# iptables rules for funky setup - vmware machines + checkpoint

# turn off ip forwarding
echo "0" > /proc/sys/net/ipv4/ip_forward

# flush + zero everything first
iptables -F
iptables -t nat -F
iptables -Z

# turn off ip forwarding
echo "1" > /proc/sys/net/ipv4/ip_forward

# variables
#LO_IFACE="lo"
#LO_IP="127.0.0.1"
#LAN_IP="192.168.0.2"
#LAN_IP_RANGE="192.168.0.0/16"
#LAN_IFACE="eth1"

# basic access rules
#iptables -P INPUT DROP
#iptables -P OUTPUT DROP
#iptables -P FORWARD DROP
iptables -A INPUT -p tcp --syn -j ACCEPT
iptables -A INPUT -p all -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -p all -j ACCEPT
iptables -A INPUT -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -A INPUT -p tcp -s 10.116.5.0/24 --dport 22 -j ACCEPT
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP

# masq rule
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# DNAT rules
# NAT for mtechdemo
iptables -t nat -A PREROUTING  -i eth0 -p tcp --dport 2200 -j DNAT --to 192.168.13.128:22
iptables -t nat -A PREROUTING  -i eth0 -p tcp --dport 25673 -j DNAT --to 192.168.13.128:25673
iptables -t nat -A PREROUTING  -i eth0 -p tcp --dport 23025 -j DNAT --to 192.168.13.128:23025
# NAT for Checkpoint VPN-1 router
iptables -t nat -A PREROUTING -i eth0 --source 146.109.240.0/24 -j DNAT --to 192.168.16.2
iptables -t nat -A PREROUTING -i eth0 --source 84.74.95.0/24  -j DNAT --to 192.168.16.2
iptables -t nat -A PREROUTING -i eth0 --source 150.101.122.0/24 -j DNAT --to 192.168.16.2


-- routing table --
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.16.0    *               255.255.255.252 U     0      0        0 eth1
172.16.16.0     *               255.255.255.0   U     0      0        0 eth0
192.168.13.0    *               255.255.255.0   U     0      0        0 vmnet1
169.254.0.0     *               255.255.0.0     U     0      0        0 eth1
default         172.16.16.254   0.0.0.0         UG    0      0        0 eth0