iptables -F
iptables -t nat -F
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
export LAN=eth1
export WAN=eth0
iptables -I INPUT 1 -i ${LAN} -j ACCEPT
iptables -I INPUT 1 -i lo -j ACCEPT
iptables -A INPUT -p UDP --dport bootps -i ! ${LAN} -j REJECT
iptables -A INPUT -p UDP --dport domain -i ! ${LAN} -j REJECT
iptables -A INPUT -p TCP --dport ssh -i ${WAN} -j ACCEPT
iptables -A INPUT -p TCP -i ! ${LAN} -d 0/0 --dport 0:112 -j DROP
iptables -A INPUT -p UDP -i ! ${LAN} -d 0/0 --dport 114:1023 -j DROP
iptables -A INPUT -p TCP -i ! ${LAN} -d 0/0 --dport 114:1023 -j DROP
iptables -A INPUT -p UDP -i ! ${LAN} -d 0/0 --dport 0:112 -j DROP
iptables -I FORWARD -i ${LAN} -d 192.168.0.0/255.255.0.0 -j DROP
iptables -A FORWARD -i ${LAN} -s 192.168.0.0/255.255.0.0 -j ACCEPT
iptables -A FORWARD -i ${WAN} -d 192.168.0.0/255.255.0.0 -j ACCEPT
iptables -A INPUT -s 0.0.0.0/255.255.255.255 -p tcp --dport 5000 -j DROP
iptables -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 1 > $f ; done
iptables -t nat -A PREROUTING -p tcp --dport 20 -i ${WAN} -j DNAT --to 192.168.0.1
iptables -t nat -A PREROUTING -p tcp --dport 21 -i ${WAN} -j DNAT --to 192.168.0.1
iptables -t nat -A PREROUTING -p tcp --dport 3000:3200 -i ${WAN} -j DNAT --to 192.168.0.1
iptables -t nat -A PREROUTING -p tcp --dport 3000:3200 -i ${LAN} -j DNAT --to 192.168.0.1
iptables -t nat -A PREROUTING -p tcp --dport 41739 -i ${WAN} -j DNAT --to 192.168.0.145
iptables -t nat -A PREROUTING -p udp --dport 27755 -i ${WAN} -j DNAT --to 192.168.0.145
iptables -t nat -A PREROUTING -p tcp --dport 4000 -i eth0 -j DNAT --to 192.168.0.1
iptables -t nat -A PREROUTING -p tcp --dport 4000 -i eth1 -j DNAT --to 192.168.0.1