#!/bin/bash
IPTABLES='/sbin/iptables'

# Set interface values
IFACE1='eth0'
IFACE2='eth1'

# enable ip forwarding in the kernel
/bin/echo 1 > /proc/sys/net/ipv4/ip_forward

# flush rules and delete chains
$IPTABLES -F
$IPTABLES -X

## loopback interface
IPTABLES -A INPUT -i lo -j ACCEPT
IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
IPTABLES -A OUTPUT -o lo -j ACCEPT

# enable masquerading to allow LAN internet access
$IPTABLES -t nat -A POSTROUTING -o $IFACE1 -j MASQUERADE

## forward LAN traffic from $IFACE1 to Internet interface $IFACE2
IPTABLES -A FORWARD -i $IFACE2 -o $IFACE1 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
IPTABLES -A FORWARD -i $IFACE2 -m state --state INVALID -j DROP
echo -e " - Allowing access to the SSH server"
IPTABLES -A INPUT --protocol tcp --dport 22 -j ACCEPT
IPTABLES -A PREROUTING -p tcp -d 192.168.1.251 --dport 22 -j DNAT --to-destination 192.168.10.10
echo -e " - Allowing access to the HTTP server"
IPTABLES -A INPUT --protocol tcp --dport 80 -j ACCEPT
IPTABLES -A PREROUTING -p tcp -d 192.168.1.251 --dport 80 -j DNAT --to-destination 192.168.10.10

##forward LAN traffic from $IFACE2 to Internet $IFACE1
$IPTABLES -A FORWARD -i $IFACE2 -o $IFACE1 -m state --state NEW,ESTABLISHED -j ACCEPT

## block out all other Internet access on $IFACE1
$IPTABLES -A INPUT -i $IFACE1 -m state --state NEW,INVALID -j DROP
$IPTABLES -A FORWARD -i $IFACE1 -m state --state NEW,INVALID -j DROP