rendered paste body#!/bin/bash -x
# safenet = where non-trusted boxes sit - do not trust on local network at all #
# lan = local area (safe) network #
# dmz = server network that cannot touch anything other than wan #
# alp = ayrshire lan party that cannot touch anything other than wan and dmz #
# wan = Internet Connectivity #
# wlan = Wireless network - Secured with WPA Enterprise #
# flush existing settings
iptables -F
iptables -X
iptables -t nat -F
# drop all by default
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# interfaces
wanif="eth0"
wlanif="ath0"
lanif="eth1.2"
dmzif="eth1.3"
safeif="eth1.4"
alpif="eth1.5"
# networks
wannet=""
wlannet="10.0.1.0/24"
lannet="10.0.0.0/24"
dmznet="10.0.2.0/24"
safenet="10.0.3.0/24"
alpnet="10.10.0.0/24"
# ip(s)
lanip="10.0.0.1"
wlanip="10.0.1.1"
dmzip="10.0.2.1"
safeip="10.0.3.1"
alpip="10.10.0.1"
# nat
natextip="82.153.32.153"
# dns
nameserver1="212.104.130.9"
nameserver2="212.104.130.65"
## LAN ##
## [INPUT] LAN --> GATEWAY ##
iptables -A INPUT -i $lanif -s $lannet -p tcp -d $lanip --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [OUTPUT] GATEWAY --> LAN ##
iptables -A OUTPUT -o $lanif -s $lanip -d $lannet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] LAN --> DMZ ##
iptables -A FORWARD -i $lanif -o $dmzif -s $lannet -d $dmznet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] LAN --> WLAN ##
iptables -A FORWARD -i $lanif -o $wlanif -s $lannet -d $wlannet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] LAN --> ALP ##
iptables -A FORWARD -i $lanif -o $alpif -s $lannet -d $alpnet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] LAN --> WAN ##
iptables -A FORWARD -i $lanif -o $wanif -s $lannet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [NAT] LAN --> INTERNET ##
iptables -t nat -A POSTROUTING -o $wanif -s $lannet -j SNAT --to $natextip
## DMZ ##
## [FORWARD] DMZ --> LAN ##
iptables -A FORWARD -i $dmzif -o $lanif -s $dmznet -d $lannet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] DMZ --> WLAN ##
iptables -A FORWARD -i $dmzif -o $wlanif -s $dmznet -d $wlannet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] DMZ --> ALP ##
iptables -A FORWARD -i $dmzif -o $alpif -s $dmznet -d $alpnet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] DMZ --> WAN ##
iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p udp -d $nameserver1 --dport 53 -m state --state NEW,ESTABLISHED,RELATE$
iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p udp -d $nameserver2 --dport 53 -m state --state NEW,ESTABLISHED,RELATE$
iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 20 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 6667 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [NAT] DMZ --> INTERNET ##
iptables -t nat -A POSTROUTING -o $wanif -s $dmznet -j SNAT --to $natextip
## WAN ##
## [FORWARD] WAN --> LAN ##
iptables -A FORWARD -i $wanif -o $lanif -d $lannet -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $wanif -o $lanif -d $lannet -p tcp --dport 32825 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] WAN --> DMZ ##
iptables -A FORWARD -i $wanif -o $dmzif -d $dmznet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] WAN --> WLAN ##
iptables -A FORWARD -i $wanif -o $wlanif -d $wlannet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] WAN --> SAFENET ##
iptables -A FORWARD -i $wanif -o $safeif -d $safenet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] WAN --> ALP ##
iptables -A FORWARD -i $wanif -o $alpif -d $alpnet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [NAT] WAN --> LAN ##
iptables -t nat -A PREROUTING -i $wanif -p tcp -d $natextip --dport 32825 -j DNAT --to-destination 10.0.0.2
## WLAN ##
## [FORWARD] WLAN --> LAN ##
iptables -A FORWARD -i $wlanif -o $lanif -s $wlannet -d $lannet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] WLAN --> DMZ ##
iptables -A FORWARD -i $wlanif -o $dmzif -s $wlannet -d $dmznet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] WLAN --> ALP ##
iptables -A FORWARD -i $wlanif -o $alpif -s $wlannet -d $alpnet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] WLAN --> WAN ##
iptables -A FORWARD -i $wlanif -o $wanif -s $wlannet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [NAT] WLAN --> INTERNET ##
iptables -t nat -A POSTROUTING -o $wanif -s $wlannet -j SNAT --to $natextip
## SAFENET ##
## [FORWARD] SAFENET --> WAN ##
iptables -A FORWARD -i $safeif -o $wanif -s $safenet -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $dmzif -o $wanif -s $safenet -p udp -d $nameserver1 --dport 53 -m state --state NEW,ESTABLISHED,RELAT$
iptables -A FORWARD -i $dmzif -o $wanif -s $safenet -p udp -d $nameserver2 --dport 53 -m state --state NEW,ESTABLISHED,RELAT$
## [NAT] SAFENET --> INTERNET ##
iptables -t nat -A POSTROUTING -o $wanif -s $safenet -j SNAT --to $natextip
## ALP ##
## [FORWARD] ALP --> LAN ##
iptables -A FORWARD -i $alpif -o $lanif -s $alpnet -d $lannet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] ALP --> DMZ ##
iptables -A FORWARD -i $alpif -o $dmzif -s $alpnet -d $dmznet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] ALP --> WLAN ##
iptables -A FORWARD -i $alpif -o $wlanif -s $alpnet -d $wlannet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] ALP --> WAN ##
iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p tcp --dport 20 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p udp -d $nameserver1 --dport 53 -m state --state NEW,ESTABLISHED,RELATED
iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p udp -d $nameserver2 --dport 53 -m state --state NEW,ESTABLISHED,RELATED
## [NAT] ALP --> INTERNET ##
iptables -t nat -A POSTROUTING -o $wanif -s $alpnet -j SNAT --to $natextip
=================================================================
root@gw:/etc/rc.d# ./rc.firewall
+ iptables -F
+ iptables -X
+ iptables -t nat -F
+ iptables -P INPUT DROP
+ iptables -P OUTPUT DROP
+ iptables -P FORWARD DROP
+ wanif=eth0
+ wlanif=ath0
+ lanif=eth1.2
+ dmzif=eth1.3
+ safeif=eth1.4
+ alpif=eth1.5
+ wannet=
+ wlannet=10.0.1.0/24
+ lannet=10.0.0.0/24
+ dmznet=10.0.2.0/24
+ safenet=10.0.3.0/24
+ alpnet=10.10.0.0/24
+ lanip=10.0.0.1
+ wlanip=10.0.1.1
+ dmzip=10.0.2.1
+ safeip=10.0.3.1
+ alpip=10.10.0.1
+ natextip=82.153.32.153
+ nameserver1=212.104.130.9
+ nameserver2=212.104.130.65
+ iptables -A INPUT -i eth1.2 -s 10.0.0.0/24 -p tcp -d 10.0.0.1 --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A OUTPUT -o eth1.2 -s 10.0.0.1 -d 10.0.0.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.2 -o eth1.3 -s 10.0.0.0/24 -d 10.0.2.0/24 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.2 -o ath0 -s 10.0.0.0/24 -d 10.0.1.0/24 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.2 -o eth1.5 -s 10.0.0.0/24 -d 10.10.0.0/24 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.2 -o eth0 -s 10.0.0.0/24 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/24 -j SNAT --to 82.153.32.153
+ iptables -A FORWARD -i eth1.3 -o eth1.2 -s 10.0.2.0/24 -d 10.0.0.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.3 -o ath0 -s 10.0.2.0/24 -d 10.0.1.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.3 -o eth1.5 -s 10.0.2.0/24 -d 10.10.0.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.3 -o eth0 -s 10.0.2.0/24 -p udp -d 212.104.130.9 --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.3 -o eth0 -s 10.0.2.0/24 -p udp -d 212.104.130.65 --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.3 -o eth0 -s 10.0.2.0/24 -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.3 -o eth0 -s 10.0.2.0/24 -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.3 -o eth0 -s 10.0.2.0/24 -p tcp --dport 20 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.3 -o eth0 -s 10.0.2.0/24 -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.3 -o eth0 -s 10.0.2.0/24 -p tcp --dport 6667 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -t nat -A POSTROUTING -o eth0 -s 10.0.2.0/24 -j SNAT --to 82.153.32.153
+ iptables -A FORWARD -i eth0 -o eth1.2 -d 10.0.0.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth0 -o eth1.2 -d 10.0.0.0/24 -p tcp --dport 32825 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth0 -o eth1.3 -d 10.0.2.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth0 -o ath0 -d 10.0.1.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth0 -o eth1.4 -d 10.0.3.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth0 -o eth1.5 -d 10.10.0.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT
+ iptables -t nat -A PREROUTING -i eth0 -p tcp -d 82.153.32.153 --dport 32825 -j DNAT --to-destination 10.0.0.2
+ iptables -A FORWARD -i ath0 -o eth1.2 -s 10.0.1.0/24 -d 10.0.0.0/24 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i ath0 -o eth1.3 -s 10.0.1.0/24 -d 10.0.2.0/24 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i ath0 -o eth1.5 -s 10.0.1.0/24 -d 10.10.0.0/24 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i ath0 -o eth0 -s 10.0.1.0/24 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -t nat -A POSTROUTING -o eth0 -s 10.0.1.0/24 -j SNAT --to 82.153.32.153
+ iptables -A FORWARD -i eth1.4 -o eth0 -s 10.0.3.0/24 -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.3 -o eth0 -s 10.0.3.0/24 -p udp -d 212.104.130.9 --dport 53 -m state --state NEW,ESTABLISHED,RELATED
+ iptables -A FORWARD -i eth1.3 -o eth0 -s 10.0.3.0/24 -p udp -d 212.104.130.65 --dport 53 -m state --state NEW,ESTABLISHED,RELATED
+ iptables -t nat -A POSTROUTING -o eth0 -s 10.0.3.0/24 -j SNAT --to 82.153.32.153
+ iptables -A FORWARD -i eth1.5 -o eth1.2 -s 10.10.0.0/24 -d 10.0.0.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.5 -o eth1.3 -s 10.10.0.0/24 -d 10.0.2.0/24 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.5 -o ath0 -s 10.10.0.0/24 -d 10.0.1.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.5 -o eth0 -s 10.10.0.0/24 -p tcp --dport 20 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.5 -o eth0 -s 10.10.0.0/24 -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.5 -o eth0 -s 10.10.0.0/24 -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+ iptables -A FORWARD -i eth1.5 -o eth0 -s 10.10.0.0/24 -p udp -d 212.104.130.9 --dport 53 -m state --state NEW,ESTABLISHED,RELATED
+ iptables -A FORWARD -i eth1.5 -o eth0 -s 10.10.0.0/24 -p udp -d 212.104.130.65 --dport 53 -m state --state NEW,ESTABLISHED,RELATED
+ iptables -t nat -A POSTROUTING -o eth0 -s 10.10.0.0/24 -j SNAT --to 82.153.32.153
root@gw:/etc/rc.d#