#!/usr/bin/perl

#Konfigurationsdateien

$fwlist_file = "/etc/firewall/fw_start.conf";
$blacklist_file = "/etc/firewall/black.list";

#Kernel-Module
$KernMods = "ip_conntrack_ftp ipt_tcpmss";

#Variablen
$IP_INET             = "";
$IP_FIREWALL         = "192.168.XXX.YYY";
$IP_WEBSERV          = "192.168.XXX.YYZ";
$IP_CLIENT           = "192.168.XXX.YZZ";

$DEV_LAN  = "eth0";

$NET_INET = "0.0.0.0/0.0.0.0";
$NET_LAN  = "192.168.XXX.0/255.255.255.0";

$IPTABLES  = "/usr/sbin/iptables";

#Komandozeilenparameter
$verbose = 0;

for($argvcount=0; $argvcount < $#ARGV; $argvcount++) 
 {
  $_=$ARGV[$argvcount];
  if ($_ eq "-h") { print "Usage myfl.pl [-v] [-ip IP.IP.IP.IP] [-id|-inetdev ippp0 ippp1 ..] [-b blacklistfile] [-c file.conf]\n" }
  if ($_ eq "-v") { $verbose = 1; }
  if ($_ eq "-ip") 
  {
    if ($ARGV[$argvcount+1] =~ /\d+\.\d+\.\d+\.\d+/) 
     {
      $IP_INET = $ARGV[$argvcount+1];
      $argvcount++; 
     }
  }
  if ($_ eq "-id" || $_ eq "-inetdev")
   {
    while($ARGV[$argvcount+1] =~ /ppp\d|ippp\d/)
     {
       $DEV_INET[$#DEV_INET+1] = $ARGV[$argvcount+1];
       $argvcount++;
     }		    
   }  
  if ($_ eq "-c") 
   { 
    if (-e $ARGV[$argvcount+1]) 
     {
      $fwlist_file = $ARGV[$argvcount+1];
      $argvcount++;    
     } 
   }
  if ($_ eq "-b") 
   { 
    if (-e $ARGV[$argvcount+1]) 
     {
      $blacklist_file = $ARGV[$argvcount+1];
      $argvcount++;    
     } 
   }
 }



if($#DEV_INET_LIST <= 0){
#    @DEV_INET_LIST = ("ppp0","ippp0","ippp1");
    @DEV_INET_LIST = ("ppp0");
}

print "Using conf file: $fwlist_file\n";
if ($verbose) {print "Using INET Devices: @DEV_INET_LIST\n";}

print "Using Blacklist file: $blacklist_file\n";
@BLACK_LIST;
if(open (BLKLIST, "<$blacklist_file")){
    while(<BLKLIST>) {
	chomp($_);
	($_) = split(/#/);
        @BLACK_LIST=(@BLACK_LIST,$_);
    }	
    if ($verbose) {
	print "Blacklist: @BLACK_LIST\n";
    }
} else { 
    print "could not open: $blacklist_file! Run without black list!\n ";
}


#if ($IP_INET eq "")
# {
#  #IP Adresse von ppp0 aus ifconfig auslesen
#  @ifconfig = `/sbin/ifconfig`;
#  $len      = @ifconfig;
#  $i = 0;
#  while (!($ifconfig[$i] =~ /^$DEV_INET/) && $i < $len) { $i++; }

#  $_ = $ifconfig[++$i];

#  ($IP_INET) = /\s*inet\s*addr:\s*(\d+\.\d+\.\d+\.\d+)/;
# }
 
if (not ($KernMods eq ""))
 {
   print("Installing Kernel modules: $KernMods\n");
   system("modprobe $KernMods");
 }

if ($verbose) { print "inet addr: $IP_INET\n"; }

open (FWLIST, "<$fwlist_file") || die "konnte Datei: $fwlist_file nicht oeffnen\n";

    while(<FWLIST>) {
	chomp($_);
	($_) = split(/#/);
	if(/\w+/) {
	    s/^\ +//;
	    s/\ +$//;
	    s/\{.*\}//g;
	    #wenn DEV_INET drin dann fuer alle devices
	    if ($verbose) { print "$_\n"; }    
	    if( /.*\$DEV_INET.*/){
	      foreach $DEV_INET (@DEV_INET_LIST){
	        if($verbose) { print "last line for DEV_INET=$DEV_INET \n";}
		eval "system(\"$IPTABLES $_\\n\");";	        
	      }
	    }else{
		if( /.*\$BLACKLIST.*/){
		    foreach $BLACKLIST (@BLACK_LIST){
	    		if($verbose) { print "Last line for BLACKLIST=$BLACKLIST \n";}
			eval "system(\"$IPTABLES $_\\n\");";	        
		    }
		}else{
	    	    eval "system(\"$IPTABLES $_\\n\");";
		}
	    }
	} 
    }
  
close (FWLIST);  

print "done...\n";
 
exit 0;





