version 5
if_lan=eth0
if_internet=eth1
# Port forwarding
dnat to 10.1.0.2 inface ${if_internet} proto tcp dport 80 # Jane HTTP
dnat to 10.1.0.2 inface ${if_internet} proto udp dport 1194 # Jane OpenVPN
dnat to 10.1.3.1 inface ${if_internet} proto tcp dport 6881:6999 # Mike BT
dnat to 10.1.3.1 inface ${if_internet} proto udp dport 6881:6999 # Mike BT
dnat to 10.1.1.1 inface ${if_internet} proto tcp dport 6699 # Rich WinMX
dnat to 10.1.1.1 inface ${if_internet} proto udp dport 6257 # Rich WinMX
dnat to 10.1.5.1 inface ${if_internet} proto tcp dport 3389 # Brian RDP
dnat to 10.1.254.249 inface ${if_internet} proto tcp dport 4662 # Mike eMule
dnat to 10.1.254.249 inface ${if_internet} proto udp dport 4672 # Mike eMule
dnat to 10.1.254.249 inface ${if_internet} proto tcp dport 34217 # Mike Shareaza
dnat to 10.1.254.249 inface ${if_internet} proto udp dport 34217 # Mike Shareaza
dnat to 10.1.1.1:3389 inface ${if_internet} proto tcp dport 3390 # Rich RDP
dnat to 10.1.3.1:22 inface ${if_internet} proto tcp dport 2222 # Mike SSH
dnat to 10.1.4.1:22 inface ${if_internet} proto tcp dport 2223 # Doug SSH
# Firewall for traffic hitting oversoul itself from the Internet
interface ${if_internet} world
policy reject
protection full
server ping accept
server ssh accept
server custom rmi tcp/1090:1099 0:65535 accept
client all accept
# Firewall for traffic hitting oversoul itself from the LAN
interface ${if_lan} lan
policy reject
protection full
server ping accept
server dhcp accept
server dns accept
server ssh accept
server cups drop # Don't log CUPS printer announcements
server samba drop # Same for SMB stuff
server custom rmi tcp/1090:1099 0:65535 accept
client all accept
# Router for masquerading traffic from the LAN to the Internet
router masq inface ${if_lan} outface ${if_internet}
protection full
masquerade
server all accept
# Router for port-forwarded traffic coming from the Internet
router services inface ${if_internet} outface ${if_lan}
protection full
server all accept