#!/bin/sh
# Define as appropriate for your setup
# external interface (connected to the internet)
EXT_IF=eth0
# internal interface (connected to your local network)
INT_IF=eth1
# path to your iptables binary - leave this alone on slack
IPTABLES=/usr/sbin/iptables
# We don't want to just forward anything to anyone, or let everything
# into our local network
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F FORWARD
$IPTABLES -P FORWARD DROP
$IPTABLES -A INPUT -s 0/0 -d 0/0 -i lo -j ACCEPT
$IPTABLES -A INPUT -i $INT_IF -j ACCEPT
$IPTABLES -A FORWARD -i $INT_IF -o $EXT_IF -j ACCEPT
$IPTABLES -A FORWARD -i $EXT_IF -o $INT_IF -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -i $EXT_IF -p TCP --dport 22 -j ACCEPT
# Do the actual masquerading
$IPTABLES -t nat -F POSTROUTING
$IPTABLES -t nat -A POSTROUTING -o $EXT_IF -j MASQUERADE