#!/bin/sh

# A Sample OpenVPN-aware firewall.

# eth0 is connected to the internet.
# eth1 is connected to a private subnet.

# Change this subnet to correspond to your private
# ethernet subnet.  Home will use HOME_NET/24 and
# Office will use OFFICE_NET/24.
PRIVATE=172.29.42.0/24

IPT=/sbin/iptables

# Loopback address
LOOP=127.0.0.1

# Delete old iptables rules
# and temporarily block all traffic.
$IPT -P OUTPUT DROP
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -F

# Set default policies
$IPT -P OUTPUT ACCEPT
$IPT -P INPUT DROP
$IPT -P FORWARD DROP

# Prevent external packets from using loopback addr
$IPT -A INPUT -i eth0 -s $LOOP -j DROP
$IPT -A FORWARD -i eth0 -s $LOOP -j DROP
$IPT -A INPUT -i eth0 -d $LOOP -j DROP
$IPT -A FORWARD -i eth0 -d $LOOP -j DROP

# Anything coming from the Internet should have a real Internet address
$IPT -A FORWARD -i eth0 -s 192.168.0.0/16 -j DROP
$IPT -A FORWARD -i eth0 -s 172.16.0.0/12 -j DROP
$IPT -A FORWARD -i eth0 -s 10.0.0.0/8 -j DROP
$IPT -A INPUT -i eth0 -s 192.168.0.0/16 -j DROP
$IPT -A INPUT -i eth0 -s 172.16.0.0/12 -j DROP
$IPT -A INPUT -i eth0 -s 10.0.0.0/8 -j DROP

# Block outgoing NetBios (if you have windows machines running
# on the private subnet).  This will not affect any NetBios
# traffic that flows over the VPN tunnel, but it will stop
# local windows machines from broadcasting themselves to
# the internet.
$IPT -A FORWARD -p tcp --sport 137:139 -o eth0 -j DROP
$IPT -A FORWARD -p udp --sport 137:139 -o eth0 -j DROP
$IPT -A OUTPUT -p tcp --sport 137:139 -o eth0 -j DROP
$IPT -A OUTPUT -p udp --sport 137:139 -o eth0 -j DROP

# Check source address validity on packets going out to internet
$IPT -A FORWARD -s ! $PRIVATE -i tun+ -j DROP

# Allow local loopback
$IPT -A INPUT -s $LOOP -j ACCEPT
$IPT -A INPUT -d $LOOP -j ACCEPT

# Allow incoming pings (can be disabled)
$IPT -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Allow services such as www and ssh (can be disabled)
$IPT -A INPUT -p tcp --dport http -j ACCEPT
$IPT -A INPUT -p tcp --dport https -j ACCEPT
$IPT -A INPUT -p tcp --dport ssh -j ACCEPT
$IPT -A INPUT -p tcp --dport smtp -j ACCEPT
$IPT -A INPUT -p tcp --dport imap -j ACCEPT
$IPT -A INPUT -p tcp --dport imaps -j ACCEPT
$IPT -A INPUT -p udp --dport 9987 -j ACCEPT

# Allow incoming OpenVPN packets
# Duplicate the line below for each
# OpenVPN tunnel, changing --dport n
# to match the OpenVPN UDP port.
#
# In OpenVPN, the port number is
# controlled by the --port n option.
# If you put this option in the config
# file, you can remove the leading '--'
#
# If you taking the stateful firewall
# approach (see the OpenVPN HOWTO),
# then comment out the line below.

$IPT -A INPUT -p tcp --dport 24911 -j ACCEPT

# Allow packets from TUN/TAP devices.
# When OpenVPN is run in a secure mode,
# it will authenticate packets prior
# to their arriving on a tun or tap
# interface.  Therefore, it is not
# necessary to add any filters here,
# unless you want to restrict the
# type of packets which can flow over
# the tunnel.

$IPT -A INPUT -i tun+ -j ACCEPT
$IPT -A FORWARD -i tun+ -j ACCEPT
#$IPT -A INPUT -i tap+ -j ACCEPT
#$IPT -A FORWARD -i tap+ -j ACCEPT

# Allow packets from private subnets
#$IPT -A INPUT -i eth1 -j ACCEPT
#$IPT -A FORWARD -i eth1 -j ACCEPT

# Keep state of connections from local machine and private subnets
$IPT -A OUTPUT -m state --state NEW -o eth0 -j ACCEPT
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -m state --state NEW -o eth0 -j ACCEPT
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Masquerade local subnet
$IPT -t nat -A POSTROUTING -s $PRIVATE -o eth0 -j MASQUERADE