root@gw:/etc/rc.d# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.16.1.0      0.0.0.0         255.255.255.248 U     0      0        0 eth0
172.16.1.0      0.0.0.0         255.255.255.248 U     0      0        0 eth0
10.0.1.0        0.0.0.0         255.255.255.240 U     0      0        0 ath0
10.0.0.0        0.0.0.0         255.255.255.0   U     0      0        0 eth1.2
10.10.0.0       0.0.0.0         255.255.255.0   U     0      0        0 eth1.5
10.0.2.0        0.0.0.0         255.255.255.0   U     0      0        0 eth1.3
10.0.3.0        0.0.0.0         255.255.255.0   U     0      0        0 eth1.4
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         172.16.1.1      0.0.0.0         UG    0      0        0 eth0
root@gw:/etc/rc.d#


#!/bin/bash -x

iptables='/usr/local/sbin/iptables'

# safenet = where non-trusted boxes sit - do not trust on local network at all #
# lan = local area (safe) network #
# dmz = server network that cannot touch anything other than wan #
# alp = ayrshire lan party that cannot touch anything other than wan and dmz #
# wan = Internet Connectivity #
# wlan = Wireless network - Secured with WPA Enterprise #

# flush existing settings
$iptables -F
$iptables -X
$iptables -t nat -F

# drop all by default
$iptables -P INPUT DROP
$iptables -P OUTPUT DROP
$iptables -P FORWARD DROP

# interfaces
wanif="eth0"
wlanif="ath0"
lanif="eth1.2"
dmzif="eth1.3"
safeif="eth1.4"
alpif="eth1.5"

# networks
wannet=""
wlannet="10.0.1.0/24"
lannet="10.0.0.0/24"
dmznet="10.0.2.0/24"
safenet="10.0.3.0/24"
alpnet="10.10.0.0/24"

# ip(s)
lanip="10.0.0.1"
wlanip="10.0.1.1"
dmzip="10.0.2.1"
safeip="10.0.3.1"
alpip="10.10.0.1"

# nat
#natextip="217.151.109.185"
natextip="172.16.1.2"

# dns
nameserver1="217.151.98.2"
nameserver2="217.151.103.2"

# fix arp and conntrack limits
echo 16 > /proc/sys/net/ipv4/neigh/default/gc_thresh1
echo 256 > /proc/sys/net/ipv4/neigh/default/gc_thresh2
echo 2048 > /proc/sys/net/ipv4/neigh/default/gc_thresh3
echo 65000 > /proc/sys/net/ipv4/ip_conntrack_max



                                        ## WAN  ##

## [FORWARD] WAN --> LAN ##
$iptables -A FORWARD -i $wanif -o $lanif -d $lannet -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $wanif -o $lanif -d $lannet -p tcp --dport 32825 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $wanif -o $lanif -d $lannet -p tcp --dport 6346 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] WAN --> DMZ ##
$iptables -A FORWARD -i $wanif -o $dmzif -d $dmznet -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $wanif -o $dmzif -d $dmznet -p tcp --dport 6667 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $wanif -o $dmzif -d $dmznet -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $wanif -o $dmzif -d $dmznet -p tcp --dport 443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $wanif -o $dmzif -d $dmznet -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $wanif -o $dmzif -d $dmznet -p tcp --dport 993 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $wanif -o $dmzif -d $dmznet -p tcp --dport 995 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] WAN --> WLAN ##
$iptables -A FORWARD -i $wanif -o $wlanif -d $wlannet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] WAN --> SAFENET ##
$iptables -A FORWARD -i $wanif -o $safeif -d $safenet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] WAN --> ALP ##
$iptables -A FORWARD -i $wanif -o $alpif -d $alpnet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [NAT] WAN --> LAN ##
$iptables -t nat -A PREROUTING -i $wanif -p tcp -d $natextip --dport 32825 -j DNAT --to-destination 10.0.0.2
$iptables -t nat -A PREROUTING -i $wanif -p tcp -d $natextip --dport 6346 -j DNAT --to-destination 10.0.0.2

