rendered paste body#=#=# OUTPUT #=#=#
iptables -P OUTPUT DROP
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -o $int -j ACCEPT
iptables -A OUTPUT -o $ext -j ACCEPT
#=#=# PREROUTING #=#=#
# smtp
iptables -t nat -A PREROUTING -p tcp --dport 25 -j DNAT --to 10.0.0.2
# torrent tracker
iptables -t nat -A PREROUTING -p tcp --dport 11234 -j DNAT --to 10.0.0.2
# torrent seeder
iptables -t nat -A PREROUTING -p tcp --dport 6881:6889 -j DNAT --to 10.0.0.2
#=#=# POSTROUTING #=#+#
# for all internal connections forwared to internal addresses
iptables -t nat -A POSTROUTING -p tcp -s $lan --dst $lan --dport 11234 -j SNAT --to-source 10.0.0.1
iptables -t nat -A POSTROUTING -p tcp -s $lan --dst $lan --dport 6881:6889 -j SNAT --to-source 10.0.0.1
#=#=# FORWARD #=#=#
iptables -P FORWARD DROP
# Internal Mail
iptables -A FORWARD -i $ext -o $int -p tcp --dport 25 -j ACCEPT
# Torrent Hosting
iptables -A FORWARD -i $ext -o $int -p tcp --dport 11234 -j ACCEPT
iptables -A FORWARD -i $ext -o $int -p tcp --dport 6881:6889 -j ACCEPT
# NAT
iptables -A FORWARD -i $ext -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $int -o $ext -j ACCEPT
iptables -A FORWARD -i $int -o $int -j ACCEPT
# Avoid bounce
iptables -A FORWARD -i $ext -o $ext -j DROP
# Masquerading on External
iptables -t nat -A POSTROUTING -o $ext -j MASQUERADE