ESTABLISHED,RELATED -j ACCEPT
 
    # We filter all input and forwarded traffic this way
    /sbin/iptables --append INPUT -j state_chk
    /sbin/iptables --append FORWARD -j state_chk
 
    # Create a new chain to handle local traffic
    /sbin/iptables --new-chain local_chk
    /sbin/iptables --new-chain local_chk_1
 
    # Accept any traffic initiated on "local" interfaces
    /sbin/iptables --append local_chk_1 \
 --in-interface ! $OUTERIF -j ACCEPT
    /sbin/iptables --append local_chk -j local_chk_1
 
    # We filter all input and forwarded traffic this way
    /sbin/iptables --append INPUT -j local_chk
    /sbin/iptables --append FORWARD -j local_chk
 
 
    # Create new chain to handle PPP interfaces from PPTP connections.
    # Note: We cannot simply permit ppp+, as that would put a huge hole in the
    # firewall for PPPoE users.
    /sbin/iptables --new-chain PPPconn
    /sbin/iptables --new-chain PPPconn_1
    /sbin/iptables --append INPUT -j PPPconn
    /sbin/iptables --append OUTPUT -j PPPconn
    /sbin/iptables --append PPPconn -j PPPconn_1
    # Drop all multicast traffic. Note that anything on from a local network
    # will have already been accepted via the local_chk chain.
    /sbin/iptables --append INPUT -s 224.0.0.0/4    -j DROP
    /sbin/iptables --append INPUT -d 224.0.0.0/4    -j DROP
     
    /sbin/iptables --append OUTPUT -s 224.0.0.0/4   -j DROP
    /sbin/iptables --append OUTPUT -d 224.0.0.0/4   -j DROP
    /sbin/iptables --table nat --new-chain PostroutingOutbound
    /sbin/iptables --table nat --append PostroutingOutbound \
 --source $OUTERNET -j ACCEPT
    /sbin/iptables --append PostroutingOutbound -t nat -j MASQUERADE
    /sbin/iptables --append POSTROUTING -t nat \
 --out-interface $OUTERIF -j PostroutingOutbound
    /sbin/iptables --append INPUT -p udp --dport 67:68 -i $OUTERIF -j ACCEPT
 
    /sbin/iptables --new-chain InboundICMP
    /sbin/iptables --new-chain InboundICMP_1
    /sbin/iptables --append INPUT --protocol icmp --jump InboundICMP
    /sbin/iptables --append InboundICMP --protocol icmp --jump InboundICMP_1
    # Catch any returns, just in case
    /sbin/iptables --append INPUT --protocol icmp --jump denylog
    /sbin/iptables --append InboundICMP --protocol icmp --jump denylog
    /sbin/iptables --new-chain OutboundICMP
    /sbin/iptables --new-chain OutboundICMP_1
    /sbin/iptables --append OUTPUT --protocol icmp --jump OutboundICMP
    /sbin/iptables --append OutboundICMP --protocol icmp --jump OutboundICMP_1
    # Catch any returns, just in case
    /sbin/iptables --append OUTPUT --protocol icmp --jump denylog
    /sbin/iptables --append OutboundICMP --protocol icmp --jump denylog
    /sbin/iptables --new-chain ForwardedTCP
    /sbin/iptables --new-chain ForwardedTCP_1
    /sbin/iptables --append FORWARD --protocol tcp --syn --jump ForwardedTCP
    /sbin/iptables --append ForwardedTCP --protocol tcp --syn --jump ForwardedTCP_1
    # Catch any returns.
    /sbin/iptables --append ForwardedTCP --protocol tcp --syn --jump denylog
    /sbin/iptables --new-chain InboundTCP
    /sbin/iptables --new-chain InboundTCP_1
    /sbin/iptables --append INPUT --protocol tcp --syn --jump InboundTCP
    /sbin/iptables --append InboundTCP --protocol tcp --syn --jump InboundTCP_1
    # Catch any returns, just in case
    /sbin/iptables --append INPUT --protocol tcp --syn --jump denylog
    /sbin/iptables --append InboundTCP --protocol tcp --syn --jump denylog
    /sbin/iptables --new-chain ForwardedUDP
    /sbin/iptables --new-chain ForwardedUDP_1
    /sbin/iptables --append FORWARD --protocol udp --jump ForwardedUDP
    /sbin/iptables --append ForwardedUDP --protocol udp --jump ForwardedUDP_1
    # Catch any returns.
    /sbin/iptables --append ForwardedUDP --protocol udp --jump denylog
    /sbin/iptables --new-chain InboundUDP
    /sbin/iptables --new-chain InboundUDP_1
    /sbin/iptables --append INPUT --protocol udp --in-interface $OUTERIF \
       --jump InboundUDP
    /sbin/iptables --append InboundUDP --protocol udp --jump InboundUDP_1
    # Catch any returns, just in case
    /sbin/iptables --append INPUT --protocol udp --in-interface $OUTERIF \
       --jump denylog
    /sbin/iptables --append InboundUDP --protocol udp --jump denylog
    /sbin/iptables -t nat --new-chain PortForwarding
    /sbin/iptables -t nat --new-chain PortForwarding_1
    /sbin/iptables -t nat --insert PREROUTING --jump PortForwarding
    /sbin/iptables -t nat --append PortForwarding --destination $OUTERNET \
                    --jump PortForwarding_1
 
    /sbin/iptables --append INPUT -p udp --sport 67:68 -i $INTERNALIF -j ACCEPT
 
# Allow IMAPS on port 993
/sbin/ipchains --append input -p tcp -s 0/0 -d $OUTERNET 993 -j ACCEPT
/sbin/ipchains --append output ! -y -p tcp -d 0/0 -s $OUTERNET 993 -j ACCEPT
 
# Allow POP3S on port 995
/sbin/ipchains --append input -p tcp -s 0/0 -d $OUTERNET 995 -j ACCEPT
/sbin/ipchains --append output ! -y -p tcp -d 0/0 -s $OUTERNET 995 -j ACCEPT
 
# Allow SMTPS on port 465
/sbin/ipchains --append input -p tcp -s 0/0 -d $OUTERNET 465 -j ACCEPT
/sbin/ipchains --append output ! -y -p tcp -d 0/0 -s $OUTERNET 465 -j ACCEPT
 
    /sbin/iptables --new-chain gre-in
    /sbin/iptables --append INPUT -p 47 -j gre-in
    /sbin/iptables --append INPUT -p 47 -j denylog
    /sbin/iptables --append gre-in -d \! $OUTERNET -j denylog
    /sbin/iptables --append gre-in -j denylog
     
    /sbin/iptables --policy FORWARD DROP
    /sbin/iptables --append FORWARD --jump denylog
     
    /sbin/iptables --policy INPUT DROP
    /sbin/iptables --append INPUT --jump denylog
     
    /sbin/iptables --policy OUTPUT ACCEPT
    /sbin/iptables --append OUTPUT --jump ACCEPT
    $0 adjust
    echo "done"
    ;;
 
 
adjust)
    OLD_ForwardedTCP=$(get_safe_id ForwardedTCP filter find)
    NEW_ForwardedTCP=$(get_safe_id ForwardedTCP filter new)
    /sbin/iptables --new-chain $NEW_ForwardedTCP
 
 
    /sbin/iptables --replace ForwardedTCP 1 \
        --jump $NEW_ForwardedTCP
    /sbin/iptables --flush $OLD_ForwardedTCP
    /sbin/iptables --delete-chain $OLD_ForwardedTCP
 
    OLD_ForwardedUDP=$(get_safe_id ForwardedUDP filter find)
    NEW_ForwardedUDP=$(get_safe_id ForwardedUDP filter new)
    /sbin/iptables --new-chain $NEW_ForwardedUDP
 
