#!/bin/sh
# Inclusion statique provenant du fichier xml 

iptables -t nat -N NONAT
iptables -t nat -I NONAT -j ACCEPT
iptables -t nat -I PREROUTING ! -i eth0 -d 10.0.0.0/8 -j NONAT
iptables -t nat -I PREROUTING -d 172.16.0.0/12 -j NONAT
iptables -t nat -I PREROUTING -d 192.168.0.0/16 -j NONAT
iptables -t nat -I PREROUTING -d 161.48.0.0/19 -j NONAT
iptables -t nat -I PREROUTING -d 79.174.192.22/32 -j NONAT
iptables -t nat -I PREROUTING -d 79.174.192.38/32 -j NONAT
iptables -t nat -I PREROUTING -d 195.221.236.208/32 -j NONAT
iptables -t nat -I PREROUTING -d 83.97.61.199/32 -j NONAT
iptables -t nat -I PREROUTING -d 83.97.61.244/32 -j NONAT
type_etab=$(CreoleGet type_etab)
if [ "$type_etab" = "Lycee_Region" ] ; then
iptables -t nat -I PREROUTING -d 10.40.0.0/16 -j RETURN
fi
iptables -D pub-bas -i eth4 -p tcp --dport 3128 -j ACCEPT
iptables -t nat -D PREROUTING -i eth4 -p tcp --dport 80 --tcp-flags SYN,RST,ACK SYN ! -d 10.104.201.245/32 -j REDIRECT --to-ports 3128
iptables -D pub-bas -i eth4 -p tcp --dport 3128 -j ACCEPT
iptables -t nat -D PREROUTING -i eth4 -p tcp --dport 3128 --tcp-flags SYN,RST,ACK SYN ! -d 10.104.201.245/32 -j REDIRECT --to-ports 3128
iptables -D pub-bas -i eth4 -p tcp --dport 3128 -j ACCEPT
iptables -t nat -D PREROUTING -i eth4 -p tcp --dport 8080 --tcp-flags SYN,RST,ACK SYN ! -d 10.104.201.245/32 -j REDIRECT --to-ports 3128
iptables -D pub-bas -d 10.104.201.55/32 -i eth4 -p tcp -m state --state NEW -m tcp --dport 3128 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
iptables -A adm-ext -s 88.190.20.94 -i eth1 -o eth0 -p tcp -m state --state NEW -m tcp --dport 4882 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
iptables -A ped-ext -s 88.190.20.94 -i eth2 -o eth0 -p tcp -m state --state NEW -m tcp --dport 4882 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
iptables -I ext-bas -d 10.104.201.245/32 -p tcp -m tcp --dport 8062 -j DROP
if [ -e /usr/share/era/ipset-tor ] ; then
. /usr/share/era/ipset-tor &> /dev/null
iptables -I OUTPUT -o eth0 -p tcp -m tcp -m set --match-set bastion-tor dst -j DROP
iptables -I FORWARD -o eth0 -p tcp -m tcp -m set --match-set bastion-tor dst -j DROP
fi
if [ "$type_etab" = "CG13" ] ; then
iptables -t nat -A POSTROUTING -o eth0 -s 10.231.0.0/255.255.0.0 -j SNAT --to-source 10.104.201.245
fi
if [ -e /etc/sysconfig/regles-locales ] ; then
. /etc/sysconfig/regles-locales
fi