## [NAT] WAN --> DMZ ##

# iptables -t nat -A PREROUTING -p tcp -d $natextip --dport 995 -j DNAT --to-destination 10.0.2.10

                                        ## LAN ##


## [INPUT] LAN --> GATEWAY ##
$iptables -A INPUT -i $lanif -s $lannet -p tcp -d $lanip --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [OUTPUT] GATEWAY --> LAN ##
$iptables -A OUTPUT -o $lanif -s $lanip -d $lannet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] LAN --> DMZ ##
$iptables -A FORWARD -i $lanif -o $dmzif -s $lannet -d $dmznet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] LAN --> WLAN ##
$iptables -A FORWARD -i $lanif -o $wlanif -s $lannet -d $wlannet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] LAN --> ALP ##
$iptables -A FORWARD -i $lanif -o $alpif -s $lannet -d $alpnet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] LAN --> WAN ##
$iptables -A FORWARD -i $lanif -o $wanif -s $lannet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [NAT] LAN --> INTERNET ##
$iptables -t nat -A POSTROUTING -o $wanif -s $lannet -j SNAT --to $natextip


                                        ## DMZ ##
## [FORWARD] DMZ --> LAN ##
$iptables -A FORWARD -i $dmzif -o $lanif -s $dmznet -d $lannet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] DMZ --> WLAN ##
$iptables -A FORWARD -i $dmzif -o $wlanif -s $dmznet -d $wlannet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] DMZ --> ALP ##
$iptables -A FORWARD -i $dmzif -o $alpif -s $dmznet -d $alpnet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] DMZ --> WAN ##
$iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p udp -d $nameserver1 --dport 53 -m state --state NEW,ESTABLISHED,RELATE$
$iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p udp -d $nameserver2 --dport 53 -m state --state NEW,ESTABLISHED,RELATE$
$iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 20 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 6667 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [NAT] DMZ --> INTERNET ##
$iptables -t nat -A POSTROUTING -o $wanif -s $dmznet -j SNAT --to $natextip

                                        ## WLAN ##

## [FORWARD] WLAN --> LAN ##
$iptables -A FORWARD -i $wlanif -o $lanif -s $wlannet -d $lannet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] WLAN --> DMZ ##
$iptables -A FORWARD -i $wlanif -o $dmzif -s $wlannet -d $dmznet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] WLAN --> ALP ##
$iptables -A FORWARD -i $wlanif -o $alpif -s $wlannet -d $alpnet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] WLAN --> WAN ##
$iptables -A FORWARD -i $wlanif -o $wanif -s $wlannet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [NAT] WLAN --> INTERNET ##
$iptables -t nat -A POSTROUTING -o $wanif -s $wlannet -j SNAT --to $natextip

                                        ## SAFENET ##

## [FORWARD] SAFENET --> WAN ##
$iptables -A FORWARD -i $safeif -o $wanif -s $safenet -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $safeif -o $wanif -s $safenet -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $dmzif -o $wanif -s $safenet -p udp -d $nameserver1 --dport 53 -m state --state NEW,ESTABLISHED,RELAT$
$iptables -A FORWARD -i $dmzif -o $wanif -s $safenet -p udp -d $nameserver2 --dport 53 -m state --state NEW,ESTABLISHED,RELAT$

## [NAT] SAFENET --> INTERNET ##
$iptables -t nat -A POSTROUTING -o $wanif -s $safenet -j SNAT --to $natextip

                                        ## ALP ##
## [FORWARD] ALP --> LAN ##
$iptables -A FORWARD -i $alpif -o $lanif -s $alpnet -d $lannet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] ALP --> DMZ ##
$iptables -A FORWARD -i $alpif -o $dmzif -s $alpnet -d $dmznet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] ALP --> WLAN ##
$iptables -A FORWARD -i $alpif -o $wlanif -s $alpnet -d $wlannet -m state --state ESTABLISHED,RELATED -j ACCEPT

## [FORWARD] ALP --> WAN ##
$iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p tcp --dport 20 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p udp -d $nameserver1 --dport 53 -m state --state NEW,ESTABLISHED,RELATED
$iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p udp -d $nameserver2 --dport 53 -m state --state NEW,ESTABLISHED,RELATED

# temp #
$iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## [NAT] ALP --> INTERNET ##
$iptables -t nat -A POSTROUTING -o $wanif -s $alpnet -j SNAT --to $natextip