#somewhat very basic iptables stuff
#by xbow in 2k7
#comments and suggestions welcome
#reach me at freenode #vmware, #linux
#use what you need of it
#no warranty whatsoever

#some vars
IPTABLES="/sbin/iptables"
EXTIF="eth0"
INTIF="vmnetx" # <- place your vmnet device here, but you can also comment out the corresponding -i $INTIF or -o $INTIF directive within the rules further below

#specify ip of the internal client
$INTCL="192.168.140.128"

#ports to be forwarded
NATPORTS="5900" #<-- specify here which ports you need on your client to be accessable from the internet..here port for vnc

#flush all tables (which means reset all rules)
$IPTABLES -F
$IPTABLES -t nat -F

#delete chains (get recreated on first use)
$IPTABLES -X
$IPTABLES -t nat -X

#set policies 
$IPTABLES -P INPUT DROP # (DENY all incoming connections other than allowed by rules below)
$IPTABLES -P OUTPUT DROP # (this is very restrictive and you would have to explicitly allow any port for OUTGOING as well..default is ACCEPT, I prefer DROP and specify which ports to let out
$IPTABLES -P FORWARD ACCEPT # allow packet forwarding

#be sure ip forwarding is enabled on the router
echo "1" > /proc/sys/net/ipv4/ip_forward

#conntrack to keep track of connections..needed for passive ftp i.e.
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc

#loading nat modules
/sbin/modprobe iptable_nat
/sbin/modprobe ip_nat_ftp

##above modules could have also been already compiled into your kernel..modprobing won't hurt

#accept any connection incoming and outgoing to one having already been established or in any way related to 
$IPTABLES -A INPUT -p all -i $EXTIF -m state --state established,related -j ACCEPT
$IPTABLES -A OUTPUT -p all -o $EXTIF -m state --state established,related -j ACCEPT

#let ports to be forwarded pass in at first, also let those back out again
for PROTO in tcp udp; do
  for PORT in $NATPORTS; do
  $IPTABLES -A INPUT -p $PROTO -m $PROTO -i $EXTIF --dport $PORT --sport 1024:65535 -j ACCEPT
  $IPTABLES -A OUTPUT -p $PROTO -m $PROTO -o $EXTIF --sport $PORT --dport 1024:65535 -m state --state new,established,related -j ACCEPT
  done;
done;

#nat/port forwarding
for PROTO in tcp udp; do
  for PORT in $NATPORTS; do
    $IPTABLES -t nat -A PREROUTING -p $PROTO -i $EXTIF --dport $PORT --sport 1024:65535 -j DNAT --to-destination $INTCL
    $IPTABLES -A FORWARD -p $PROTO -i $EXTIF -o $INTIF -d $INTCL --dport $PORT --sport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
  done;
done;