 
    /sbin/iptables --replace ForwardedUDP 1 \
        --jump $NEW_ForwardedUDP
    /sbin/iptables --flush $OLD_ForwardedUDP
    /sbin/iptables --delete-chain $OLD_ForwardedUDP
 
    OLD_InboundTCP=$(get_safe_id InboundTCP filter find)
    NEW_InboundTCP=$(get_safe_id InboundTCP filter new)
    /sbin/iptables --new-chain $NEW_InboundTCP
    /sbin/iptables --append $NEW_InboundTCP \! --destination $OUTERNET --jump denylog
 
    adjust_tcp_in 113 ACCEPT $NEW_InboundTCP
    adjust_tcp_in 21 ACCEPT $NEW_InboundTCP
    adjust_tcp_in 80 ACCEPT $NEW_InboundTCP
    adjust_tcp_in 443 ACCEPT $NEW_InboundTCP
    adjust_tcp_in 143 ACCEPT $NEW_InboundTCP
    adjust_tcp_in 389 denylog $NEW_InboundTCP
    adjust_tcp_in 110 ACCEPT $NEW_InboundTCP
    adjust_tcp_in 1723 denylog $NEW_InboundTCP
    adjust_tcp_in 25 denylog $NEW_InboundTCP
    adjust_tcp_in 22 ACCEPT $NEW_InboundTCP
    adjust_tcp_in 23 denylog $NEW_InboundTCP
 
    /sbin/iptables --replace InboundTCP 1 \
     --jump $NEW_InboundTCP
    /sbin/iptables --flush $OLD_InboundTCP
    /sbin/iptables --delete-chain $OLD_InboundTCP
 
    OLD_InboundUDP=$(get_safe_id InboundUDP filter find)
    NEW_InboundUDP=$(get_safe_id InboundUDP filter new)
    /sbin/iptables --new-chain $NEW_InboundUDP
    /sbin/iptables --append $NEW_InboundUDP \! --destination $OUTERNET --jump denylog
 
 
    /sbin/iptables --replace InboundUDP 1 \
     --jump $NEW_InboundUDP
    /sbin/iptables --flush $OLD_InboundUDP
    /sbin/iptables --delete-chain $OLD_InboundUDP
 
 
 
 
 /sbin/iptables --replace denylog 1 --jump DROP
    /sbin/iptables --replace gre-in 1 -d \! $OUTERNET -j denylog
    /sbin/iptables --replace gre-in 2 -j denylog
    # Find the current InboundICMP_$$ chain, and create a new one.
    IBI=$(get_safe_id InboundICMP filter find)
    new=$(get_safe_id InboundICMP filter new)
    /sbin/iptables --new-chain $new
    /sbin/iptables --append $new --proto icmp \
 --icmp-type echo-request --jump ACCEPT
    /sbin/iptables --append $new --proto icmp \
 --icmp-type echo-reply --jump ACCEPT
    /sbin/iptables --append $new --proto icmp \
 --icmp-type destination-unreachable --jump ACCEPT
    /sbin/iptables --append $new --proto icmp \
 --icmp-type source-quench --jump ACCEPT
    /sbin/iptables --append $new --proto icmp \
 --icmp-type time-exceeded --jump ACCEPT
    /sbin/iptables --append $new --proto icmp \
 --icmp-type parameter-problem --jump ACCEPT
 
