#!/bin/bash
export WAN=ethx
export LAN=ethx

echo -e "-- Flushing current rules..."
/sbin/iptables -F
/sbin/iptables -t nat -F
/sbin/iptables -t mangle -F

echo -e "-- Setting up new rules..."
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P OUTPUT ACCEPT

/sbin/iptables -I INPUT x -i ${LAN}  -j ACCEPT
/sbin/iptables -I INPUT x -i lo -j ACCEPT
/sbin/iptables -A INPUT -p UDP --dport bootps -i ! ${LAN}  -j REJECT
/sbin/iptables -A INPUT -p UDP --dport domain -i ! ${LAN} -j REJECT

###### Open Port per IP
/sbin/iptables -A INPUT -p TCP --dport ssh -s x.x.x.x -i ${WAN} -j ACCEPT
#/sbin/iptables -A INPUT -p TCP --dport smtp -s x.x.x.x -i ${WAN} -j ACCEPT

###### Block based on IP
#/sbin/iptables -A OUTPUT -s x.x.x.x -j DROP
#/sbin/iptables -A INPUT -d x.x.x.x -i ${WAN} -j DROP

#/sbin/iptables -A OUTPUT -s x.x.x.x -j DROP
#/sbin/iptables -A INPUT -d x.x.x.x -i ${WAN} -j DROP


###### drop EVERYTHING to privileged ports
/sbin/iptables -A INPUT -p TCP -i ! ${LAN} -d x/x --dport x:x -j DROP
/sbin/iptables -A INPUT -p TCP -i ! ${LAN} -d x/x --dport x:x -j DROP

###### Port (default) forwarding/masquerading
/sbin/iptables -I FORWARD -i ${LAN} -d x.x.x.x/x.x.x.x -j DROP
/sbin/iptables -A FORWARD -i ${LAN} -s x.x.x.x/x.x.x.x -j ACCEPT
/sbin/iptables -A FORWARD -i ${WAN}  -d x.x.x.x/x.x.x.x -j ACCEPT
/sbin/iptables -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE
#/sbin/iptables -A FORWARD -i ${WAN} --ctstate ESTABLISHED,RELATED -j ACCEPT

###### Port (extra) forwarding

#/sbin/iptables -t nat -A PREROUTING -p TCP --dport x -i ${WAN} -j DNAT --to x.x.x.x:x

# rdp and vnc
/sbin/iptables -t nat -A PREROUTING -p TCP -s x.x.x.x --dport x -i ${WAN} -j DNAT --to x.x.x.x:x
#/sbin/iptables -t nat -A PREROUTING -p TCP --dport x -i ${WAN} -j DNAT --to x.x.x.x:x


# bittorrent
#/sbin/iptables -t nat -A PREROUTING -p TCP --dport x -i ${WAN} -j DNAT --to x.x.x.x:x
#/sbin/iptables -t nat -A PREROUTING -p UDP --dport x -i ${WAN} -j DNAT --to x.x.x.x:x
#/sbin/iptables -t nat -A PREROUTING -p TCP --dport x -i ${WAN} -j DNAT --to x.x.x.x:x
#/sbin/iptables -t nat -A PREROUTING -p TCP --dport x:x -i ${WAN} -j DNAT --to x.x.x.x:x-x
#/sbin/iptables -t nat -A PREROUTING -p UDP --dport x:x -i ${WAN} -j DNAT --to x.x.x.x:x-x
/sbin/iptables -t nat -A PREROUTING -p TCP --dport x -i ${WAN} -j DNAT --to x.x.x.x:x
/sbin/iptables -t nat -A PREROUTING -p UDP --dport x -i ${WAN} -j DNAT --to x.x.x.x:x

# bittorrent (alt port)
/sbin/iptables -t nat -A PREROUTING -p TCP --dport x -i ${WAN} -j DNAT --to x.x.x.x:x
/sbin/iptables -t nat -A PREROUTING -p UDP --dport x -i ${WAN} -j DNAT --to x.x.x.x:x

/sbin/iptables -t nat -A PREROUTING -p TCP --dport x -i ${WAN} -j DNAT --to x.x.x.x:x
/sbin/iptables -t nat -A PREROUTING -p UDP --dport x -i ${WAN} -j DNAT --to x.x.x.x:x

/sbin/iptables -t nat -A PREROUTING -p TCP --dport x -i ${WAN} -j DNAT --to x.x.x.x:x
/sbin/iptables -t nat -A PREROUTING -p UDP --dport x -i ${WAN} -j DNAT --to x.x.x.x:x
# ident
/sbin/iptables -A INPUT -p TCP --dport x -j ACCEPT

# smtp
#/sbin/iptables -A INPUT -p TCP --dport x -j ACCEPT

# ventrilo
/sbin/iptables -A INPUT -p TCP --dport x -j ACCEPT

/etc/init.d/iptables save