#!/bin/bash
echo 1 > /proc/sys/net/ipv4/ip_forward
lan=eth0
wan=eth1

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X

iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT

# Creation des chaines personnalisees
iptables -N lan-wan
iptables -N lan-fw
iptables -N wan-fw
iptables -N wan-lan

# Redirection vers les chaines
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i $wan -j wan-fw
iptables -A INPUT -i $lan -j lan-fw
iptables -A FORWARD -i $lan -o $wan -j lan-wan
iptables -A FORWARD -i $wan -o $lan -j wan-lan

# Filtrage
iptables -A wan-lan -p tcp --dport 3389 -j ACCEPT
iptables -A wan-lan -p tcp --dport 21 -j ACCEPT
iptables -A wan-lan -p gre -j ACCEPT
iptables -A wan-lan -p tcp --dport 1723 -j ACCEPT
iptables -A wan-lan -p tcp --dport 4662 -j ACCEPT
iptables -A wan-lan -p udp --dport 4672 -j ACCEPT
iptables -A wan-lan -p tcp --dport 6881 -j ACCEPT
iptables -A wan-lan -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A wan-fw -p tcp --dport ssh -j ACCEPT

iptables -A wan-fw -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A lan-wan -p tcp --dport 3389 -j ACCEPT
iptables -A lan-wan -j ACCEPT

iptables -A lan-fw -p icmp -j ACCEPT
iptables -A lan-fw -p tcp --dport ssh -j ACCEPT

# Redirection de ports
iptables -t nat -A PREROUTING -i $wan -p tcp --dport 3389 -j DNAT --to-destination x.x.x.10
iptables -t nat -A PREROUTING -i $wan -p tcp --dport 3390 -j DNAT --to-destination x.x.x.18:3389
iptables -t nat -A PREROUTING -i $wan -p tcp --dport 21 -j DNAT --to-destination x.x.x.10
iptables -t nat -A PREROUTING -i $wan -p gre -j DNAT --to-destination x.x.x.2
iptables -t nat -A PREROUTING -i $wan -p tcp --dport 1723 -j DNAT --to-destination x.x.x.2
iptables -t nat -A PREROUTING -i $wan -p tcp --dport 4662 -j DNAT --to-destination x.x.x.10
iptables -t nat -A PREROUTING -i $wan -p udp --dport 4672 -j DNAT --to-destination x.x.x.10
iptables -t nat -A PREROUTING -i $wan -p tcp --dport 6881 -j DNAT --to-destination x.x.x.10

# Masquerade
iptables -t nat -A POSTROUTING -o $wan -j MASQUERADE