kgoetz@gateProxy:~$ cat /etc/network/if-up.d/000-firewallScript 
#!/bin/sh

###############                                                  ###############
# The bits that are ##'d are copied from places - they should be basicly       #
# unchanged ( perhaps a port here and there, or a variable ). The header block #
# is the only original bit - and the variables :). wow. original :)            #
# This was coppied from the script used on Willunga Waldorf Schools gateway    #
###############                                                  ###############


# internal=eth0
# thisBoxInternal=192.168.0.1

# external=eth1
# thisBoxExternal=10.0.0.2

# cachingProxyPort=8123
# filteringProxyPort=8118

###############                                                  ###############
# Copied from http://www.debian-administration.org/articles/23                 #
# "Setting up a simple Debian gateway"                                         #
# All typed out by Karl, 16th July, 2k6                                        #
# Eth0 is internal, Eth1 is eth1. Or was when I set it up.                 #
###############                                                  ###############

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# Delete All Existing Rules
#

iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# Always accept loopback traffic
iptables -A INPUT -i lo -j ACCEPT

# Allow established connections, and those not coming from the outside
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow outgoing connections from the LAN side
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

# Masquerade
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

# Dont't forward from the outside to the inside
iptables -A FORWARD -i eth1 -o eth1 -j REJECT

# Enable routing
echo "1" > /proc/sys/net/ipv4/ip_forward

###############                                                  ###############
# End of debian-administration iptables rules                                  #
###############                                                  ###############

###############                                                  ###############
# Copied from http://www.debian-administration.org/articles/73                 #
# "Port forwarding for iptables (DMZ)"                                         #
# The instructions are for a different machine, I'm trying for this one.       #
###############                                                  ###############

# All external traffic to 64 should be sent to this machine.
iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 64 -j DNAT --to 10.0.0.2

# Accept new connections on port 64 on device eth1
iptables -A INPUT -p tcp -m state --state NEW --dport 64 -i eth1 -j ACCEPT

###############                                                  ###############
# End DMZ (ssh) bit                                                            #
###############                                                  ###############

###############                                                  ###############
# Copied from http://www.debian-administration.org/articles/252                #
# "Secure Networking within kernel"                                            #
# Left disabled until I know the top bit works, and because all this can /     #
# should be set in a config file. (/etc/sysctl.conf). It will be enabled here  #
# for added security.                                                          #
##############                                                   ###############

# Ignore all ICMP echo - dont respond to ping
echo  "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all

# Reject incoming packets if their source ip does not match the network
# they are coming from - dont know if this is safe for us.
# echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter

# Protect against SYN floods... whatever o_0
echo "1" > /proc/sys/net/ipv4/tcp_syncookies

# Ignore broadcast ping to "... prevent you from being an unwilling 
# participant in smurf attacks"
echo  "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Ignore bogus error responces (ie, responces to errors we didn't make)
#echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responces

###############                                                  ###############
# End of Secure networking in kernel section.                                  #
###############                                                  ###############

###############                                                  ###############
# Copied from http://www.debian-administration.org/articles/187                #
# "Using iptables to rate-limit incoming connections"                          #
###############                                                  ###############

iptables -I INPUT -p tcp --dport 64 -i eth1 -m state --state NEW -m recent --set

# Allow a max of 3 tries per minute (drop on 4th) from external network to ssh.
iptables -I INPUT -p tcp --dport 64 -i eth1 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP

###############                                                  ###############

###############                                                  ###############
# Copied from:                                                                 #
# http://www.cyberciti.biz/tips/linux-setup-transparent-proxy-squid-howto.html #
# "Linux: Setup a transparent proxy with Squid in three easy steps"            #
# Skipped down to step 3 - "Iptables configuration".                           #
# Comments somewhat changed to reflet my reality, variables renamed.           #
##############                                                   ###############
#
# Commented out due to lack of testing
#
# DNAT port 80 request comming from LAN systems to squid 8118 ($SQUID_PORT) aka transparent proxy
#iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to $thisBoxInternal:$filteringProxyPort
#
# if it is same system
#iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port $filteringProxyPort
#
# From debian-administraton.org - seems to disagree with above - :S
## Transparent proxying
#iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
#
###############                                                  ###############
# End of "Linux: Setup a transparent proxy with Squid in three easy steps"     #
###############                                                  ###############