*filter 
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:RH-Lokkit-0-50-INPUT - [0:0]
:OUTPUT ACCEPT [0:0]

-A INPUT -j RH-Lokkit-0-50-INPUT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 53   -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 4661 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 53   -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 4672 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2425 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2627 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 25   -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 110  -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 80   -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 22   -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 21   -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 443  -j ACCEPT

-A RH-Lokkit-0-50-INPUT -i lo   -j ACCEPT
-A RH-Lokkit-0-50-INPUT -i eth1 -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -p icmp --icmp-type echo-request   -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -i eth1 -p tcp -m tcp --dport 110  -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -s eth0 -p tcp  --dport 143  -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -i eth1 -p tcp -m tcp --dport 8080 -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -i eth1 -p tcp -m tcp --dport 1234 -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -i eth1 -p udp -m udp --dport 8080 -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -i eth1 -p udp -m udp --dport 1234 -j ACCEPT
#-A INPUT -p tcp -m state --state RELATED -j ACCEPT
-A INPUT -p tcp -m state --state NEW,INVALID -j DROP

COMMIT

*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT

*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
###################################
# http to bedef.cl

-A POSTROUTING -s 192.168.1.0/255.255.255.0 -j MASQUERADE


-A PREROUTING -p tcp  -d 203.54.49.50 -i eth0 --dport 80  -j DNAT  --to 192.168.1.15:80

-A PREROUTING -i eth0 -p tcp -d 203.54.49.50 --dport 110  -j DNAT  --to 192.168.1.14:110

-A PREROUTING -p tcp  -d 203.54.49.50 -i eth0 --dport 22  -j DNAT  --to 192.168.1.15:22

-A PREROUTING -p tcp  -d 203.54.49.51 -i eth0 --dport 2121  -j DNAT  --to 192.168.1.14:2121

#Desde aqui parte los nateos hacia el servidor Debian o otro server con ip.24
#aqui hay un preruteo de la .50 con el puerto 2222 y va al server debian ssh

-A PREROUTING -p tcp -d 203.54.49.50 -i eth0 --dport 2222 -j DNAT --to 192.168.1.24:22

-A PREROUTING -p tcp -d 203.54.49.52 -i eth0 --dport 80 -j DNAT --to 192.168.1.24:80

-A PREROUTING -p tcp -d 203.54.49.52 -i eth0 --dport 53 -j DNAT --to 192.168.1.24:53

#aqui termina el 24
-A PREROUTING -p tcp  -d 203.54.49.50 -i eth0 --dport 443 -j DNAT  --to 192.168.1.15:443

-A PREROUTING -p tcp  -d 203.54.49.51 -i eth0 --dport 80 -j DNAT  --to 192.168.1.14:80

-A PREROUTING -p tcp  -d 203.54.49.51 -i eth0 --dport 2627 -j DNAT  --to 192.168.1.14:2627

-A PREROUTING -p tcp  -d 203.54.49.50 -i eth0 --dport 2627 -j DNAT  --to 192.168.1.14:2627

-A PREROUTING -p tcp  -d 203.54.49.51 -i eth0 --dport 443 -j DNAT  --to 192.168.1.14:443

-A PREROUTING -p tcp  -d 203.54.49.51 -i eth0 --dport 25 -j DNAT  --to 192.168.1.14:25


# Servers allow all
 -A POSTROUTING -s 192.168.1.1/255.255.255.0   -d 0.0.0.0/0 -j MASQUERADE
 -A POSTROUTING -s 192.168.1.2/255.255.255.0   -d 0.0.0.0/0 -j MASQUERADE
 -A POSTROUTING -s 192.168.1.3/255.255.255.0   -d 0.0.0.0/0 -j MASQUERADE
 -A POSTROUTING -s 192.168.1.4/255.255.255.0   -d 0.0.0.0/0 -j MASQUERADE
 -A POSTROUTING -s 192.168.1.5/255.255.255.0   -d 0.0.0.0/0 -j MASQUERADE
 -A POSTROUTING -s 192.168.1.6/255.255.255.0   -d 0.0.0.0/0 -j MASQUERADE
 -A POSTROUTING -s 192.168.1.7/255.255.255.0   -d 0.0.0.0/0 -j MASQUERADE
 -A POSTROUTING -s 192.168.1.8/255.255.255.0   -d 0.0.0.0/0 -j MASQUERADE
 -A POSTROUTING -s 192.168.1.14/255.255.255.0   -d 0.0.0.0/0 -j MASQUERADE
 -A POSTROUTING -s 192.168.1.15/255.255.255.0   -d 0.0.0.0/0 -j MASQUERADE  
-A POSTROUTING -s 192.168.1.24/255.255.255.0   -d 0.0.0.0/0 -j MASQUERADE


# ########################################################################
# Users, only http and https





-A POSTROUTING -s 192.168.1.21/255.255.255.0 -p tcp -m tcp --dport 80 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.22/255.255.255.0 -p tcp -m tcp --dport 80 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.23/255.255.255.0 -p tcp -m tcp --dport 80 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.25/255.255.255.0 -p tcp -m tcp --dport 80 -d 0.0.0.0/0 -j MASQUERADE

###### HTTPS

-A POSTROUTING -s 192.168.1.21/255.255.255.0 -p tcp -m tcp --dport 443 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.22/255.255.255.0 -p tcp -m tcp --dport 443 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.23/255.255.255.0 -p tcp -m tcp --dport 443 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.25/255.255.255.0 -p tcp -m tcp --dport 443 -d 0.0.0.0/0 -j MASQUERADE

###############################################################################

# Forward HTTP connections to Squid proxy
#-A PREROUTING -p tcp -m tcp -i eth0 --dport 80 -j REDIRECT --to-ports 3128
#-A PREROUTING -p udp -m udp -i eth0 --dport 53 -j DNAT --to 192.168.1.2
#-A PREROUTING -p tcp -m tcp -i eth0 --dport 53 -j DNAT --to 192.168.1.2
COMMIT
# Completed