iptables -A FORWARD -J ACCEPT  -i ${if_lan} -p 50
    iptables -A FORWARD -J ACCEPT  -i ${if_lan} -p 51


    iptables -t nat -I POSTROUTING 1 -p 50 -j ACCEPT

echo "Masquerading VPN..";
iptables -t nat -A POSTROUTING -j MASQUERADE -o ppp+ -s ${vpn_mask}


# based on: http://lists.netfilter.org/pipermail/netfilter/2003-March/043149.html
# also based on: http://lists.netfilter.org/pipermail/netfilter/2005-March/059163.html

# GRE tunneling should be supported by running kernel
# (esp=50, ah=51) See also: http://ipsec-tools.sourceforge.net/checklist.html

iptables -A INPUT  -i ppp+ -p 50 -j ACCEPT
iptables -A OUTPUT -p 50 -j ACCEPT
iptables -A INPUT -i ppp+ -p 51 -j ACCEPT
iptables -A OUTPUT -p 51 -j ACCEPT
iptables -A INPUT -i ppp+ -p UDP --dport 500 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 500 -j ACCEPT

#iptables -I POSTROUTING 1 -p 50 -j ACCEPT

iptables -A FORWARD -i ppp+ -p 50 -j ACCEPT
iptables -A FORWARD -i ppp+ -p 51 -j ACCEPT
iptables -A FORWARD -i ppp+ -p UDP --dport 500 -j ACCEPT
#iptables -A FORWARD -p udp -m udp --dport 500 -j ACCEPT
iptables -A FORWARD -i  ppp+ -p udp --dport 4500 -j ACCEPT
iptables -A FORWARD -i  ppp+ -p udp --dport 5000 -j ACCEPT
iptables -A FORWARD -i  ppp+ -p udp --dport 10000 -j ACCEPT
iptables -A FORWARD -i  ppp+ -p tcp --syn --dport 10000 -j ACCEPT

iptables -A INPUT  -i ${if_lan} -p 50 -j ACCEPT
#iptables -A OUTPUT -p 50 -j ACCEPT
iptables -A INPUT -i ${if_lan} -p 51 -j ACCEPT
#iptables -A OUTPUT -p 51 -j ACCEPT
iptables -A INPUT -i ${if_lan} -p UDP --dport 500 -j ACCEPT
#iptables -A INPUT -p udp -m udp --dport 500 -j ACCEPT

iptables -A INPUT -i ${if_lan} -p udp --dport 4500 -j ACCEPT
iptables -A INPUT -i ${if_lan} -p udp --dport 5000 -j ACCEPT
iptables -A INPUT -i ${if_lan} -p udp --dport 10000 -j ACCEPT
iptables -A INPUT -i ${if_lan} -p tcp --syn --dport 10000 -j ACCEPT