# 
# Created by LiuWei @ 2010.8.27 
# init firewall
#

#FMT_ECHO=1>/dev/null 2>&1

ebtables -t broute -F

ZTE_FILTER_CHAIN=macipport_filter
ZTE_FORWARD_CHAIN=port_forward
ZTE_DMZ_CHAIN=DMZ
ZTE_MAP_CHAIN=port_map
ZTE_WIFI_FILTER_CHAIN=wifi_filter
ZTE_FOTA_FILTER_CHAIN=fota_filter

#clear mangle
iptables -t mangle -F

#clear filter
iptables -t filter -F
iptables -t filter -X $ZTE_FILTER_CHAIN
iptables -t filter -X $ZTE_WIFI_FILTER_CHAIN
iptables -t filter -X $ZTE_FOTA_FILTER_CHAIN

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

#clear nat
iptables -t nat -F
iptables -t nat -X $ZTE_FORWARD_CHAIN
iptables -t nat -X $ZTE_DMZ_CHAIN
iptables -t nat -X $ZTE_MAP_CHAIN

#make a new chain for filter
iptables -t filter -N $ZTE_FILTER_CHAIN
iptables -t filter -A FORWARD -j $ZTE_FILTER_CHAIN

iptables -t filter -N $ZTE_WIFI_FILTER_CHAIN
iptables -t filter -A INPUT -j $ZTE_WIFI_FILTER_CHAIN

iptables -t filter -N $ZTE_FOTA_FILTER_CHAIN
iptables -t filter -A INPUT -j $ZTE_FOTA_FILTER_CHAIN


# begin - zhangyuelong10100551 for ipv6 firewall 2012.08.30
#clear filter
ip6tables -t filter -F
ip6tables -t filter -X $ZTE_FILTER_CHAIN

ip6tables -P INPUT ACCEPT
ip6tables -P OUTPUT ACCEPT
ip6tables -P FORWARD ACCEPT

ip6tables -t filter -N $ZTE_FILTER_CHAIN
ip6tables -t filter -A FORWARD -j $ZTE_FILTER_CHAIN
# end - zhangyuelong10100551 for ipv6 firewall 2012.08.30

#Make a new chain for nat
iptables -t nat -N $ZTE_FORWARD_CHAIN
iptables -t nat -N $ZTE_DMZ_CHAIN
iptables -t nat -N $ZTE_MAP_CHAIN

iptables -t nat -I PREROUTING 1 -j $ZTE_FORWARD_CHAIN
iptables -t nat -I PREROUTING 1 -j $ZTE_DMZ_CHAIN
iptables -t nat -I PREROUTING 1 -j $ZTE_MAP_CHAIN

#ssh
#iptables -t filter -I INPUT -p tcp --dport 22 -j DROP
#iptables -t filter -I INPUT -p udp --dport 22 -j DROP

echo "firewall init done"
#nat.sh

# added by liuwei
#rmmod turbo_nat
#insmod /lib/modules/3.4.0+/kernel/net/turbonat/turbo_nat.ko

insmod /usr/lib/modules/3.4.0+/kernel/net/ipv4/netfilter/xt_HL.ko
iptables -t mangle -I PREROUTING -m ttl --ttl 1 -j TTL --ttl-inc 4
iptables -t mangle -A PREROUTING -j TTL --ttl-set 64
iptables -t mangle -A POSTROUTING -j TTL --ttl-set 64
