### NEW ###
modprobe nf_nat_irc
### NEW-END ###

iptables -F
iptables -t nat -F

# Setup default policies to handle unmatched traffic                                                                                 
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP                                                                                                         
# Copy and paste these examples ...                                                                                                  
export LAN=eth0
export WAN=eth1

# Then we lock our services so they only work from the LAN                                                                           

### NEW ###
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i $LAN -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
### NEW-END ###

iptables -A INPUT -p udp --dport bootps -i ! $LAN -j REJECT
iptables -A INPUT -p udp --dport domain -i ! $LAN -j REJECT

# (Optional) Allow access to our ssh server from the WAN                                                                             
iptables -A INPUT -p tcp --dport ssh -i $WAN -j ACCEPT

# Drop TCP / UDP packets to privileged ports
iptables -A INPUT -p tcp -i ! $LAN -d 0/0 --dport 0:1023 -j DROP
iptables -A INPUT -p udp -i ! $LAN -d 0/0 --dport 0:1023 -j DROP

# Finally we add the rules for NAT
### NEW ###
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
### NEW-END ###
iptables -A FORWARD -i $LAN -d 192.168.0.0/255.255.0.0 -j DROP
iptables -A FORWARD -i $LAN -s 192.168.0.0/255.255.0.0 -j ACCEPT
iptables -A FORWARD -i $WAN -d 192.168.0.0/255.255.0.0 -j ACCEPT 
iptables -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE

# HTTP
iptables -t nat -A PREROUTING -p tcp --dport 80 -i ${WAN} -j DNAT --to 192.168.10.2

# VNC forwarding for internal hosts
iptables -t nat -I PREROUTING -p tcp --dport 5900 -i ${WAN} -j DNAT --to 192.168.10.10

### REMOVE THIS ###
# DCC forwarding to an internal host 
iptables -t nat -A PREROUTING -p tcp --dport 5000:5005 -i ${WAN} -j DNAT --to 192.168.10.10
iptables -A INPUT -p tcp -m state --state NEW --dport 5000:5005 -i ${WAN} -j ACCEPT
### REMOVE-END ###

# Azureus forwarding
iptables -t nat -A PREROUTING -p tcp --dport 60218 -i ${WAN} -j DNAT --to 192.168.10.10