#!/bin/bashIPTABLES='/sbin/iptables'# Set interface valuesIFACE1='eth0'IFACE2='eth1'# enable ip forwarding in the kernel/bin/echo 1 > /proc/sys/net/ipv4/ip_forward# flush rules and delete chains$IPTABLES -F$IPTABLES -X## loopback interfaceIPTABLES -A INPUT -i lo -j ACCEPTIPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPTIPTABLES -A OUTPUT -o lo -j ACCEPT# enable masquerading to allow LAN internet access$IPTABLES -t nat -A POSTROUTING -o $IFACE1 -j MASQUERADE## forward LAN traffic from $IFACE1 to Internet interface $IFACE2IPTABLES -A FORWARD -i $IFACE2 -o $IFACE1 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPTIPTABLES -A FORWARD -i $IFACE2 -m state --state INVALID -j DROPecho -e " - Allowing access to the SSH server"IPTABLES -A INPUT --protocol tcp --dport 22 -j ACCEPTIPTABLES -A PREROUTING -p tcp -d 192.168.1.251 --dport 22 -j DNAT --to-destination 192.168.10.10echo -e " - Allowing access to the HTTP server"IPTABLES -A INPUT --protocol tcp --dport 80 -j ACCEPTIPTABLES -A PREROUTING -p tcp -d 192.168.1.251 --dport 80 -j DNAT --to-destination 192.168.10.10##forward LAN traffic from $IFACE2 to Internet $IFACE1$IPTABLES -A FORWARD -i $IFACE2 -o $IFACE1 -m state --state NEW,ESTABLISHED -j ACCEPT## block out all other Internet access on $IFACE1$IPTABLES -A INPUT -i $IFACE1 -m state --state NEW,INVALID -j DROP$IPTABLES -A FORWARD -i $IFACE1 -m state --state NEW,INVALID -j DROP