#!/bin/sh
# Begin /etc/rc.d/nat

EXT="eth0"
INT="eth1"
EXTIP="206.193.194.3"

WEBSERVER="192.168.1.251"

case $1 in
start)

        # Forwording
        echo "1" > /proc/sys/net/ipv4/ip_forward
        # Allow outgoing connections
#       /usr/sbin/iptables -A FORWARD -i $EXT -o $INT -m state --state ESTABLISHED,RELATED -j ACCEPT
        /usr/sbin/iptables -A FORWARD -i $INT -o $EXT -j ACCEPT
        /usr/sbin/iptables -A FORWARD -j LOG

        # Allow ssh to local box
        /usr/sbin/iptables -A INPUT -i $EXT -m state --state ESTABLISHED,RELATED -j ACCEPT
        /usr/sbin/iptables -A INPUT -i $EXT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

        # Allow 8080
        /usr/sbin/iptables -A INPUT -i $EXT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
        /usr/sbin/iptables -A INPUT -i $INT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
        # Port forwarding (testing)
#       /usr/sbin/iptables -t nat -A PREROUTING -p tcp -i $EXT -d 192.168.12.1 --dport 80 -j DNAT --to 192.168.12.180:80
#       /usr/sbin/iptables -A FORWARD -p tcp -i $EXT -d 192.168.12.180 --dport 80 -s 192.168.15.5 -j ACCEPT

        # Forwarding 
        # port 9800 (webdav)
        /usr/sbin/iptables -t nat -A PREROUTING -p tcp -i $EXT -d $EXTIP --dport 9800 -j DNAT --to 192.168.1.240:9800
        /usr/sbin/iptables -A FORWARD -p tcp -i $EXT -d 192.168.1.240 --dport 9800 -j ACCEPT
        # port 3389 (rdp)
        /usr/sbin/iptables -t nat -A PREROUTING -p tcp -i $EXT -d $EXTIP --dport 3389 -j DNAT --to 192.168.1.240:3389
        /usr/sbin/iptables -A FORWARD -p tcp -i $EXT -d 192.168.1.240 --dport 3389 -j ACCEPT
        # port 80 (http)
        /usr/sbin/iptables -t nat -A PREROUTING -p tcp -i $EXT -d $EXTIP --dport 80 -j DNAT --to $WEBSERVER:80
        /usr/sbin/iptables -A FORWARD -p tcp -i $EXT -d $WEBSERVER --dport 80 -j ACCEPT


        # Begin masquerade
        /usr/sbin/iptables -t nat -A POSTROUTING -o $EXT -j MASQUERADE

        ;;
stop)
        # Clear policies
        /usr/sbin/iptables -P INPUT ACCEPT
        /usr/sbin/iptables -F INPUT
        /usr/sbin/iptables -P OUTPUT ACCEPT
        /usr/sbin/iptables -F OUTPUT
        /usr/sbin/iptables -P FORWARD DROP
        /usr/sbin/iptables -F FORWARD
        /usr/sbin/iptables -t nat -F
        ;;
restart)
        $0 stop
        $0 start
        ;;
*)
        echo "usage: $0 [start|stop|restart]"
        ;;
esac

# End of file


and iptables -L

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:webcache 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:webcache 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
LOG        all  --  anywhere             anywhere            LOG level warning 
ACCEPT     tcp  --  anywhere             192.168.1.240       tcp dpt:9800 
ACCEPT     tcp  --  anywhere             192.168.1.240       tcp dpt:3389 
ACCEPT     tcp  --  anywhere             192.168.1.251       tcp dpt:http 
ACCEPT     tcp  --  anywhere             192.168.1.251       tcp dpt:http 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination