echo -n "Setting up IP forwarding and IP masquerading (iptables): "

# External Interface, MAC address -> 00:11:11:27:76:62
EXTIF="eth0"

# Internal Interface, MAC address -> 00:0C:41:F1:6D:06
INTIF="eth1"

# OpenVPN TAP and Bridge interface(s)
TAPIF="tap+"
BRGIF="br0"

# Enable routing
echo 1 > /proc/sys/net/ipv4/ip_forward

# Clearing any existing rules and setting default policy
iptables --flush
iptables --table nat --flush
iptables --table nat --delete-chain
iptables --delete-chain

# Default policy if packet falls off chain is to drop
iptables -P INPUT   DROP
iptables -P FORWARD DROP

# Always accept loopback traffic
iptables -A INPUT  -i lo -j ACCEPT

# Allow established connections, and those not coming from the outside
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! $EXTIF -j ACCEPT

# Masquerade
iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

# Port specific firewall settings
iptables -A INPUT -p tcp -i $EXTIF --dport 21 -j ACCEPT 
iptables -A INPUT -p udp -i $EXTIF --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -i $EXTIF --dport 22 -j ACCEPT 
iptables -A INPUT -p udp -i $EXTIF --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -i $EXTIF --dport 80 -j ACCEPT 
iptables -A INPUT -p udp -i $EXTIF --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -i $EXTIF --dport 25 -j ACCEPT
iptables -A INPUT -p udp -i $EXTIF --dport 25 -j ACCEPT
iptables -A INPUT -p udp -i $EXTIF --dport 1194 -j ACCEPT
iptables -A INPUT -p tcp --syn -s 10.0.0.0/24 --destination-port 139 -j ACCEPT 

# OpenVPN: Allow interface connections to OpenVPN server
iptables -A INPUT -i $TAPIF -j ACCEPT
iptables -A INPUT -i $BRGIF -j ACCEPT

# Allow established connections
iptables -A FORWARD -i $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow outgoing connections from the LAN side
iptables -A FORWARD -o $EXTIF -j ACCEPT

# OpenVPN: Allow interface connections be forwarded through other interfaces
iptables -A FORWARD -i $TAPIF -j ACCEPT
iptables -A FORWARD -i $BRGIF -j ACCEPT

# Don't forward from the outside to the inside
iptables -A FORWARD -i $EXTIF -j REJECT

echo "done."