#!/bin/sh
# Copyright (C) 2006 OpenWrt.org

iptables -F input_rule
iptables -F output_rule
iptables -F forwarding_rule
iptables -t nat -F prerouting_rule
iptables -t nat -F postrouting_rule

# The following chains are for traffic directed at the IP of the 
# WAN interface

iptables -F input_wan
iptables -F forwarding_wan
iptables -t nat -F prerouting_wan

### allow ipsec traffic from your wan port to the router
iptables -A input_wan -p esp              -j ACCEPT # allow IPSEC
iptables -A input_wan -p udp --dport 500  -j ACCEPT # allow ISAKMP
iptables -A input_wan -p udp --dport 4500 -j ACCEPT # allow NAT-T

### disable nat for the remote peer subnet, in this example 192.168.2.0/24
iptables -t nat -A postrouting_rule -d 172.16.0.0/16 -j ACCEPT
iptables -t nat -A postrouting_rule -d 172.22.0.0/16 -j ACCEPT
iptables -t nat -A postrouting_rule -d 192.168.0.0/16 -j ACCEPT

### Allow any traffic between your local LAN and remote peer LAN
iptables -A forwarding_rule -i $LAN -o ipsec0 -j ACCEPT
iptables -A forwarding_rule -i ipsec0 -o $LAN -j ACCEPT
#iptables -A forwarding_rule -i ipsec0 -o $WAN -j ACCEPT
#iptables -A forwarding_rule -i $WAN -o ipsec0 -j ACCEPT

### Open port to WAN
## -- This allows port 22 to be answered by (dropbear on) the router
# iptables -t nat -A prerouting_wan -p tcp --dport 22 -j ACCEPT 
# iptables        -A input_wan      -p tcp --dport 22 -j ACCEPT

### SSH (Dropbear running on port 2020)
## SSH: Rules for new incoming connections on tcp-2020
iptables -t nat -A prerouting_wan -p tcp --dport 2020  -m state --state NEW \
  -m recent --name ATTACKER_SSH --rsource --update --seconds 60 --hitcount 10 -j DROP
iptables -t nat -A prerouting_wan -p tcp --dport 2020  -m state --state NEW \
  -m recent --name ATTACKER_SSH --rsource --set
## SSH
iptables        -A input_wan      -p tcp --dport 2020  -m state --state NEW -j ACCEPT

### Port forwarding
## -- This forwards port 8080 on the WAN to port 80 on 192.168.1.2
# iptables -t nat -A prerouting_wan -p tcp --dport 8080 -j DNAT --to 192.168.1.2:80
# iptables        -A forwarding_wan -p tcp --dport 80 -d 192.168.1.2 -j ACCEPT

### DMZ
## -- Connections to ports not handled above will be forwarded to 192.168.1.2
# iptables -t nat -A prerouting_wan -j DNAT --to 192.168.1.2
# iptables        -A forwarding_wan -d 192.168.1.2 -j ACCEPT

##Squid Redirect Port 80 to 3128
# iptables -t nat -A prerouting_rule -i $LAN -p tcp --dport 80 -j REDIRECT --to-port 3128

### Web Interface Access
## -- This allows Web Interface Access VIA WAN
iptables  -A input_rule -i $WAN -p tcp --dport 8088 -j ACCEPT

### Allow ICMP From LAN to WAN
iptables -A forwarding_rule -p ICMP -j ACCEPT

### Allow Ports From LAN to WAN
# iptables -A forwarding_rule -p TCP -i $LAN -s 192.168.250.104 -m multiport --dport 22,80,443 -j ACCEPT
iptables -A forwarding_rule -p TCP -i $LAN -o $WAN --dport 22,80,443 -j ACCEPT


### Block Ports From LAN to WAN
iptables -A forwarding_rule -j DROP