rendered paste body# iptables rules for funky setup - vmware machines + checkpoint
# turn off ip forwarding
echo "0" > /proc/sys/net/ipv4/ip_forward
# flush + zero everything first
iptables -F
iptables -t nat -F
iptables -Z
# turn off ip forwarding
echo "1" > /proc/sys/net/ipv4/ip_forward
# variables
#LO_IFACE="lo"
#LO_IP="127.0.0.1"
#LAN_IP="192.168.0.2"
#LAN_IP_RANGE="192.168.0.0/16"
#LAN_IFACE="eth1"
# basic access rules
#iptables -P INPUT DROP
#iptables -P OUTPUT DROP
#iptables -P FORWARD DROP
iptables -A INPUT -p tcp --syn -j ACCEPT
iptables -A INPUT -p all -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -p all -j ACCEPT
iptables -A INPUT -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -A INPUT -p tcp -s 10.116.5.0/24 --dport 22 -j ACCEPT
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP
# masq rule
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# DNAT rules
# NAT for mtechdemo
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 2200 -j DNAT --to 192.168.13.128:22
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25673 -j DNAT --to 192.168.13.128:25673
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 23025 -j DNAT --to 192.168.13.128:23025
# NAT for Checkpoint VPN-1 router
iptables -t nat -A PREROUTING -i eth0 --source 146.109.240.0/24 -j DNAT --to 192.168.16.2
iptables -t nat -A PREROUTING -i eth0 --source 84.74.95.0/24 -j DNAT --to 192.168.16.2
iptables -t nat -A PREROUTING -i eth0 --source 150.101.122.0/24 -j DNAT --to 192.168.16.2
-- routing table --
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.16.0 * 255.255.255.252 U 0 0 0 eth1
172.16.16.0 * 255.255.255.0 U 0 0 0 eth0
192.168.13.0 * 255.255.255.0 U 0 0 0 vmnet1
169.254.0.0 * 255.255.0.0 U 0 0 0 eth1
default 172.16.16.254 0.0.0.0 UG 0 0 0 eth0