#!/bin/sh
service iptables stop

iptables -P OUTPUT ACCEPT
#for CHAIN in INPUT FORWARD ; do
for CHAIN in INPUT ; do
    iptables -P $CHAIN DROP
done

iptables -A INPUT -i lo -j ACCEPT

for CHAIN in INPUT OUTPUT FORWARD ; do
    iptables -A $CHAIN -m state --state ESTABLISHED,RELATED -j ACCEPT
    iptables -A $CHAIN -m state --state INVALID -j LOG
    iptables -A $CHAIN -m state --state INVALID -j DROP
done

iptables -A INPUT -p tcp -s 10.0.0.0/24 --dport ssh -j ACCEPT
iptables -A INPUT -p tcp -s 10.0.0.0/24 --dport http -j ACCEPT
iptables -A INPUT -p tcp -s 10.0.0.0/24 --dport 3128 -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT

iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

service iptables save