#!/bin/bash
# $Id: fifalobath.private 26 2009-08-25 17:06:27Z dave $


# Slash delimited port/name/protocol(s).
# Ports can have a range, eg 137:139 or 5060,5062.
# Protocols are comma delimited; if omitted then tcp is assumed.
SERVICES=`cat <<SETVAR
   25/smtp
   53/dns/udp
   69/tftpd/tcp,udp
  137:139/samba/tcp,udp
  445/samba/tcp,udp
  993/pops
 2049/nfs
 3306/mysql
 5901/vnc
 6000:6002/X/tcp,udp
19150/gkrellm
SETVAR`

for DELIMITED in $SERVICES; do
   SERVICE=`echo $DELIMITED | cut -d'/' -f 2`
   PORT=`echo $DELIMITED | cut -d'/' -f 1`
   PROTOCOLS=`echo $DELIMITED | cut -d'/' -f 3 | sed 's/,/ /g'`
   if [ ! -n "$PROTOCOLS" ]; then PROTOCOLS=tcp; fi

   for PROTOCOL in $PROTOCOLS; do
      if ! `echo "tcp udp icmp" | fgrep -q "$PROTOCOL"`; then
         $ERR "invalid protocol '$PROTOCOL' extracted from '$DELIMITED'"
         continue
      fi

      $IPTABLES -A INPUT -i $INTIF -m state --state NEW,ESTABLISHED,RELATED -p $PROTOCOL -s $INTNET -d $INTIP --dport $PORT -j ACCEPT &&
         $LOG "allowing $PROTOCOL access from $INTNET to $SERVICE on $INTIP:$PORT"
   done
done