Something

#public ip=200.200.200.1 $external
external="eth0"

#eth1 ip=10.0.2.1 dmz
dmz="eth1"

#eth2 ip=10.0.1.1 intranet (firewall)
internal_fw="eth2"

webserver="10.0.2.3"
dnsserver="10.0.2.2"
mailserver="10.0.2.2"

# Flush chains and set policies
iptables -n -L
iptables -X
iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# Allow all loopback traffic no matter what
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# State rules 
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow dns out from the firewall itself
iptables -A OUTPUT -o $external -p tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -o $external -p udp --dport 53 -j ACCEPT

# Allow ping requests and replies in and out of the firewall (state rules will catch replies)
iptables -A INPUT -i $external -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT
iptables -A OUTPUT -o $external -p icmp --icmp-type 0 -j ACCEPT
iptables -A OUTPUT -o $external -p icmp --icmp-type 8 -j ACCEPT

# Send http requests coming in from the internet to the webserver
iptables -t nat -A PREROUTING -i $external -p tcp -d 200.200.200.1 --dport 80 -j DNAT --to-destination $webserver:80
iptables -t nat -A PREROUTING -i $external -p tcp -d 200.200.200.1 --dport 443 -j DNAT --to-destination $webserver:443
iptables -A FORWARD -i $external -o $dmz -p tcp --dport 80 -d $webserver -j ACCEPT
iptables -A FORWARD -i $external -o $dmz -p tcp --dport 443 -d $webserver -j ACCEPT

# Send DNS requests coming in from the internet to the DNS server
iptables -t nat -A PREROUTING -i $external -p tcp -d 200.200.200.1 --dport 53 -j DNAT --to-destination $dnsserver:53
iptables -t nat -A PREROUTING -i $external -p udp -d 200.200.200.1 --dport 53 -j DNAT --to-destination $dnsserver:53
iptables -A FORWARD -i $external -o $dmz -p tcp --dport 53 -d $dnsserver -j ACCEPT
iptables -A FORWARD -i $external -o $dmz -p udp --dport 53 -d $dnsserver -j ACCEPT

# Send mail coming in from the internet to the mail server
iptables -t nat -A PREROUTING -i $external -p tcp -d 200.200.200.1 --dport 25 -j DNAT --to-destination $mailserver:25
iptables -A FORWARD -i $external -o $dmz -p tcp --dport 25 -d $mailserver -j ACCEPT

# Allow ssh from inside the LAN to <somehost> in DMZ
iptables -A PREROUTING -i $internal_fw --dport 22 -j DNAT --to-destination <somehost_in_DMZ>
iptables -A FORWARD -i $internal_fw -o $dmz -p tcp --dport 22 -j ACCEPT

# Allow everything passed by the internal firewall to go out
iptables -A FORWARD -i $internal_fw -o $external -j ACCEPT