#!/bin/bash -x

IPFRDCTL=/proc/sys/net/ipv4/ip_forward

WANNIC=eth1
#LANNIC=tun0
LANNIC=eth0

if [[ -f "${IPFRDCTL}" ]]
	then
	echo 1 > "${IPFRDCTL}"
	else
	echo "need ip_forward in kernel"
	exit 0
fi

DAEMON=iptables

	${DAEMON} -F

	${DAEMON} -I INPUT -i ${LANNIC} -j ACCEPT
	${DAEMON} -I INPUT -i ${WANNIC} -p tcp --dport 22 -j ACCEPT
	${DAEMON} -I INPUT -i ${WANNIC} -p tcp --dport 5000 -j ACCEPT
	${DAEMON} -I INPUT -i ${WANNIC} -p all -m state --state RELATED,ESTABLISHED -j ACCEPT
	${DAEMON} -t nat -A POSTROUTING -o ${WANNIC} -j MASQUERADE
	${DAEMON} -A FORWARD -i ${WANNIC} -o ${LANNIC} -m state --state RELATED,ESTABLISHED -j ACCEPT
	${DAEMON} -A FORWARD -i ${LANNIC} -o ${WANNIC} -j ACCEPT
	${DAEMON} -A FORWARD -i ${WANNIC} -o ${LANNIC} -j DROP
	#${DAEMON} -A INPUT -i ${WANNIC} -p tcp --dport ! 22 -j DROP

echo "NAT from private:${LANNIC} to public:${WANNIC}"