rendered paste body#!/bin/sh
INET_IF="eth1"
INET_IP="10.0.0.7"
LAN_IP="192.168.1.21"
LAN_IP_RANGE="192.168.1.0/24"
LAN_IF="eth0"
LAN2_IP="192.168.2.5"
LAN2_IP_RANGE="192.168.2.0/24"
CLIENT_IP="192.168.1.6"
CLIENT_IP_TMG="192.168.1.251"
CLIENT_IP_NTP="192.168.1.250"
SPECIAL_IP="192.168.0.5"
SPECIAL_IP1="192.168.0.1"
SPECIAL_IP2="192.168.0.2"
SPECIAL_IP3="192.168.0.201"
SPECIAL_IP4="192.168.0.202"
SPECIAL_IP5="192.168.0.203"
SPECIAL_IF="br0"
IPTABLES="/sbin/iptables"
MODPROBE="/sbin/modprobe"
/sbin/depmod -a
#$MODPROBE ip_conntrack
#$MODPROBE ip_tables
#$MODPROBE iptable_filter
#$MODPROBE iptable_mangle
#$MODPROBE iptable_nat
$MODPROBE ipt_LOG
$MODPROBE ipt_limit
$MODPROBE ipt_state
#$MODPROBE ipt_MASQUERADE
#$MODPROBE ipt_REDIRECT
#$MODPROBE ipt_owner
$MODPROBE ipt_REJECT
$MODPROBE ip_conntrack_ftp
$MODPROBE ip_conntrack_irc
$MODPROBE ip_nat_ftp
$MODPROBE ip_nat_irc
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
#-----------------------------------------------
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -N icmp_packets
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m icmp --icmp-type 4 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m icmp --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m state --state ESTABLISHED,RELATED -m icmp --icmp-type 0 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m state --state ESTABLISHED,RELATED -m icmp --icmp-type 3 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m state --state ESTABLISHED,RELATED -m icmp --icmp-type 11 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m state --state ESTABLISHED,RELATED -m icmp --icmp-type 12 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m state --state ESTABLISHED,RELATED -m icmp --icmp-type 14 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m state --state ESTABLISHED,RELATED -m icmp --icmp-type 18 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m state --state ESTABLISHED,RELATED -m icmp --icmp-type 3/2 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 -m state --state ESTABLISHED,RELATED -m icmp --icmp-type 5 -j ACCEPT
$IPTABLES -N bad_tcp_packets
$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
#$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A bad_tcp_packets -p tcp -m state --state INVALID -j DROP
$IPTABLES -N allowed
$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -j REJECT --reject-with tcp-reset
$IPTABLES -N tcp_ext_input
$IPTABLES -A tcp_ext_input -p TCP --dport 22 -j allowed
$IPTABLES -A tcp_ext_input -p TCP --dport 113 -j allowed
$IPTABLES -A tcp_ext_input -p TCP --dport 3299 -j allowed
$IPTABLES -A tcp_ext_input -p TCP --dport 3389 -j allowed
$IPTABLES -A tcp_ext_input -p TCP --dport 6129 -j allowed
$IPTABLES -N tcp_ext_forward
$IPTABLES -A tcp_ext_forward -p TCP --dport 113 -j allowed
$IPTABLES -N udp_ext_input
$IPTABLES -A udp_ext_input -p UDP --dport 1194 -j ACCEPT
$IPTABLES -A udp_ext_input -p UDP --dport 1195 -j ACCEPT
$IPTABLES -A udp_ext_input -p UDP --dport 113 -j ACCEPT
$IPTABLES -A udp_ext_input -p UDP --dport 123 -j ACCEPT
$IPTABLES -N udp_ext_forward
$IPTABLES -A udp_ext_forward -p UDP --dport 113 -j ACCEPT
#-----------------------------------------------------
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT
$IPTABLES -A INPUT -p ICMP -i lo -s 127.0.0.1 -j ACCEPT
$IPTABLES -A INPUT -p ICMP -i eth+ -j icmp_packets
$IPTABLES -A FORWARD -p ICMP -i eth+ -j icmp_packets
$IPTABLES -A OUTPUT -p ICMP -o lo -j ACCEPT
$IPTABLES -A OUTPUT -p ICMP -o eth+ -j ACCEPT
$IPTABLES -A INPUT -p TCP -j bad_tcp_packets
$IPTABLES -A FORWARD -p TCP -j bad_tcp_packets
$IPTABLES -A OUTPUT -p TCP -j bad_tcp_packets
$IPTABLES -A INPUT -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p UDP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -p UDP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -p UDP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -i $LAN_IF -s $CLIENT_IP -d 224.0.0.0/8 -j DROP
$IPTABLES -A FORWARD -i $LAN_IF -s $CLIENT_IP -d 224.0.0.0/8 -j DROP
$IPTABLES -A INPUT -i $LAN_IF -s $CLIENT_IP_TMG -d 224.0.0.0/8 -j DROP
