def &FORWARD_HOST($proto, $port, $dest) = {
        table nat chain PREROUTING interface $DEV_WORLD daddr $HOST_STATIC proto $proto dport $port DNAT to $dest;
        table filter chain FORWARD interface $DEV_WORLD proto $proto daddr $dest dport $port ACCEPT;
}

#
# convenience function which creates both the nat/DNAT and the filter/FORWARD rule
#
def &FORWARD_PORT($proto, $sport, $dport, $dest) = {
        table nat chain PREROUTING interface $DEV_WORLD daddr $CLUSTER_OUT proto $proto dport $sport DNAT to "$dest:$dport";
        table filter chain FORWARD interface $DEV_WORLD proto $proto daddr $dest dport $sport ACCEPT;
}

#
# Function to accept and tarpit services
#
def &TARPIT_PORT($source, $dest, $proto, $port) = {
        saddr $source proto $proto daddr $dest dport $port mod state state NEW mod recent update seconds 60 hitcount 10 DROP;
        saddr $source proto $proto daddr $dest dport $port mod state state NEW mod recent set ACCEPT;
}

    chain FORWARD {
        policy DROP;

        # connection tracking
        mod state state INVALID DROP;
        mod state state (ESTABLISHED RELATED) ACCEPT;

        # Hack
        #interface $DEV_DMZ_PUBLIC ACCEPT;

        saddr 0/0 daddr $NET_DMZ_PUBLIC proto icmp {
                icmp-type echo-request mod limit limit 10/s ACCEPT;
                DROP;
        }

        saddr $NET_DMZ_PUBLIC daddr 0/0 proto icmp {
                icmp-type echo-request mod limit limit 10/s ACCEPT;
                DROP;
        }

--

        # VPN stuff
        saddr (172.31.128.0/22 172.31.248.0/21 89.250.115.0/24) {
                daddr (172.31.255.68 172.31.255.86) proto (tcp udp) dport (domain) ACCEPT;
                daddr (172.31.255.64/26) proto (tcp udp) dport (netbios-ns netbios-dgm netbios-ssn microsoft-ds kerberos) ACCEPT;
                daddr (172.31.255.64/26) proto (tcp) dport (http) ACCEPT;

                daddr (89.250.115.0/24 172.31.248.0/24 172.20.0.0/20 172.31.255.64/26) proto icmp {
                        icmp-type echo-request mod limit limit 10/s ACCEPT;
                        DROP;
                }
        }


&FORWARD_PORT(tcp, https, 443, 89.250.115.79);
&FORWARD_PORT(tcp, http, 80, 89.250.115.79);

&TARPIT_PORT(0/0, 89.250.115.188, tcp, 5900);
&TARPIT_PORT(0/0, 89.250.115.189, tcp, rdp);