# LIMPANDO AS TABELAS DO FIREWALL
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X


# LIBERA PARA LOOPBACK
iptables -A OUTPUT -p tcp --syn -s 127.0.0.1/255.0.0.0 -j ACCEPT 
iptables -A INPUT -i lo -j ACCEPT

# LIBERA ACESSO SOMENTE PARA REDE LOCAL PORTAS PARA INTERNET SSH, ETC
iptables -A INPUT -p tcp --destination-port 20 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 21 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 22 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 80 -j ACCEPT 
iptables -A INPUT -p tcp --destination-port 8080 -j ACCEPT

# PORTAS PARA O SAMBA
iptables -A INPUT -i eth1 -m multiport -p tcp --dport 53,135,139,445 -j ACCEPT
iptables -A INPUT -i eth1 -m multiport -p udp --dport 53,137,138 -j ACCEPT

iptables -A INPUT -p tcp --syn -s 192.168.2.0/24 -j ACCEPT 

# COMPARTILHANDO INTERNET
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward

# PARA NAO FUGIREM DO PROXY
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128

# PARA PRIORIZAR O TRAFEGO HTTP/HTTPS
iptables -t mangle -A OUTPUT -o eth0 -p tcp --dport 80 -j TOS --set-tos 16
iptables -t mangle -A OUTPUT -o eth0 -p tcp --dport 443 -j TOS --set-tos 16


# BLOQUEANDO SCANERNS POSTMAP ATAQUES DOS E PING OF DEATH

#iptables echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT


# FECHANDO TUDO EXCETO O ABERTO ACIMA
iptables -A INPUT -p tcp --syn -j DROP