#!/bin/sh
# Copyright (C) 2006 OpenWrt.org

iptables -F input_rule
iptables -F output_rule
iptables -F forwarding_rule
iptables -t nat -F prerouting_rule
iptables -t nat -F postrouting_rule

iptables -I input_rule -i $WAN -j LOG --log-prefix "input: "

# The following chains are for traffic directed at the IP of the 
# WAN interface

iptables -F input_wan
iptables -F forwarding_wan
iptables -t nat -F prerouting_wan

### Prevent protocol 41 from being listed in the NAT table
# iptables -t nat -D POSTROUTING -o $WAN -j MASQUERADE
# iptables -t nat -A POSTROUTING --protocol ! 41 -o $WAN -j MASQUERADE

### Open port to WAN
## -- This allows port 22 to be answered by (dropbear on) the router
iptables -t nat -A prerouting_wan -p tcp --dport 22 -j ACCEPT 
iptables        -A input_wan      -p tcp --dport 22 -j ACCEPT

### Port forwarding WWW
## -- This forwards port 80 on the WAN to port 80 on 192.168.10.2
iptables -t nat -A prerouting_wan -p tcp --dport 80 -j DNAT --to 192.168.10.2:80
iptables        -A forwarding_wan -p tcp --dport 80 -d 192.168.10.2 -j ACCEPT

### Port forwarding IRCD
## -- This forwards port 6667 on the WAN to port 6667 on 192.168.10.2
iptables -t nat -A prerouting_wan -p tcp --dport 6667 -j DNAT --to 192.168.10.2
iptables        -A forwarding_wan -p tcp --dport 6667 -d 192.168.10.2 -j ACCEPT

### Port forwarding DCC
## -- This forwards ports 5000 - 5005 on the WAN to ports 5000 - 5005 on 192.168.10.10
iptables -t nat -A prerouting_wan -p tcp --dport 5000:5005 -j DNAT --to 192.168.10.10
iptables        -A forwarding_wan -p tcp --dport 5000:5005 -d 192.168.10.10 -j ACCEPT

### Port forwarding Azureus
## -- This forwards port 60218 on the WAN to port 60218 on 192.168.10.10
iptables -t nat -A prerouting_wan -p tcp --dport 60218 -j DNAT --to 192.168.10.10
iptables        -A forwarding_wan -p tcp --dport 60218 -d 192.168.10.10 -j ACCEPT

### IPv6 rules
ip6tables -F INPUT
ip6tables -P INPUT DROP
ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT
ip6tables -A INPUT -p icmpv6 -j ACCEPT
ip6tables -F FORWARD
ip6tables -A FORWARD -j ACCEPT

root@OpenWrt:~#