$IPTABLES -A FORWARD -i $LAN_IF -s $CLIENT_IP_TMG -d 224.0.0.0/8 -j DROP
$IPTABLES -A INPUT -i $LAN_IF -s $CLIENT_IP_NTP -d 224.0.0.0/8 -j DROP
$IPTABLES -A FORWARD -i $LAN_IF -s $CLIENT_IP_NTP -d 224.0.0.0/8 -j DROP
$IPTABLES -A INPUT -p TCP -i $LAN_IF -s $CLIENT_IP -j ACCEPT
$IPTABLES -A FORWARD -p TCP -i $LAN_IF -s $CLIENT_IP -j ACCEPT
$IPTABLES -A FORWARD -p TCP -o $LAN_IF -d $CLIENT_IP -j ACCEPT
$IPTABLES -A OUTPUT -p TCP -o $LAN_IF -d $CLIENT_IP -j ACCEPT
$IPTABLES -A INPUT -p UDP -i $LAN_IF -s $CLIENT_IP_TMG -j ACCEPT
$IPTABLES -A FORWARD -p UDP -i $LAN_IF -s $CLIENT_IP_TMG -j ACCEPT
$IPTABLES -A FORWARD -p UDP -o $LAN_IF -d $CLIENT_IP_TMG -j ACCEPT
$IPTABLES -A OUTPUT -p UDP -o $LAN_IF -d $CLIENT_IP_TMG -j ACCEPT
$IPTABLES -A INPUT -p UDP -i $LAN_IF -s $CLIENT_IP_NTP -j ACCEPT
$IPTABLES -A FORWARD -p UDP -i $LAN_IF -s $CLIENT_IP_NTP -j ACCEPT
$IPTABLES -A FORWARD -p UDP -o $LAN_IF -d $CLIENT_IP_NTP -j ACCEPT
$IPTABLES -A OUTPUT -p UDP -o $LAN_IF -d $CLIENT_IP_NTP -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $INET_IF -j tcp_ext_input
$IPTABLES -A FORWARD -p TCP -i $INET_IF -j tcp_ext_forward
$IPTABLES -A OUTPUT -p TCP -o $INET_IF -j ACCEPT
$IPTABLES -A INPUT -p UDP -i $LAN_IF -s $CLIENT_IP -j ACCEPT
$IPTABLES -A FORWARD -p UDP -i $LAN_IF -s $CLIENT_IP -j ACCEPT
$IPTABLES -A FORWARD -p UDP -o $LAN_IF -d $CLIENT_IP -j ACCEPT
$IPTABLES -A OUTPUT -p UDP -o $LAN_IF -d $CLIENT_IP -j ACCEPT
$IPTABLES -A INPUT -p UDP -i $LAN_IF -s $CLIENT_IP_TMG -j ACCEPT
$IPTABLES -A FORWARD -p UDP -i $LAN_IF -s $CLIENT_IP_TMG -j ACCEPT
$IPTABLES -A FORWARD -p UDP -o $LAN_IF -d $CLIENT_IP_TMG -j ACCEPT
$IPTABLES -A OUTPUT -p UDP -o $LAN_IF -d $CLIENT_IP_TMG -j ACCEPT
$IPTABLES -A INPUT -p UDP -i $INET_IF -j udp_ext_input
$IPTABLES -A FORWARD -p UDP -i $INET_IF -j udp_ext_forward
$IPTABLES -A OUTPUT -p UDP -o $INET_IF -j ACCEPT
$IPTABLES -A INPUT -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -d $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -s $LAN2_IP_RANGE -j ACCEPT
$IPTABLES -A FORWARD -s $LAN2_IP_RANGE -j ACCEPT
$IPTABLES -A FORWARD -d $LAN2_IP_RANGE -j ACCEPT
$IPTABLES -A OUTPUT -d $LAN2_IP_RANGE -j ACCEPT
$IPTABLES -t nat -A POSTROUTING -o $INET_IF -j SNAT --to-source $INET_IP
#-------------------------=SPECIAL RULES=-------------------------
$IPTABLES -A INPUT -p icmp -d $SPECIAL_IP -j ACCEPT
$IPTABLES -A INPUT -p tcp -d $SPECIAL_IP --dport 22 -j ACCEPT
$IPTABLES -A OUTPUT -d 192.168.0.0/24 -j ACCEPT
$IPTABLES -A FORWARD -i br0 -o br0 -s 192.168.0.0/24 -d 192.168.0.0/24 -j ACCEPT
$IPTABLES -A INPUT -p icmp -s 10.2.1.0/24 -j ACCEPT
$IPTABLES -A OUTPUT -p icmp -d 10.2.1.0/24 -j ACCEPT
$IPTABLES -A FORWARD -i tun0 -d 192.6.1.0/24 -j ACCEPT
$IPTABLES -t nat -A POSTROUTING -o eth0 -d 192.6.1.0/24 -j SNAT --to-source 192.6.1.5
#-----------------------<=PRIVATE RULES=>-------------------------
$IPTABLES -A INPUT -p tcp -s 192.168.1.2 --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 192.168.1.202 --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 195.24.145.140 --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 195.24.145.140 --dport 6129 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 195.24.145.140 --dport 3389 -j ACCEPT
$IPTABLES -A INPUT -p udp -s 10.0.0.1 --dport 123 -j ACCEPT
$IPTABLES -A INPUT -p udp -s 192.168.1.250 --dport 123 -j ACCEPT
#-----------------------
$IPTABLES -A INPUT -p tcp -s 217.198.128.99 --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 217.198.128.163 --dport 22 -j ACCEPT
#----------------------
$IPTABLES -A INPUT -p tcp -s 213.154.196.175 --dport 3299 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 213.154.213.169 --dport 3299 -j ACCEPT
#$IPTABLES -A PREROUTING -t nat -p tcp -d 10.0.0.3 --dport 6129 -j DNAT --to-destination 192.168.1.2:6129
#$IPTABLES -A PREROUTING -t nat -p tcp -d 10.0.0.3 --dport 3389 -j DNAT --to-destination 192.168.1.2:3389
#$IPTABLES -A FORWARD -i eth0 -d 192.168.1.2 -p tcp --dport 6129 -j ACCEPT
#$IPTABLES -A FORWARD -i eth0 -d 192.168.1.2 -p tcp --dport 3389 -j ACCEPT
#$IPTABLES -A POSTROUTING -t nat -p tcp -o eth0 -j SNAT --to-source 195.248.163.36