ROUTER A


#!/bin/sh
# Copyright (C) 2006 OpenWrt.org

iptables -F input_rule
iptables -F output_rule
iptables -F forwarding_rule
iptables -t nat -F prerouting_rule
iptables -t nat -F postrouting_rule
#iptables -F
#iptables -P INPUT DROP
#iptables -A INPUT -i lo -j ACCEPT

# The following chains are for traffic directed at the IP of the 
# WAN interface

iptables -F input_wan
iptables -F forwarding_wan
iptables -t nat -F prerouting_wan

### allow ipsec traffic from your wan port to the router
iptables -A input_wan -p esp              -j ACCEPT # allow IPSEC
iptables -A input_wan -p udp --dport 500  -j ACCEPT # allow ISAKMP
iptables -A input_wan -p udp --dport 4500 -j ACCEPT # allow NAT-T

### disable nat for the remote peer subnet, in this example 192.168.2.0/24
iptables -t nat -A postrouting_rule -d 172.16.0.0/16 -j ACCEPT
iptables -t nat -A postrouting_rule -d 172.22.0.0/16 -j ACCEPT
iptables -t nat -A postrouting_rule -d 192.168.0.0/16 -j ACCEPT

### Allow any traffic between your local LAN and remote peer LAN
iptables -A forwarding_rule -i $LAN -o ipsec0 -j ACCEPT
iptables -A forwarding_rule -i ipsec0 -o $LAN -j ACCEPT

### Open port to WAN
## -- This allows port 22 to be answered by (dropbear on) the router
#iptables -t nat -A prerouting_wan -p tcp --dport 22 -j ACCEPT 
#iptables        -A input_wan      -p tcp --dport 22 -j ACCEPT

### SSH (Dropbear running on port 22)
## SSH: Rules for new incoming connections on tcp-22
iptables -t nat -A prerouting_wan -p tcp --dport 22  -m state --state NEW \
  -m recent --name ATTACKER_SSH --rsource --update --seconds 60 --hitcount 5 -j DROP
iptables -t nat -A prerouting_wan -p tcp --dport 22  -m state --state NEW \
  -m recent --name ATTACKER_SSH --rsource --set
## SSH
iptables        -A input_wan      -p tcp --dport 22  -m state --state NEW -j ACCEPT

### Port forwarding
## -- This forwards port 8080 on the WAN to port 80 on 192.168.1.2
# iptables -t nat -A prerouting_wan -p tcp --dport 8080 -j DNAT --to 192.168.1.2:80
# iptables        -A forwarding_wan -p tcp --dport 80 -d 192.168.1.2 -j ACCEPT

### DMZ
## -- Connections to ports not handled above will be forwarded to 192.168.1.2
# iptables -t nat -A prerouting_wan -j DNAT --to 192.168.1.2
# iptables        -A forwarding_wan -d 192.168.1.2 -j ACCEPT

##Squid Redirect Port 80 to 3128
#iptables -t nat -A prerouting_rule -i $LAN -p tcp --dport 80 -j REDIRECT --to-port 3128

### Web Interface Access
## -- This allows Web Interface Access VIA WAN
iptables  -A input_rule -i $WAN -p tcp --dport 8088 -j ACCEPT

### Block Ports From LAN to WAN
#ip-range is not an avlaible option yet, so add one for every computer
#iptables -A forwarding_rule -p TCP -i $LAN -s 192.168.1.2 -m multiport --dport 8088,21 -j DROP
#iptables -A forwarding_rule -p TCP -i $LAN -s 192.168.1.3 -m multiport --dport 8088,21 -j DROP
#iptables -A forwarding_rule -p TCP -i $LAN -s 192.168.1.4 -m multiport --dport 8088,21 -j DROP
#iptables -A forwarding_rule -p TCP -i $LAN -s 192.168.1.5 -m multiport --dport 8088,21 -j DROP
#iptables -A forwarding_rule -p TCP -i $LAN -s 192.168.1.6 -m multiport --dport 8088,21 -j DROP
#iptables -A forwarding_rule -p TCP -i $LAN -s 192.168.1.7 -m multiport --dport 8088,21 -j DROP
#iptables -A forwarding_rule -p TCP -i $LAN -s 192.168.1.8 -m multiport --dport 8088,21 -j DROP

#iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#iptables -A FORWARD -i ipsec0 -j ACCEPT; iptables -A FORWARD -o ipsec0 -j ACCEPT



ROUTER B



#!/bin/sh
# Copyright (C) 2006 OpenWrt.org

iptables -F input_rule
iptables -F output_rule
iptables -F forwarding_rule
iptables -t nat -F prerouting_rule
iptables -t nat -F postrouting_rule
#iptables -F
#iptables -P INPUT DROP
#iptables -A INPUT -i lo -j ACCEPT