    /sbin/iptables --append $new --jump denylog
    /sbin/iptables --replace InboundICMP 1 --jump $new
    /sbin/iptables --flush "$IBI"
    /sbin/iptables --delete-chain "$IBI"
    # Find the current OutboundICMP_$$ chain, and create a new one.
    OBICMP=$(get_safe_id OutboundICMP filter find)
    new=$(get_safe_id OutboundICMP filter new)
    /sbin/iptables --new-chain $new
    /sbin/iptables --append $new --proto icmp \
 --icmp-type echo-request --jump ACCEPT
    /sbin/iptables --append $new --proto icmp \
 --icmp-type echo-reply --jump ACCEPT
    /sbin/iptables --append $new --proto icmp \
 --icmp-type destination-unreachable --jump ACCEPT
    /sbin/iptables --append $new --proto icmp \
 --icmp-type source-quench --jump ACCEPT
    /sbin/iptables --append $new --proto icmp \
 --icmp-type time-exceeded --jump ACCEPT
    /sbin/iptables --append $new --proto icmp \
 --icmp-type parameter-problem --jump ACCEPT
 
    /sbin/iptables --append $new --jump denylog
    /sbin/iptables --replace OutboundICMP 1 --jump $new
    /sbin/iptables --flush $OBICMP
    /sbin/iptables --delete-chain $OBICMP
    /sbin/iptables --table nat --replace PostroutingOutbound 1 \
 --source $OUTERNET -j ACCEPT
    /sbin/iptables --table nat \
 --replace SMTPProxy 3\
 --destination $OUTERNET --jump ACCEPT
    /sbin/iptables --table nat --replace SMTPProxy 4
 
    /sbin/iptables --table nat \
 --replace TransProxy 3\
 --destination $OUTERNET --jump ACCEPT
    /sbin/iptables --table nat --replace TransProxy 4\
 -p TCP -j DNAT --to 192.168.1.1:3128
 
    OLD_local_chk=$(get_safe_id local_chk filter find)
    NEW_local_chk=$(get_safe_id local_chk filter new)
    /sbin/iptables --new-chain $NEW_local_chk
    /sbin/iptables -A $NEW_local_chk --in-interface lo -j ACCEPT
 
    for network in 192.168.1.0/255.255.255.0
    do
        /sbin/iptables -A $NEW_local_chk -s $network -j ACCEPT
    done
 
    /sbin/iptables --replace local_chk 1 \
        --jump $NEW_local_chk
    /sbin/iptables --flush $OLD_local_chk
    /sbin/iptables --delete-chain $OLD_local_chk
 
# Create a new PortForwarding chain
PFC=$(/sbin/iptables --table nat --numeric --list PortForwarding |\
   sed -n '3s/ .*//p')
    /sbin/iptables --table nat --new-chain PortForwarding_$$
    /sbin/iptables --table nat --replace PortForwarding 1 --destination $OUTERNET --jump PortForwarding_$$
    /sbin/iptables --table nat --flush $PFC
    /sbin/iptables --table nat --delete-chain $PFC
 
    ;;
 
 
masqstop)
      echo ""
      echo -n "Shuting down IP Masquerading:"
      /sbin/iptables -F FORWARD
      /sbin/iptables -P FORWARD DROP
      echo "  Done!"
      echo "" ;;
restart)
        $0 stop
        $0 start
        ;;
 
 
 status)
      echo $"Table: filter"
      /sbin/iptables --list -n
      echo $"Table: nat"
      /sbin/iptables -t nat --list -n
      echo $"Table: mangle"
      /sbin/iptables -t mangle --list -n
      ;;
 
stop)
     echo ""
     echo -n "Shutting down IP masquerade and firewall rules:"
     /sbin/iptables -P FORWARD DROP
     /sbin/iptables -P OUTPUT ACCEPT
     /sbin/iptables -P INPUT DROP
     /sbin/iptables -F INPUT
     /sbin/iptables -F OUTPUT
     /sbin/iptables -F FORWARD
     /sbin/iptables -F  
    /sbin/iptables --append FORWARD -s 192.168.1.0/255.255.255.0 -d 192.168.1.0/255.255.255.0 -j ACCEPT
     /sbin/iptables -X  
     echo "  Done!"
     echo "" ;;
 
 
 *)
    echo "Usage: masq {start|stop|restart|...}"
    exit 1
 
esac
exit 0