#!/bin/sh

EXTIF=ppp0
INTIF=eth1
IPTABLES=/sbin/iptables
echo "1" > /proc/sys/net/ipv4/ip_forward

$IPTABLES -P INPUT DROP
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD
$IPTABLES -t nat -F

$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG


$IPTABLES -t nat -A POSTROUTING -o $EXTIF -s 192.168.1.0/24 -j MASQUERADE
#$IPTABLES -A INPUT -i $EXTIF -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF  -m state --state RELATED,ESTABLISHED -j ACCEPT

$IPTABLES -A INPUT -i $INTIF -s 192.168.1.0/24 -j ACCEPT
$IPTABLES -A INPUT -i lo -j ACCEPT

# ssh
$IPTABLES -A INPUT -i $EXTIF -p tcp --dport 22 -j ACCEPT

# VPN
$IPTABLES -A INPUT -i $EXTIF -p tcp --dport 1723 -j ACCEPT

# http
$IPTABLES -A INPUT -i $EXTIF -p tcp --dport 80 -j ACCEPT