rendered paste body#!/bin/sh -x
EXT_IP="85.249.167.140"
EXT_IFACE="eth0:1"
INT_IP="192.168.1.1"
INT_RANGE="192.168.1.0/24"
INT_IFACE="eth0:0"
LO_IFACE="lo"
LO_IP="127.0.0.1"
NETWORKS="10.0.0.0/8 192.168.0.0/16 85.249.160.0/24 195.189.80.0/22 91.201.228.0/22"
OPEN_TCP_PORTS="20 21 25 80 110 222 600 995 4001 4444 4672 6881 6882 49152:65534"
OPEN_UDP_PORTS="4444 4672 4676"
ipt=`which iptables`
#allowed_ips=`cat /opt/etc/allowed_ips | grep -v '#'`
echo "1" > /proc/sys/net/ipv4/ip_forward
$ipt -P INPUT DROP
$ipt -P OUTPUT DROP
$ipt -P FORWARD DROP
cat /proc/net/ip_tables_names | while read table; do
$ipt -t $table -L -n | while read c chain rest; do
if test "X$c" = "XChain" ; then
$ipt -t $table -F $chain
fi
done
$ipt -t $table -X
done
$ipt -N badpkt
$ipt -N pass
$ipt -N tcppkt
$ipt -N udppkt
$ipt -N icmppkt
$ipt -A badpkt -p tcp --tcp-flags syn,ack syn,ack -m state --state NEW -j DROP
$ipt -A badpkt -p tcp ! --syn -m state --state NEW -j DROP
$ipt -A pass -p tcp --syn -j ACCEPT
$ipt -A pass -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
$ipt -A pass -p tcp -j DROP
for port in $OPEN_TCP_PORTS
do
$ipt -A tcppkt -p tcp -s $EXT_IP --dport $port -j pass
done
for port in $OPEN_UDP_PORTS
do
$ipt -A udppkt -p udp -s $EXT_IP --dport $port -j ACCEPT
done
$ipt -A icmppkt -p icmp --icmp-type 8 -j ACCEPT
$ipt -A icmppkt -p icmp --icmp-type 11 -j ACCEPT
$ipt -A INPUT -p tcp -j badpkt
$ipt -A INPUT -p all -i $INT_IFACE -s $INT_RANGE -j ACCEPT
$ipt -A INPUT -p all -i $LO_IFACE -s $LO_IP -j ACCEPT
$ipt -A INPUT -p all -i $LO_IFACE -s $INT_IP -j ACCEPT
$ipt -A INPUT -p all -i $LO_IFACE -s $EXT_IP -j ACCEPT
$ipt -A INPUT -p udp -i $INT_IFACE --dport 67 --sport 68 -j ACCEPT
$ipt -A INPUT -p all -d $EXT_IP -m state --state ESTABLISHED,RELATED -j ACCEPT
$ipt -A INPUT -p tcp -i $EXT_IFACE -j tcppkt
$ipt -A INPUT -p udp -i $EXT_IFACE -j udppkt
$ipt -A INPUT -p icmp -i $EXT_IFACE -j icmppkt
$ipt -A FORWARD -p tcp -j badpkt
$ipt -A FORWARD -i $INT_IFACE -j ACCEPT
for port in $OPEN_TCP_PORTS
do
$ipt -A FORWARD -p tcp -i $EXT_IFACE -o $INT_IFACE --dport $port -j pass
done
for port in $OPEN_UDP_PORTS
do
$ipt -A FORWARD -p udp -i $EXT_IFACE -o $INT_IFACE --dport $port -j ACCEPT
done
$ipt -A FORWARD -p icmp -i $EXT_IFACE -o $INT_IFACE -j icmppkt
$ipt -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$ipt -A OUTPUT -p tcp -j badpkt
$ipt -A OUTPUT -p all -s $LO_IP -j ACCEPT
$ipt -A OUTPUT -p all -s $INT_IP -j ACCEPT
$ipt -A OUTPUT -p all -s $EXT_IP -j ACCEPT
$ipt -t nat -A PREROUTING -p tcp -d $EXT_IP --dport 49152:65534 -j DNAT --to-destination 192.168.1.10
$ipt -t nat -A PREROUTING -p tcp -d $EXT_IP --dport 4001 -j DNAT --to-destination 192.168.1.10:4001
$ipt -t nat -A PREROUTING -p udp -d $EXT_IP --dport 4676 -j DNAT --to-destination 192.168.1.10:4676
$ipt -t nat -A PREROUTING -p tcp -d $EXT_IP --dport 4672 -j DNAT --to-destination 192.168.1.10:4672
$ipt -t nat -A PREROUTING -p tcp -d $EXT_IP --dport 4444 -j DNAT --to-destination 192.168.1.10:4444
$ipt -t nat -A PREROUTING -p tcp -d $EXT_IP --dport 6881 -j DNAT --to-destination 192.168.1.10:6881
$ipt -t nat -A PREROUTING -p tcp -d $EXT_IP --dport 6882 -j DNAT --to-destination 192.168.1.10:6882
#$ipt -t nat -A PREROUTING -p tcp -d $EXT_IP --dport 2222 -j DNAT --to-destination 192.168.1.1:22
$ipt -t nat -A PREROUTING -p tcp -d $EXT_IP --dport 995 -j DNAT --to-destination 192.168.1.10:995
$ipt -t nat -A PREROUTING -p tcp -d $EXT_IP --dport 600 -j DNAT --to-destination 192.168.1.10:5901
$ipt -t nat -A PREROUTING -p tcp -d $EXT_IP --dport 222 -j DNAT --to-destination 192.168.1.10:22
$ipt -t nat -A PREROUTING -p tcp -d $EXT_IP --dport 110 -j DNAT --to-destination 192.168.1.10:110
$ipt -t nat -A PREROUTING -p tcp -d $EXT_IP --dport 80 -J DNAT --to-destination 192.168.1.10:80
$ipt -t nat -A PREROUTING -p tcp -d $EXT_IP --dport 25 -j DNAT --to-destination 192.168.1.10:25
$ipt -t nat -A PREROUTING -p tcp -d $EXT_IP --dport 20 -j DNAT --to-destination 192.168.1.10:20
$ipt -t nat -A PREROUTING -p tcp -d $EXT_IP --dport 21 -j DNAT --to-destination 192.168.1.10:21
$ipt -t nat -A POSTROUTING -o $EXT_IFACE -j SNAT --to-source $EXT_IP