#somewhat very basic iptables stuff#by xbow in 2k7#comments and suggestions welcome#reach me at freenode #vmware, #linux#use what you need of it#no warranty whatsoever#some varsIPTABLES="/sbin/iptables"EXTIF="eth0"INTIF="vmnetx" # <- place your vmnet device here, but you can also comment out the corresponding -i $INTIF or -o $INTIF directive within the rules further below#specify ip of the internal client$INTCL="192.168.140.128"#ports to be forwardedNATPORTS="5900" #<-- specify here which ports you need on your client to be accessable from the internet..here port for vnc#flush all tables (which means reset all rules)$IPTABLES -F$IPTABLES -t nat -F#delete chains (get recreated on first use)$IPTABLES -X$IPTABLES -t nat -X#set policies $IPTABLES -P INPUT DROP # (DENY all incoming connections other than allowed by rules below)$IPTABLES -P OUTPUT DROP # (this is very restrictive and you would have to explicitly allow any port for OUTGOING as well..default is ACCEPT, I prefer DROP and specify which ports to let out$IPTABLES -P FORWARD ACCEPT # allow packet forwarding#be sure ip forwarding is enabled on the routerecho "1" > /proc/sys/net/ipv4/ip_forward#conntrack to keep track of connections..needed for passive ftp i.e./sbin/modprobe ip_conntrack/sbin/modprobe ip_conntrack_ftp/sbin/modprobe ip_conntrack_irc#loading nat modules/sbin/modprobe iptable_nat/sbin/modprobe ip_nat_ftp##above modules could have also been already compiled into your kernel..modprobing won't hurt#accept any connection incoming and outgoing to one having already been established or in any way related to $IPTABLES -A INPUT -p all -i $EXTIF -m state --state established,related -j ACCEPT$IPTABLES -A OUTPUT -p all -o $EXTIF -m state --state established,related -j ACCEPT#let ports to be forwarded pass in at first, also let those back out againfor PROTO in tcp udp; do for PORT in $NATPORTS; do $IPTABLES -A INPUT -p $PROTO -m $PROTO -i $EXTIF --dport $PORT --sport 1024:65535 -j ACCEPT $IPTABLES -A OUTPUT -p $PROTO -m $PROTO -o $EXTIF --sport $PORT --dport 1024:65535 -m state --state new,established,related -j ACCEPT done;done;#nat/port forwardingfor PROTO in tcp udp; do for PORT in $NATPORTS; do $IPTABLES -t nat -A PREROUTING -p $PROTO -i $EXTIF --dport $PORT --sport 1024:65535 -j DNAT --to-destination $INTCL $IPTABLES -A FORWARD -p $PROTO -i $EXTIF -o $INTIF -d $INTCL --dport $PORT --sport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT done;done;