#!/bin/sh
echo "Starting firewall"

wan_nic=eth0
lan_nic=eth1

# Forwarding off
echo 0 > /proc/sys/net/ipv4/ip_forward

# Load modules
modprobe ip_nat_ftp
modprobe ip_conntrack_ftp

# Flush old rules
iptables -t nat -F POSTROUTING
iptables -t nat -F PREROUTING
iptables -t nat -F OUTPUT
iptables -F


#Input rules
#These Ports should be allowed for incoming connections
INPUT(){
iptables -A INPUT -j ACCEPT -p tcp --dport $1 -s ! 192.168.0.0/24
}

INPUT 22

# Allow connections from LAN to all ports
iptables -A INPUT -s 192.168.0.0/24 -j ACCEPT


# Activate NAT for the LAN
/sbin/iptables -t nat -A POSTROUTING -o $wan_nic -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward


#PORTMAPPING
MAP(){
/sbin/iptables -t nat -A PREROUTING -p $3 -i $wan_nic --dport $1 -j DNAT --to-destination $2
echo "Mapped port $1($3) -> $2";
}
MAP 80 192.168.0.22:80 tcp

# Defaults for tables
iptables -P INPUT DROP
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

# Allow traffic ffrom LAN
iptables -A INPUT -i lo -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

echo "Firewall running"





***************************************************
Output of iptables -L

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     tcp  -- !192.168.0.0/24       anywhere            tcp dpt:ssh
ACCEPT     all  --  192.168.0.0/24       anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination


******************************************

Output of iptables -t nat -L PREROUTING

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       tcp  --  anywhere             anywhere            tcp dpt:www to:192.168.0.22:80