#!/bin/sh
# Firewall script that allows access to my WAG354G
#These rules will be overwritten by the http://192.168.1.1/Forward_UPnP.asp page


echo "Resetting netfilter rules..."

# Location of iptables command 
IPTABLES=/usr/sbin/iptables 

# Flush existing firewall rules
$IPTABLES --flush 

# Delete any chains from previous scripts
$IPTABLES --delete-chain 

echo "Adding new rules..."

# Change the default policy of all three chains to DROP
$IPTABLES -P INPUT DROP 

#$IPTABLES -P FORWARD DROP # if this is enabled I cant do anything from my LAN!
$IPTABLES -P OUTPUT DROP 

# Use stateful inspection feature to only allow incoming connections
# related to connections I have already established myself 
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 
$IPTABLES -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#what about established FORWARD?

# Allow the world access to ports 22/80 on my WAG354G, 

$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT # internal ssh now works 
$IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT # internal modem web pages now acce
$IPTABLES -A INPUT -i ppp0 -p tcp --dport 22 -j ACCEPT #this now works! 

# Other rules may be needed to allow other required ports


#shutdown adsl
echo "(Trying to) shutting down ADSL..."

route del default
route add default via 192.168.1.1 dev br0 
ifconfig ppp0 down
killall checkadsl
killall redial
killall wanledctrl
killall pppd
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE

# Included to allow the script to exit gracefully
exit 0