version 5

if_lan=eth0
if_internet=eth1

# Port forwarding
dnat to 10.1.0.2 inface ${if_internet} proto tcp dport 80    # Jane HTTP
dnat to 10.1.0.2 inface ${if_internet} proto udp dport 1194  # Jane OpenVPN
dnat to 10.1.3.1 inface ${if_internet} proto tcp dport 6881:6999  # Mike BT
dnat to 10.1.3.1 inface ${if_internet} proto udp dport 6881:6999  # Mike BT
dnat to 10.1.1.1 inface ${if_internet} proto tcp dport 6699  # Rich WinMX
dnat to 10.1.1.1 inface ${if_internet} proto udp dport 6257  # Rich WinMX
dnat to 10.1.5.1 inface ${if_internet} proto tcp dport 3389  # Brian RDP
dnat to 10.1.254.249 inface ${if_internet} proto tcp dport 4662  # Mike eMule
dnat to 10.1.254.249 inface ${if_internet} proto udp dport 4672  # Mike eMule
dnat to 10.1.254.249 inface ${if_internet} proto tcp dport 34217  # Mike Shareaza

dnat to 10.1.254.249 inface ${if_internet} proto udp dport 34217  # Mike Shareaza
dnat to 10.1.1.1:3389 inface ${if_internet} proto tcp dport 3390  # Rich RDP
dnat to 10.1.3.1:22   inface ${if_internet} proto tcp dport 2222  # Mike SSH
dnat to 10.1.4.1:22   inface ${if_internet} proto tcp dport 2223  # Doug SSH

# Firewall for traffic hitting oversoul itself from the Internet
interface ${if_internet} world
        policy reject
        protection full
        server ping accept
        server ssh accept
        server custom rmi tcp/1090:1099 0:65535 accept
        client all accept

# Firewall for traffic hitting oversoul itself from the LAN
interface ${if_lan} lan
        policy reject
        protection full
        server ping accept
        server dhcp accept
        server dns accept
        server ssh accept
        server cups  drop  # Don't log CUPS printer announcements
        server samba drop  # Same for SMB stuff
        server custom rmi tcp/1090:1099 0:65535 accept
        client all accept

# Router for masquerading traffic from the LAN to the Internet
router masq inface ${if_lan} outface ${if_internet}
        protection full
        masquerade
        server all accept

# Router for port-forwarded traffic coming from the Internet
router services inface ${if_internet} outface ${if_lan}
        protection full
        server all accept