rendered paste body*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:RH-Lokkit-0-50-INPUT - [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -j RH-Lokkit-0-50-INPUT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 53 -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 4661 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 53 -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 4672 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2425 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2627 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 22 -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT
-A RH-Lokkit-0-50-INPUT -i eth1 -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -p icmp --icmp-type echo-request -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -i eth1 -p tcp -m tcp --dport 110 -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -s eth0 -p tcp --dport 143 -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -i eth1 -p tcp -m tcp --dport 8080 -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -i eth1 -p tcp -m tcp --dport 1234 -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -i eth1 -p udp -m udp --dport 8080 -j ACCEPT
#-A RH-Lokkit-0-50-INPUT -i eth1 -p udp -m udp --dport 1234 -j ACCEPT
#-A INPUT -p tcp -m state --state RELATED -j ACCEPT
-A INPUT -p tcp -m state --state NEW,INVALID -j DROP
COMMIT
*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
###################################
# http to bedef.cl
-A POSTROUTING -s 192.168.1.0/255.255.255.0 -j MASQUERADE
-A PREROUTING -p tcp -d 203.54.49.50 -i eth0 --dport 80 -j DNAT --to 192.168.1.15:80
-A PREROUTING -i eth0 -p tcp -d 203.54.49.50 --dport 110 -j DNAT --to 192.168.1.14:110
-A PREROUTING -p tcp -d 203.54.49.50 -i eth0 --dport 22 -j DNAT --to 192.168.1.15:22
-A PREROUTING -p tcp -d 203.54.49.51 -i eth0 --dport 2121 -j DNAT --to 192.168.1.14:2121
#Desde aqui parte los nateos hacia el servidor Debian o otro server con ip.24
#aqui hay un preruteo de la .50 con el puerto 2222 y va al server debian ssh
-A PREROUTING -p tcp -d 203.54.49.50 -i eth0 --dport 2222 -j DNAT --to 192.168.1.24:22
-A PREROUTING -p tcp -d 203.54.49.52 -i eth0 --dport 80 -j DNAT --to 192.168.1.24:80
-A PREROUTING -p tcp -d 203.54.49.52 -i eth0 --dport 53 -j DNAT --to 192.168.1.24:53
#aqui termina el 24
-A PREROUTING -p tcp -d 203.54.49.50 -i eth0 --dport 443 -j DNAT --to 192.168.1.15:443
-A PREROUTING -p tcp -d 203.54.49.51 -i eth0 --dport 80 -j DNAT --to 192.168.1.14:80
-A PREROUTING -p tcp -d 203.54.49.51 -i eth0 --dport 2627 -j DNAT --to 192.168.1.14:2627
-A PREROUTING -p tcp -d 203.54.49.50 -i eth0 --dport 2627 -j DNAT --to 192.168.1.14:2627
-A PREROUTING -p tcp -d 203.54.49.51 -i eth0 --dport 443 -j DNAT --to 192.168.1.14:443
-A PREROUTING -p tcp -d 203.54.49.51 -i eth0 --dport 25 -j DNAT --to 192.168.1.14:25
# Servers allow all
-A POSTROUTING -s 192.168.1.1/255.255.255.0 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.2/255.255.255.0 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.3/255.255.255.0 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.4/255.255.255.0 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.5/255.255.255.0 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.6/255.255.255.0 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.7/255.255.255.0 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.8/255.255.255.0 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.14/255.255.255.0 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.15/255.255.255.0 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.24/255.255.255.0 -d 0.0.0.0/0 -j MASQUERADE
# ########################################################################
# Users, only http and https
-A POSTROUTING -s 192.168.1.21/255.255.255.0 -p tcp -m tcp --dport 80 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.22/255.255.255.0 -p tcp -m tcp --dport 80 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.23/255.255.255.0 -p tcp -m tcp --dport 80 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.25/255.255.255.0 -p tcp -m tcp --dport 80 -d 0.0.0.0/0 -j MASQUERADE
###### HTTPS
-A POSTROUTING -s 192.168.1.21/255.255.255.0 -p tcp -m tcp --dport 443 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.22/255.255.255.0 -p tcp -m tcp --dport 443 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.23/255.255.255.0 -p tcp -m tcp --dport 443 -d 0.0.0.0/0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.25/255.255.255.0 -p tcp -m tcp --dport 443 -d 0.0.0.0/0 -j MASQUERADE
###############################################################################
# Forward HTTP connections to Squid proxy
#-A PREROUTING -p tcp -m tcp -i eth0 --dport 80 -j REDIRECT --to-ports 3128
#-A PREROUTING -p udp -m udp -i eth0 --dport 53 -j DNAT --to 192.168.1.2
#-A PREROUTING -p tcp -m tcp -i eth0 --dport 53 -j DNAT --to 192.168.1.2
COMMIT
# Completed