#Add the Iptables masquerade module(s)
 modprobe ipt_MASQUERADE

#  Flush out the current iptables filter table rules.
iptables -F;
iptables -t nat -F;
iptables -t mangle -F;

# filter table.  contains the built-in chains
#               INPUT (for packets coming into the box itself),
#               FORWARD (for packets being routed through the box),
#               OUTPUT (for locally-generated packets).
# In the NAT table. Append to the POSTROUTING chain, a rule that on output to interface eth1
# performs an action to ? map the source ip address of the outgoing
# packet to be the ip address of the interface it is going out on, eg -
# make it look like it originated on eth1.
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

# turn on ip forwarding. (yes, this is an obscure control.)
echo 1 > /proc/sys/net/ipv4/ip_forward
# turn off ignoring icmp requests
echo 0 >/proc/sys/net/ipv4/icmp_echo_ignore_all
#

# Block spoofed (should only be local) addresses
iptables -A INPUT  -i eth0 -s  10.0.0.0/8 -j DROP
iptables -A INPUT  -i eth0 -s  172.16/12  -j DROP
iptables -A INPUT  -i eth0 -s  192.168/12 -j DROP

# let in identd requests
#iptables -A INPUT  -i eth0 -p TCP --dport  113 -j ACCEPT
#iptables -A INPUT  -i eth0 -p UDP --dport  113 -j ACCEPT

# let in ssh on eth0
#iptables -A INPUT  -i eth0 -p TCP --dport  22 -j ACCEPT
#iptables -A INPUT  -i eth0 -p UDP --dport  22 -j ACCEPT

# IN the filter table (the default)  Append a rule to the INPUT chain that says
# accept incoming packets from interface eth1 which are coming into connect to port
# 25 for SMTP access. And port 113 for identd access

 iptables -A INPUT  -i eth0 -p TCP --dport 25  -j ACCEPT
 iptables -A INPUT  -i eth0 -p TCP --dport 88  -j ACCEPT
 iptables -A INPUT  -i eth0 -p TCP --dport 443  -j ACCEPT

#    SMB / Windows filesharing, don't let it outside this LAN
iptables -A FORWARD -p tcp --sport 137 -j DROP
iptables -A FORWARD -p udp --sport 137 -j DROP
iptables -A FORWARD -p tcp --sport 138 -j DROP
iptables -A FORWARD -p udp --sport 138 -j DROP
iptables -A FORWARD -p tcp --sport 139 -j DROP
iptables -A FORWARD -p udp --sport 139 -j DROP

# IN the filter table (the default)  Append a rule to the INPUT chain that says
# accept incoming packets which are part of an already established connection
 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# IN the filter table (the default)  Append a rule to the INPUT chain that says
# accept incoming packets that are starting new connections from any interface EXCEPT eth1.
 iptables -A INPUT -m state --state NEW -i ! eth0 -j ACCEPT

# iptables -A INPUT -j LOG --log-prefix "New not syn:"
# iptables -A INPUT -j LOG --log-prefix "New not syn:"
 iptables -P INPUT DROP #only if the first two are succesful

iptables -A INPUT  -p UDP --sport 67 --dport 68  -j DROP