rendered paste body#public ip=200.200.200.1 eth0
#eth1 ip=10.0.2.1 dmz
eth1="eth0"
#eth2 ip=10.0.1.1 intranet (firewall)
eth2="eth0"
webserver="10.0.2.3"
dnsserver="10.0.2.2"
mailserver="10.0.2.2"
#Configuring iptables rules
iptables -n -L
iptables -X
iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -s 200.200.200.1 --dport 80 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -s 200.200.200.1 --dport 443 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -s 200.200.200.1 --dport 25 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -s 200.200.200.1 --dport 53 -j ACCEPT
iptables -A INPUT -i eth0 -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT
iptables -A OUTPUT -o eth0 -p icmp --icmp-type 0 -j ACCEPT
iptables -A INPUT -i eth0 -p icmp --icmp-type 0 -j ACCEPT
iptables -A OUTPUT -o eth0 -p icmp --icmp-type 8 -j ACCEPT
#PREROUTING DMZ
iptables -t nat -A PREROUTING -i eth0 -p tcp -d 200.200.200.1 --dport 80 -j DNAT --to-destination $webserver:80
iptables -A FORWARD -i eth0 -o $eth1 -p tcp --dport 80 -d $webserver -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p tcp -d 200.200.200.1 --dport 443 -j DNAT --to-destination $webserver:443
iptables -A FORWARD -i eth0 -o $eth1 -p tcp --dport 443 -d $webserver -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p tcp -d 200.200.200.1 --dport 53 -j DNAT --to-destination $dnsserver:56
iptables -A FORWARD -i eth0 -o $eth1 -p tcp --dport 53 -d $dnsserver -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p udp -d 200.200.200.1 --dport 53 -j DNAT --to-destination $dnsserver:56
iptables -A FORWARD -i eth0 -o $eth1 -p udp --dport 53 -d $dnsserver -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p tcp -d 200.200.200.1 --dport 25 -j DNAT --to-destination $mailserver:25
iptables -A FORWARD -i eth0 -o $eth1 -p tcp --dport 25 -d $mailserver -j ACCEPT
#POSTROUTING DMZ
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 200.200.200.1
# The below is not possible - traffic in the FORWARD chain is by definition going from one interface
# to another -- something is wrong here
iptables -A FORWARD -i eth0 -o eth0 -p tcp -s 10.0.2.0/24 --sport 1024: -d ! 10.0.2.1 --dport :1023 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth0 -p tcp -s ! 10.0.2.0/24 --sport :1023 -d 10.0.2.1 --dport 1024: -j ACCEPT
iptables -A FORWARD -i eth0 -o eth0 -p udp -s 10.0.2.0/24 --sport 1024: -d ! 10.0.2.1 --dport :1023 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth0 -p udp -s ! 10.0.2.0/24 --sport :1023 -d 10.0.2.1 --dport 1024: -j ACCEPT
iptables -A FORWARD -i eth0 -o eth0 -p icmp -s 10.0.2.0/24 -d ! 10.0.2.1 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth0 -p icmp -s ! 10.0.2.0/24 -d 10.0.2.1 -j ACCEPT