rendered paste body#!/bin/bash# Define interfaces and subnetsWAN="eth0"LAN="eth1"LOCAL="192.168.1.0/24"TRUSTED="192.168.1.0/25"UNTRUSTED="192.168.1.128/25"ROUTER="192.168.0.1"# Define individual hosts (grab IPs from DNS)LITHIUM=$(host -t A lithium | grep address | awk '{ print $NF }')EAGLE=$(host -t A eagle | grep address | awk '{ print $NF }')DEEPTHOUGHT=$(host -t A deepthought | grep address | awk '{ print $NF }')DRIFTER=$(host -t A drifter | grep address | awk '{ print $NF }')SERVER1=$(host -t A server1 | grep address | awk '{ print $NF }')# Flush tablesiptables -Fiptables -t nat -F# Set policiesiptables -P INPUT DROPiptables -P FORWARD DROPiptables -P OUTPUT ACCEPT# Set general rulesiptables -A INPUT -i lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT # Allow everything from localhost to localhostiptables -A INPUT -i ${LAN} -s ${TRUSTED} -j ACCEPT # Allow all packets from trusted LANiptables -A FORWARD -i ${LAN} -s ${LOCAL} -d ! ${LOCAL} -j ACCEPT # Prevent bouncing packets from broken hosts, and allow outgoingiptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Allow all established connectionsiptables -A FORWARD -i ${WAN} -d ${LOCAL} -m state --state ESTABLISHED,RELATED -j ACCEPTiptables -A INPUT -s ${ROUTER} -j ACCEPT # Allow communication with routeriptables -A FORWARD -s ${ROUTER} -j ACCEPTiptables -A INPUT -i ${WAN} -s 192.168.0.0/16 -j DROP # Stop spoofed packets from the net :)iptables -A INPUT -i ${WAN} -s 10.0.0.0/8 -j DROPiptables -A INPUT -i ${WAN} -s 172.16.0.0/12 -j DROP# Protect from untrusted LANiptables -A INPUT -i ${LAN} -s ${UNTRUSTED} -p tcp --dport 53 -j ACCEPT # Allow DNSiptables -A INPUT -i ${LAN} -s ${UNTRUSTED} -p udp --dport 53 -j ACCEPTiptables -A INPUT -i ${LAN} -s ${UNTRUSTED} -p tcp --dport 22 -j ACCEPT # Allow SSHiptables -A INPUT -i ${LAN} -s ${UNTRUSTED} -p all -j DROP # Drop everything else# Port forwarding for servers#iptables -A FORWARD -i ${WAN} -p tcp --dport 22 -j ACCEPT # SSH (shell server)#iptables -t nat -A PREROUTING -p tcp --dport 22 -i ${WAN} -j DNAT --to ${EAGLE}iptables -A FORWARD -i ${WAN} -p tcp --dport 25 -j ACCEPT # SMTPiptables -t nat -A PREROUTING -p tcp --dport 25 -i ${WAN} -j DNAT --to ${SERVER1}iptables -A FORWARD -i ${WAN} -p tcp --dport 80 -j ACCEPT # Apache webserveriptables -t nat -A PREROUTING -p tcp --dport 80 -i ${WAN} -j DNAT --to ${LITHIUM}iptables -A FORWARD -i ${WAN} -p tcp --dport 110 -j ACCEPT # POP3iptables -t nat -A PREROUTING -p tcp --dport 110 -i ${WAN} -j DNAT --to ${SERVER1}iptables -A FORWARD -i ${WAN} -p tcp --dport 143 -j ACCEPT # IMAPiptables -t nat -A PREROUTING -p tcp --dport 143 -i ${WAN} -j DNAT --to ${SERVER1}iptables -A FORWARD -i ${WAN} -p tcp --dport 993 -j ACCEPT # IMAP-SSLiptables -t nat -A PREROUTING -p tcp --dport 993 -i ${WAN} -j DNAT --to ${SERVER1}iptables -A FORWARD -i ${WAN} -p tcp --dport 995 -j ACCEPT # POP3-SSLiptables -t nat -A PREROUTING -p tcp --dport 995 -i ${WAN} -j DNAT --to ${SERVER1}iptables -A FORWARD -i ${WAN} -p tcp --dport 8767 -j ACCEPT # TeamSpeakiptables -t nat -A PREROUTING -p tcp --dport 8767 -i ${WAN} -j DNAT --to ${LITHIUM}iptables -A FORWARD -i ${WAN} -p udp --dport 8767 -j ACCEPT # TeamSpeakiptables -t nat -A PREROUTING -p udp --dport 8767 -i ${WAN} -j DNAT --to ${LITHIUM}iptables -A FORWARD -i ${WAN} -p tcp --dport 6667:6669 -j ACCEPT # IRCdiptables -t nat -A PREROUTING -p tcp --dport 6667:6669 -i ${WAN} -j DNAT --to ${LITHIUM}iptables -A FORWARD -i ${WAN} -p tcp --dport 6690:6699 -j ACCEPT # IRCd-SSLiptables -t nat -A PREROUTING -p tcp --dport 6690:6699 -i ${WAN} -j DNAT --to ${LITHIUM}# Port forwarding for other thingsiptables -A FORWARD -i ${WAN} -p tcp --dport 6881:6889 -j ACCEPT # BitTorrentiptables -t nat -A PREROUTING -p tcp --dport 6881:6889 -i ${WAN} -j DNAT --to ${DEEPTHOUGHT}iptables -A FORWARD -i ${WAN} -p udp --dport 6881:6889 -j ACCEPT # BitTorrentiptables -t nat -A PREROUTING -p udp --dport 6881:6889 -i ${WAN} -j DNAT --to ${DEEPTHOUGHT}iptables -A FORWARD -i ${WAN} -p tcp --dport 7777:7778 -j ACCEPT # UT2004iptables -t nat -A PREROUTING -p tcp --dport 7777:7778 -i ${WAN} -j DNAT --to ${DEEPTHOUGHT}iptables -A FORWARD -i ${WAN} -p udp --dport 7777:7778 -j ACCEPT # UT2004iptables -t nat -A PREROUTING -p udp --dport 7777:7778 -i ${WAN} -j DNAT --to ${DEEPTHOUGHT}iptables -A FORWARD -i ${WAN} -p tcp --dport 10777 -j ACCEPT # UT2004iptables -t nat -A PREROUTING -p tcp --dport 10777 -i ${WAN} -j DNAT --to ${DEEPTHOUGHT}iptables -A FORWARD -i ${WAN} -p udp --dport 10777 -j ACCEPT # UT2004iptables -t nat -A PREROUTING -p udp --dport 10777 -i ${WAN} -j DNAT --to ${DEEPTHOUGHT}# Enable DNAT (outgoing)iptables -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE# Log all dropped packetsiptables -A INPUT -i ${WAN} -j LOG --log-level info --log-prefix "iptables:INPUT:DROP:" # Log dropping connection attemptsiptables -A FORWARD -i ${WAN} -j LOG --log-level info --log-prefix "iptables:FORWARD:DROP:" # Log failed forwarding attempts