rendered paste bodyroot@gw:/etc/rc.d# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
172.16.1.0 0.0.0.0 255.255.255.248 U 0 0 0 eth0
172.16.1.0 0.0.0.0 255.255.255.248 U 0 0 0 eth0
10.0.1.0 0.0.0.0 255.255.255.240 U 0 0 0 ath0
10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1.2
10.10.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1.5
10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1.3
10.0.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1.4
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 172.16.1.1 0.0.0.0 UG 0 0 0 eth0
root@gw:/etc/rc.d#
#!/bin/bash -x
iptables='/usr/local/sbin/iptables'
# safenet = where non-trusted boxes sit - do not trust on local network at all #
# lan = local area (safe) network #
# dmz = server network that cannot touch anything other than wan #
# alp = ayrshire lan party that cannot touch anything other than wan and dmz #
# wan = Internet Connectivity #
# wlan = Wireless network - Secured with WPA Enterprise #
# flush existing settings
$iptables -F
$iptables -X
$iptables -t nat -F
# drop all by default
$iptables -P INPUT DROP
$iptables -P OUTPUT DROP
$iptables -P FORWARD DROP
# interfaces
wanif="eth0"
wlanif="ath0"
lanif="eth1.2"
dmzif="eth1.3"
safeif="eth1.4"
alpif="eth1.5"
# networks
wannet=""
wlannet="10.0.1.0/24"
lannet="10.0.0.0/24"
dmznet="10.0.2.0/24"
safenet="10.0.3.0/24"
alpnet="10.10.0.0/24"
# ip(s)
lanip="10.0.0.1"
wlanip="10.0.1.1"
dmzip="10.0.2.1"
safeip="10.0.3.1"
alpip="10.10.0.1"
# nat
#natextip="217.151.109.185"
natextip="172.16.1.2"
# dns
nameserver1="217.151.98.2"
nameserver2="217.151.103.2"
# fix arp and conntrack limits
echo 16 > /proc/sys/net/ipv4/neigh/default/gc_thresh1
echo 256 > /proc/sys/net/ipv4/neigh/default/gc_thresh2
echo 2048 > /proc/sys/net/ipv4/neigh/default/gc_thresh3
echo 65000 > /proc/sys/net/ipv4/ip_conntrack_max
## WAN ##
## [FORWARD] WAN --> LAN ##
$iptables -A FORWARD -i $wanif -o $lanif -d $lannet -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $wanif -o $lanif -d $lannet -p tcp --dport 32825 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $wanif -o $lanif -d $lannet -p tcp --dport 6346 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] WAN --> DMZ ##
$iptables -A FORWARD -i $wanif -o $dmzif -d $dmznet -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $wanif -o $dmzif -d $dmznet -p tcp --dport 6667 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $wanif -o $dmzif -d $dmznet -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $wanif -o $dmzif -d $dmznet -p tcp --dport 443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $wanif -o $dmzif -d $dmznet -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $wanif -o $dmzif -d $dmznet -p tcp --dport 993 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $wanif -o $dmzif -d $dmznet -p tcp --dport 995 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] WAN --> WLAN ##
$iptables -A FORWARD -i $wanif -o $wlanif -d $wlannet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] WAN --> SAFENET ##
$iptables -A FORWARD -i $wanif -o $safeif -d $safenet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] WAN --> ALP ##
$iptables -A FORWARD -i $wanif -o $alpif -d $alpnet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [NAT] WAN --> LAN ##
$iptables -t nat -A PREROUTING -i $wanif -p tcp -d $natextip --dport 32825 -j DNAT --to-destination 10.0.0.2
$iptables -t nat -A PREROUTING -i $wanif -p tcp -d $natextip --dport 6346 -j DNAT --to-destination 10.0.0.2
## [NAT] WAN --> DMZ ##
# iptables -t nat -A PREROUTING -p tcp -d $natextip --dport 995 -j DNAT --to-destination 10.0.2.10
## LAN ##
## [INPUT] LAN --> GATEWAY ##
$iptables -A INPUT -i $lanif -s $lannet -p tcp -d $lanip --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [OUTPUT] GATEWAY --> LAN ##
$iptables -A OUTPUT -o $lanif -s $lanip -d $lannet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] LAN --> DMZ ##
