#
# Shorewall version 4.0 - Sample Rules File for two-interface configuration.
# Copyright (C) 2006,2007 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# See the file README.txt for further details.
#------------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall-rules"
#
# The manpage is also online at 
# http://shorewall.net/manpages/shorewall-rules.html
#
#############################################################################################################
#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK
#							PORT	PORT(S)		DEST		LIMIT		GROUP
#
#	Accept DNS connections from the firewall to the network
#
DNS/ACCEPT	$FW		net
#
#	Accept SSH connections from the local network for administration
#
SSH/ACCEPT	loc		$FW
#
#	Allow Ping from the local network
#
Ping/ACCEPT	loc		$FW

#
# Drop Ping from the "bad" net zone.. and prevent your log from being flooded..
#

Ping/DROP	net		$FW

ACCEPT		$FW		loc		icmp
ACCEPT		$FW		net		icmp
#

HTTP/ACCEPT	$FW	net
DNS/ACCEPT	loc	net
HTTPS/ACCEPT	$FW	net
# Acceso ssh externo
ACCEPT	net	$FW	tcp	4657

# VPN
#ACCEPT	net	$FW	tcp	1723
#ACCEPT	net	$FW	47
#ACCEPT	$FW	net	47
#ACCEPT	$FW	net	gre	
#ACCEPT	net	$FW	tcp	1723

ACCEPT	$FW	net	udp	ntp

ACCEPT	$FW	net	udp	ntp
REDIRECT	loc	3128	tcp	www
ACCEPT	loc	$FW	tcp	3128
ACCEPT	loc	$FW	tcp	pop3
ACCEPT	loc	$FW	tcp	smtp
ACCEPT	loc	$FW	tcp	domain
ACCEPT	loc	$FW	udp	domain
ACCEPT	loc	$FW	tcp	137
ACCEPT	loc	$FW	tcp	138
ACCEPT	loc	$FW	tcp	139
ACCEPT	loc	$FW	udp	137
ACCEPT	loc	$FW	udp	138
ACCEPT	loc	$FW	udp	139
ACCEPT	loc	$FW	tcp	10000
ACCEPT	loc	$FW	tcp	22
#ACCEPT	loc	$FW	tcp	21
#ACCEPT	loc	$FW	udp	21
ACCEPT	loc	$FW	tcp	ftp
ACCEPT	loc	$FW	icmp	

# Mapeo para Maquina Grabadora
DNAT	net	loc:192.168.2.18:4000	tcp	4000

# Webmin para cmg

#DNAT	net	loc:192.168.2.202	tcp	10000
#DNAT	net	loc:192.168.2.202	udp	10000

# Mapeo para Router de VoIP
DNAT	net	loc:192.168.2.250	udp	5060,5061
DNAT	net	loc:192.168.2.250	udp	16384,16482,16383
DNAT	net	loc:192.168.2.250	tcp	8080
ACCEPT	loc:192.168.2.250	net	all
# Se permite acceso a smtp de gmail
ACCEPT	loc	net	tcp	993
DNAT	net	loc:192.168.2.177	udp	51915

# Se permite acceso a ftp a todos
ACCEPT	loc	net	udp	993
ACCEPT	loc	net	tcp	21

# Se permite acceso a gmail
ACCEPT	loc	net	udp	21

ACCEPT	loc	net	tcp	465
ACCEPT	loc	net	tcp	25


ACCEPT	loc	net	udp	25
DNAT	net	loc:192.168.2.177	tcp	51915

ACCEPT	loc	all	tcp

#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE