fw_limit/custom_rules_init.sh

#!/bin/sh
ACTDIR=$(dirname "$0")
KIDS_IP="172.24.42.100-172.24.42.110"
KIDS_MAC="00:e0:53:13:1b:f1 88:79:7e:f7:05:60 d0:04:01:9f:b4:09"

FOR_OUT_KIDS="forwarding_lan_rules_kids"
FOR_OUT_GAMES="forwarding_lan_rules_games"
FOR_IN_KIDS="forwarding_wan_rules_kids"
YOUTUBE="forwarding_wan_rules_youtube"

iptables -N ${FOR_OUT_KIDS}
iptables -I ${FOR_OUT_GAMES} -m limit --limit 1/min -j LOG --log-prefix "Surfing kid: "
iptables -A ${FOR_OUT_KIDS} -j DROP

iptables -N ${FOR_OUT_GAMES}
iptables -I ${FOR_OUT_GAMES} -m limit --limit 1/min -j LOG --log-prefix "Playing kid: "
iptables -A ${FOR_OUT_GAMES} -j DROP

iptables -N ${FOR_IN_KIDS}
iptables -A ${FOR_IN_KIDS} -j DROP

iptables -N ${YOUTUBE}
iptables -A ${YOUTUBE} -j DROP

# Time restriction for games
iptables -I ${FOR_OUT_GAMES} 1 -m time --timestart 14:00 --timestop 21:00 --weekdays Mon,Tue,Wed,Thu,Sun -j ACCEPT
iptables -I ${FOR_OUT_GAMES} 1 -m time --timestart 08:00 --timestop 23:00 --weekdays Sat -j ACCEPT
iptables -I ${FOR_OUT_GAMES} 1 -m time --timestart 12:00 --timestop 23:00 --weekdays Fri -j ACCEPT

# allow WhatsApp
iptables -I ${FOR_OUT_KIDS} 1 -p tcp -m multiport --dports 4244,5222,5223,5228,5242,50318,59234 -m comment --comment "TCP Whatsapp" -j ACCEPT
iptables -I ${FOR_OUT_KIDS} 1 -p udp -m multiport --dports 3478,45395,50318,59234 -m comment --comment "UDP Whatsapp" -j ACCEPT

# redirect games
iptables -I ${FOR_OUT_KIDS} -p udp -m multiport --dports 29995:30005 -m comment --comment "Minetest" -j ${FOR_OUT_GAMES}

# populate list
${ACTDIR}/filter_mac.sh start
iptables -I FORWARD -m iprange --dst-range ${KIDS_IP} -m conntrack --ctstatus RELATED,ESTABLISHED -j ${FOR_IN_KIDS}

# web access - time restriction
iptables -I ${FOR_OUT_KIDS} 1 -p tcp -m multiport --dports 80,443 -m time --timestart 08:00 --timestop 23:00 -j ACCEPT
iptables -I ${FOR_IN_KIDS} 1 -p tcp -m multiport --sports 80,443 -m time --timestart 08:00 --timestop 23:00 -j ACCEPT

# Youtube
while read -r line; do
	iptables -I ${FOR_IN_KIDS} -m iprange --src-range ${line} -m length --length 2048:65535 -p tcp -j ${YOUTUBE}
done < "${ACTDIR}/youtube.txt"