INTIF="eth1"
EXTIF="eth0"

# OpenVPN interface(s)
TAPIF="tap+"
BRGIF="br0"
echo "1" > /proc/sys/net/ipv4/ip_forward

# Clearing any existing rules and setting default policy
iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain

# Setup ip-forwarding and masquerading
iptables --table nat --append POSTROUTING --out-interface $EXTIF -j MASQUERADE
iptables --append FORWARD --in-interface $INTIF -j ACCEPT

# Setup firewall
iptables -A INPUT  -i lo -p all -j ACCEPT 
iptables -A OUTPUT -o lo -p all -j ACCEPT
iptables -A INPUT  -i $INTIF -p all -j ACCEPT
iptables -A OUTPUT -o $INTIF -p all -j ACCEPT

# FWD: Allow all connections OUT and only existing and related ones IN
iptables -A INPUT -i $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT 
iptables -A INPUT -p tcp --tcp-option ! 2 -j REJECT 

# Port specific firewall settings
iptables -A INPUT -p tcp -i $EXTIF --dport 21 -j ACCEPT 
iptables -A INPUT -p udp -i $EXTIF --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -i $EXTIF --dport 22 -j ACCEPT 
iptables -A INPUT -p udp -i $EXTIF --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -i $EXTIF --dport 80 -j ACCEPT 
iptables -A INPUT -p udp -i $EXTIF --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -i $EXTIF --dport 25 -j ACCEPT
iptables -A INPUT -p udp -i $EXTIF --dport 25 -j ACCEPT
##iptables -A INPUT -p udp -i $EXTIF --dport 1194 -j ACCEPT
iptables -A INPUT -p udp -i $INTIF --dport 1194 -j ACCEPT


# OpenVPN: Allow interface connections to OpenVPN server
iptables -A INPUT   -i $TAPIF -j ACCEPT
iptables -A INPUT   -i $BRGIF -j ACCEPT
iptables -A OUTPUT  -o $TAPIF -j ACCEPT
iptables -A OUTPUT  -o $BRGIF -j ACCEPT

# OpenVPN: Allow interface connections be forwarded through other interfaces
iptables -A FORWARD -i $TAPIF -j ACCEPT
iptables -A FORWARD -i $BRGIF -j ACCEPT

iptables -P INPUT DROP

echo -e "Proxy iptables load is complete."