# The following chains are for traffic directed at the IP of the 
# WAN interface

iptables -F input_wan
iptables -F forwarding_wan
iptables -t nat -F prerouting_wan

### allow ipsec traffic from your wan port to the router
iptables -A input_wan -p esp              -j ACCEPT # allow IPSEC
iptables -A input_wan -p udp --dport 500  -j ACCEPT # allow ISAKMP
iptables -A input_wan -p udp --dport 4500 -j ACCEPT # allow NAT-T

### disable nat for the remote peer subnet, in this example 192.168.2.0/24
iptables -t nat -A postrouting_rule -d 172.16.0.0/16 -j ACCEPT
iptables -t nat -A postrouting_rule -d 172.22.0.0/16 -j ACCEPT
iptables -t nat -A postrouting_rule -d 192.168.0.0/16 -j ACCEPT

### Allow any traffic between your local LAN and remote peer LAN
iptables -A forwarding_rule -i $LAN -o ipsec0 -j ACCEPT
iptables -A forwarding_rule -i ipsec0 -o $LAN -j ACCEPT
#iptables -A forwarding_rule -i ipsec0 -o $WAN -j ACCEPT
#iptables -A forwarding_rule -i $WAN -o ipsec0 -j ACCEPT

### Open port to WAN
## -- This allows port 22 to be answered by (dropbear on) the router
#iptables -t nat -A prerouting_wan -p tcp --dport 22 -j ACCEPT 
#iptables        -A input_wan      -p tcp --dport 22 -j ACCEPT

### SSH (Dropbear running on port 22)
## SSH: Rules for new incoming connections on tcp-22
iptables -t nat -A prerouting_wan -p tcp --dport 22  -m state --state NEW \
  -m recent --name ATTACKER_SSH --rsource --update --seconds 60 --hitcount 10 -j DROP
iptables -t nat -A prerouting_wan -p tcp --dport 22  -m state --state NEW \
  -m recent --name ATTACKER_SSH --rsource --set
## SSH
iptables        -A input_wan      -p tcp --dport 22  -m state --state NEW -j ACCEPT

### Port forwarding
## -- This forwards port 8080 on the WAN to port 80 on 192.168.1.2
# iptables -t nat -A prerouting_wan -p tcp --dport 8080 -j DNAT --to 192.168.1.2:80
# iptables        -A forwarding_wan -p tcp --dport 80 -d 192.168.1.2 -j ACCEPT

### DMZ
## -- Connections to ports not handled above will be forwarded to 192.168.1.2
# iptables -t nat -A prerouting_wan -j DNAT --to 192.168.1.2
# iptables        -A forwarding_wan -d 192.168.1.2 -j ACCEPT

##Squid Redirect Port 80 to 3128
#iptables -t nat -A prerouting_rule -i $LAN -p tcp --dport 80 -j REDIRECT --to-port 3128

### Web Interface Access
## -- This allows Web Interface Access VIA WAN
iptables  -A input_rule -i $WAN -p tcp --dport 8088 -j ACCEPT

### Block Ports From LAN to WAN
#ip-range is not an avlaible option yet, so add one for every computer
#iptables -A forwarding_rule -p TCP -i $LAN -s 192.168.1.2 -m multiport --dport 8088,21 -j DROP
#iptables -A forwarding_rule -p TCP -i $LAN -s 192.168.1.3 -m multiport --dport 8088,21 -j DROP
#iptables -A forwarding_rule -p TCP -i $LAN -s 192.168.1.4 -m multiport --dport 8088,21 -j DROP
#iptables -A forwarding_rule -p TCP -i $LAN -s 192.168.1.5 -m multiport --dport 8088,21 -j DROP
#iptables -A forwarding_rule -p TCP -i $LAN -s 192.168.1.6 -m multiport --dport 8088,21 -j DROP
#iptables -A forwarding_rule -p TCP -i $LAN -s 192.168.1.7 -m multiport --dport 8088,21 -j DROP
#iptables -A forwarding_rule -p TCP -i $LAN -s 192.168.1.8 -m multiport --dport 8088,21 -j DROP

#iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#iptables -A FORWARD -i ipsec0 -j ACCEPT; iptables -A FORWARD -o ipsec0 -j ACCEPT

iptables -t nat -A POSTROUTING -s 172.16.55.0/24 -d 10.11.12.13-o eth0 -j MASQUERADE

iptables -t nat -A POSTROUTING -s 172.16.55.0/24 -d 20.21.22.23 -o eth0 -j MASQUERADE