$iptables -A FORWARD -i $lanif -o $dmzif -s $lannet -d $dmznet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] LAN --> WLAN ##
$iptables -A FORWARD -i $lanif -o $wlanif -s $lannet -d $wlannet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] LAN --> ALP ##
$iptables -A FORWARD -i $lanif -o $alpif -s $lannet -d $alpnet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] LAN --> WAN ##
$iptables -A FORWARD -i $lanif -o $wanif -s $lannet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [NAT] LAN --> INTERNET ##
$iptables -t nat -A POSTROUTING -o $wanif -s $lannet -j SNAT --to $natextip
## DMZ ##
## [FORWARD] DMZ --> LAN ##
$iptables -A FORWARD -i $dmzif -o $lanif -s $dmznet -d $lannet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] DMZ --> WLAN ##
$iptables -A FORWARD -i $dmzif -o $wlanif -s $dmznet -d $wlannet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] DMZ --> ALP ##
$iptables -A FORWARD -i $dmzif -o $alpif -s $dmznet -d $alpnet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] DMZ --> WAN ##
$iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p udp -d $nameserver1 --dport 53 -m state --state NEW,ESTABLISHED,RELATE$
$iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p udp -d $nameserver2 --dport 53 -m state --state NEW,ESTABLISHED,RELATE$
$iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 20 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $dmzif -o $wanif -s $dmznet -p tcp --dport 6667 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [NAT] DMZ --> INTERNET ##
$iptables -t nat -A POSTROUTING -o $wanif -s $dmznet -j SNAT --to $natextip
## WLAN ##
## [FORWARD] WLAN --> LAN ##
$iptables -A FORWARD -i $wlanif -o $lanif -s $wlannet -d $lannet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] WLAN --> DMZ ##
$iptables -A FORWARD -i $wlanif -o $dmzif -s $wlannet -d $dmznet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] WLAN --> ALP ##
$iptables -A FORWARD -i $wlanif -o $alpif -s $wlannet -d $alpnet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] WLAN --> WAN ##
$iptables -A FORWARD -i $wlanif -o $wanif -s $wlannet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [NAT] WLAN --> INTERNET ##
$iptables -t nat -A POSTROUTING -o $wanif -s $wlannet -j SNAT --to $natextip
## SAFENET ##
## [FORWARD] SAFENET --> WAN ##
$iptables -A FORWARD -i $safeif -o $wanif -s $safenet -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $safeif -o $wanif -s $safenet -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $dmzif -o $wanif -s $safenet -p udp -d $nameserver1 --dport 53 -m state --state NEW,ESTABLISHED,RELAT$
$iptables -A FORWARD -i $dmzif -o $wanif -s $safenet -p udp -d $nameserver2 --dport 53 -m state --state NEW,ESTABLISHED,RELAT$
## [NAT] SAFENET --> INTERNET ##
$iptables -t nat -A POSTROUTING -o $wanif -s $safenet -j SNAT --to $natextip
## ALP ##
## [FORWARD] ALP --> LAN ##
$iptables -A FORWARD -i $alpif -o $lanif -s $alpnet -d $lannet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] ALP --> DMZ ##
$iptables -A FORWARD -i $alpif -o $dmzif -s $alpnet -d $dmznet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] ALP --> WLAN ##
$iptables -A FORWARD -i $alpif -o $wlanif -s $alpnet -d $wlannet -m state --state ESTABLISHED,RELATED -j ACCEPT
## [FORWARD] ALP --> WAN ##
$iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p tcp --dport 20 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p udp -d $nameserver1 --dport 53 -m state --state NEW,ESTABLISHED,RELATED
$iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -p udp -d $nameserver2 --dport 53 -m state --state NEW,ESTABLISHED,RELATED
# temp #
$iptables -A FORWARD -i $alpif -o $wanif -s $alpnet -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
## [NAT] ALP --> INTERNET ##
$iptables -t nat -A POSTROUTING -o $wanif -s $alpnet -j SNAT --to $natextip