#!/bin/sh
# Copyright (C) 2006 OpenWrt.org
iptables -F input_rule
iptables -F output_rule
iptables -F forwarding_rule
iptables -t nat -F prerouting_rule
iptables -t nat -F postrouting_rule
# The following chains are for traffic directed at the IP of the
# WAN interface
iptables -F input_wan
iptables -F forwarding_wan
iptables -t nat -F prerouting_wan
### allow ipsec traffic from your wan port to the router
iptables -A input_wan -p esp -j ACCEPT # allow IPSEC
iptables -A input_wan -p udp --dport 500 -j ACCEPT # allow ISAKMP
iptables -A input_wan -p udp --dport 4500 -j ACCEPT # allow NAT-T
### disable nat for the remote peer subnet, in this example 192.168.2.0/24
iptables -t nat -A postrouting_rule -d 172.16.0.0/16 -j ACCEPT
iptables -t nat -A postrouting_rule -d 172.22.0.0/16 -j ACCEPT
iptables -t nat -A postrouting_rule -d 192.168.0.0/16 -j ACCEPT
### Allow any traffic between your local LAN and remote peer LAN
iptables -A forwarding_rule -i $LAN -o ipsec0 -j ACCEPT
iptables -A forwarding_rule -i ipsec0 -o $LAN -j ACCEPT
#iptables -A forwarding_rule -i ipsec0 -o $WAN -j ACCEPT
#iptables -A forwarding_rule -i $WAN -o ipsec0 -j ACCEPT
### Open port to WAN
## -- This allows port 22 to be answered by (dropbear on) the router
# iptables -t nat -A prerouting_wan -p tcp --dport 22 -j ACCEPT
# iptables -A input_wan -p tcp --dport 22 -j ACCEPT
### SSH (Dropbear running on port 2020)
## SSH: Rules for new incoming connections on tcp-2020
iptables -t nat -A prerouting_wan -p tcp --dport 2020 -m state --state NEW \
-m recent --name ATTACKER_SSH --rsource --update --seconds 60 --hitcount 10 -j DROP
iptables -t nat -A prerouting_wan -p tcp --dport 2020 -m state --state NEW \
-m recent --name ATTACKER_SSH --rsource --set
## SSH
iptables -A input_wan -p tcp --dport 2020 -m state --state NEW -j ACCEPT
### Port forwarding
## -- This forwards port 8080 on the WAN to port 80 on 192.168.1.2
# iptables -t nat -A prerouting_wan -p tcp --dport 8080 -j DNAT --to 192.168.1.2:80
# iptables -A forwarding_wan -p tcp --dport 80 -d 192.168.1.2 -j ACCEPT
### DMZ
## -- Connections to ports not handled above will be forwarded to 192.168.1.2
# iptables -t nat -A prerouting_wan -j DNAT --to 192.168.1.2
# iptables -A forwarding_wan -d 192.168.1.2 -j ACCEPT
##Squid Redirect Port 80 to 3128
# iptables -t nat -A prerouting_rule -i $LAN -p tcp --dport 80 -j REDIRECT --to-port 3128
### Web Interface Access
## -- This allows Web Interface Access VIA WAN
iptables -A input_rule -i $WAN -p tcp --dport 8088 -j ACCEPT
### Allow ICMP From LAN to WAN
iptables -A forwarding_rule -p ICMP -j ACCEPT
### Allow Ports From LAN to WAN
# iptables -A forwarding_rule -p TCP -i $LAN -s 192.168.250.104 -m multiport --dport 22,80,443 -j ACCEPT
iptables -A forwarding_rule -p TCP -i $LAN -o $WAN --dport 22,80,443 -j ACCEPT
### Block Ports From LAN to WAN
iptables -A forwarding_rule -j DROP