Debian Router With USB 3G Modem

option subnet-mask 255.255.255.0;
default-lease-time 600;
max-lease-time 7200;

subnet 172.16.7.0 netmask 255.255.255.0 {
range 172.16.7.2 172.16.7.250;
option broadcast-address 172.16.7.255;
option routers 172.16.7.1;
}

#host confusia {
# hardware ethernet 02:03:04:05:06:07;
# filename “vmunix.confusia”;
# server-name “bb.home.vix.com”;
#}

echo “Loading modem”
modprobe usbserial vendor=0x12d1 product=0x1003
sleep 1

echo “Loading driver”
/scripts/huaweiAktBbo-i386.out
sleep 1

echo “Connecting”
wvdial

# The IP-addresses for the interfaces
LAN_IP=”172.16.7.1″
WAN_IP=”`ifconfig $WAN | grep \”inet addr\” | cut -f 2 -d \”:\” | cut -f 1 -d \” \”`”
LO_IP=”127.0.0.1″

#Networks
LAN_NET=”172.16.7.0/24″
WAN_NET=”$WAN_IP”
LO_NET=”127.0.0.1/8″

# The machines on the net
MILO=”172.16.7.1″

#——————————————————————-
# Starting the scripts and write to syslog & Console
# ——————————————————————
echo “‘date’:FIREWALL SCRIPT Started ” >> /var/log/messages

echo
echo “Linux Firewall at PBJ IT & Webdesign ”
echo “(C) Copyrigth by Per Jørgensen – 2006″
echo ” All rigths reserved!”

echo
echo “Initializing firewall with these settings:”
echo “- WAN IP-address: $WAN ($WAN_IP)”
echo “- LAN IP-address: $LAN ($LAN_IP)”
echo “- GATEWAY hos 3: GW ($GW)”
echo
echo “Initiating script:”
echo ” Done”

# —————————————————————
# Start by loading IPTABLES modules
# —————————————————————
echo “Loading IPTABLES modules”
modprobe ip_tables
modprobe ip_conntrack

echo ” Done”
# —————————————————————
# Flush existing Connections and removing rules
# —————————————————————
echo “Flashing and zeroing the chains”
$IPTABLES -F
$IPTABLES -Z
$IPTABLES -X
echo ” Done”
echo
# —————————————————————
# Initialize and setup defaults rules
# —————————————————————
echo “Initialzing and setup defaults policies”

# Forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# IP spoofing
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $f
done

# Default Policies
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP

echo ” Done”
echo
# ————————————————————–
# Create and flush chains
# ————————————————————–
echo “Creating and flushing the chains”
$IPTABLES -N wantolan
$IPTABLES -N lantowan
$IPTABLES -N lo
$IPTABLES -N lan
$IPTABLES -N wan
echo ” Done. Chains are made”
echo
################################################################
# Setting up the INPUT chain
# ————————————————————–
echo “Setting up the INPUT chain”
# Allowing all trafic from the inside
$IPTABLES -A lan -m state –state NEW -j ACCEPT

## DNS ##
$IPTABLES -t filter -A INPUT -p udp –dport 53 -j ACCEPT
$IPTABLES -t filter -A INPUT -p tcp –dport 53 -j ACCEPT

## ICMP ##
$IPTABLES -t filter -A INPUT -p icmp -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -t filter -A INPUT -i $LAN -p icmp –icmp-type echo-request -m state –state NEW -j ACCEPT
$IPTABLES -t filter -A INPUT -i $WAN -p icmp –icmp-type echo-request -m state –state NEW -j ACCEPT

echo ” Done. INPUT chain is up and running”
echo

# ————————————————————–
# Setting up the OUTPUT chain
# ————————————————————–
#
## DNS ##
$IPTABLES -t filter -A OUTPUT -p udp –dport 53 -j ACCEPT
$IPTABLES -t filter -A OUTPUT -p tcp –dport 53 -j ACCEPT

# Accepting outgoing trafik
$IPTABLES -t filter -A OUTPUT -p ALL -s $LAN_NET -j ACCEPT

# Rejecting Ident
#$IPTABLES -A wan -m state –state NEW -p tcp –dport 113 -j REJECT

echo ” Done. OUTPUT chain is up and running”
echo

################################################################
# Setting up rules for LO interface
# ————————————————————–
echo “Setting up LOCAL interface ”
$IPTABLES -A lo -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -i $LO -j ACCEPT
$IPTABLES -A OUTPUT -o $LO -j ACCEPT

echo ” Done. LO is up and running”
echo

# ————————————————————–
# Setting up the LAN interface
# ————————————————————–
echo “Setting up the LAN interface”
$IPTABLES -t filter -A lan -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT

echo ” Done. LAN is up and running”
echo

# ————————————————————–
# Setting up the WAN interface
# ————————————————————–
echo “Setting up the WAN interface”
$IPTABLES -t filter -A wan -m state –state ESTABLISHED,RELATED -j ACCEPT

echo ” Done. WAN is up and running”
echo

################################################################
# Setting up rules for LANTOWAN chain
# ————————————————————–
echo “Setting up the LANTOWAN chain”
$IPTABLES -t filter -A lantowan -s $LAN_NET -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT

echo ” Done. LANTOWAN chain is up and running”
echo

################################################################
# Setting up rules for WANTOLAN interface
# ————————————————————–
echo “Setting up the WANTOLAN chains”

# Accepting only returntraffic to lan
$IPTABLES -A wantolan -m state –state ESTABLISHED,RELATED -j ACCEPT

echo ” Done. WANTOLAN chain is up and running”
echo

################################################################
# Setting up Masquerading
# ————————————————————–
echo “Setting up MASQUERADING”
# From all interfaces – but not WAN
$IPTABLES -t nat -A POSTROUTING -s ! $WAN_IP -j SNAT –to-source $WAN_IP

echo ” Done. MASQUERADING is up and running”
echo

##################################################################
# Activating the Chains
# —————————————————————-
echo “Activating the chains”
$IPTABLES -A INPUT -i $WAN -j wan
$IPTABLES -A INPUT -i $LAN -j lan
$IPTABLES -A INPUT -i $LO -j lo
$IPTABLES -A FORWARD -i $WAN -o $LAN -j wantolan
$IPTABLES -A FORWARD -i $LAN -o $WAN -j lantowan

echo “Done. The chains are now activated”

echo
echo “Firewall has been setup succesfully and are now”
echo ” protecting your network. No garanty is given.”
echo
echo “This script is designet by PBJ IT & Webdesign”
echo ” This is released under GPL licens”
echo ” Remember OpenSource is not nessecary FREE”