table nat {
    chain POSTROUTING {
        # masquerade private IP addresses
        saddr 172.31.255.68 daddr 137.217.0.0/16 proto udp dport 53 outerface $DEV_WORLD SNAT to 89.250.115.68;
        saddr $NET_PRIVATE daddr ! 137.217.0.0/16 outerface $DEV_WORLD SNAT to $CLUSTER_OUT;
    }
}

---

def $DEV_WORLD = eth0;
def $DEV_PRIVATE = eth1;
def $DEV_DMZ_BOXED = eth2;
def $DEV_DMZ_PUBLIC = eth3;

def $NET_PUBLIC = (89.250.114.8/29 89.250.126.80/28);
def $NET_PRIVATE = 172.31.255.64/26;
def $NET_DMZ_BOXED = 172.31.255.128/27;
def $NET_DMZ_PUBLIC = 89.250.115.64/26;
def $NET_DMZ_CUSTOMER = 89.250.115.160/26;
def $NET_VPN_PRIVATE = 172.31.128.0/24;

def $NET_BOXED_UK = 89.250.127.16/28;

# our static IP address
def $HOST_STATIC = (89.250.115.228 89.250.115.161 172.31.255.66 89.250.115.65);
#def $CLUSTER_OUT = 194.24.253.37;
def $CLUSTER_OUT = 89.250.115.228;
def $CLUSTER_IN = 172.31.255.65;

---

table filter {
    chain INPUT {
        policy ACCEPT;

        # connection tracking
        mod state state INVALID DROP;
        mod state state (ESTABLISHED RELATED) ACCEPT;

        # allow local connections
        interface lo ACCEPT;

        # allow VPNs
        interface tap+ ACCEPT;

        # Hack
        interface $DEV_DMZ_PUBLIC ACCEPT;

        # Accept igmp-based things like VRRP and OSPF
        daddr 224.0.0.0/16 ACCEPT;

        # respond to ping, but limit that
        proto icmp {
            icmp-type echo-request mod limit limit 10/s ACCEPT;
            DROP;
        }

---

def &FORWARD_HOST($proto, $port, $dest) = {
        table nat chain PREROUTING interface $DEV_WORLD daddr $HOST_STATIC proto $proto dport $port DNAT to $dest;
        table filter chain FORWARD interface $DEV_WORLD proto $proto daddr $dest dport $port ACCEPT;
}

#
# convenience function which creates both the nat/DNAT and the filter/FORWARD rule
#
def &FORWARD_PORT($proto, $sport, $dport, $dest) = {
        table nat chain PREROUTING interface $DEV_WORLD daddr $CLUSTER_OUT proto $proto dport $sport DNAT to "$dest:$dport";
        table filter chain FORWARD interface $DEV_WORLD proto $proto daddr $dest dport $sport ACCEPT;
}

#
# Function to accept and tarpit services
#
def &TARPIT_PORT($source, $dest, $proto, $port) = {
        saddr $source proto $proto daddr $dest dport $port mod state state NEW mod recent update seconds 60 hitcount 10 DROP;
        saddr $source proto $proto daddr $dest dport $port mod state state NEW mod recent set ACCEPT;
}

    chain FORWARD {
        policy DROP;

        # connection tracking
        mod state state INVALID DROP;
        mod state state (ESTABLISHED RELATED) ACCEPT;

        # Hack
        #interface $DEV_DMZ_PUBLIC ACCEPT;

        saddr 0/0 daddr $NET_DMZ_PUBLIC proto icmp {
                icmp-type echo-request mod limit limit 10/s ACCEPT;
                DROP;
        }

        saddr $NET_DMZ_PUBLIC daddr 0/0 proto icmp {
                icmp-type echo-request mod limit limit 10/s ACCEPT;
                DROP;
        }

--

        # VPN stuff
        saddr (172.31.128.0/22 172.31.248.0/21 89.250.115.0/24) {
                daddr (172.31.255.68 172.31.255.86) proto (tcp udp) dport (domain) ACCEPT;
                daddr (172.31.255.64/26) proto (tcp udp) dport (netbios-ns netbios-dgm netbios-ssn microsoft-ds kerberos) ACCEPT;
                daddr (172.31.255.64/26) proto (tcp) dport (http) ACCEPT;

                daddr (89.250.115.0/24 172.31.248.0/24 172.20.0.0/20 172.31.255.64/26) proto icmp {
                        icmp-type echo-request mod limit limit 10/s ACCEPT;
                        DROP;
                }
        }


&FORWARD_PORT(tcp, https, 443, 89.250.115.79);
&FORWARD_PORT(tcp, http, 80, 89.250.115.79);

&TARPIT_PORT(0/0, 89.250.115.188, tcp, 5900);
&TARPIT_PORT(0/0, 89.250.115.189, tcp, rdp);