#!/bin/sh

# ------------------------------------------------------------------------------------------------------------------------------------$
depmod -a

iptables --flush

echo "1" > /proc/sys/net/ipv4/ip_forward

/sbin/modprobe ip_conntrack
/sbin/modprobe ip_tables
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_MASQUERADE

# ------------------------------------------------------------------------------------------------------------------------------------$
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# NAT
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --append FORWARD --in-interface eth1 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp --dport 80 -i eth1 -j REDIRECT --to-port 3128

iptables -A OUTPUT -j ACCEPT -m state --state NEW,ESTABLISHED,RELATED -o eth0 -p tcp -m multiport --dport 80,22 -m multiport --sport 1024:65535
iptables -A OUTPUT -j ACCEPT -m state --state NEW,ESTABLISHED,RELATED -o eth1 -p tcp -m multiport --dport 80,22 -m multiport --sport 1024:65535

# Forwarding
iptables -A FORWARD -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --sport 1024:65535 -d 10.0.0.250 --dport 55555 -m state --state NEW -j ACCEPT
iptables -A PREROUTING -t nat -i eth0 -p tcp --sport 1024:65535 -d 192.168.1.100 --dport 55555 -j DNAT --to 10.0.0.250