Mine

config policy lan
        option nat      wan

config accept ssh
        option proto tcp
        option dport 22
----------------------------------------

config_cb() {
	config_get TYPE "$CONFIG_SECTION" TYPE
	case "$TYPE" in
		policy)
			option_cb() {
				case "$1" in
					allow)
						# Allow connections between networks
						config_get iface1 "$CONFIG_SECTION" ifname
						config_get iface2 $2 ifname
						iptables -A FORWARD -i $iface1 -o $iface2 -j ACCEPT
					;;
					nat)
						config_get LAN_MASK "$CONFIG_SECTION" netmask
						config_get LAN_IP "$CONFIG_SECTION" ipaddr
						LAN_NET=$(/bin/ipcalc.sh $LAN_IP $LAN_MASK | grep NETWORK | cut -d= -f2)
						iptables -t nat -A POSTROUTING --src $LAN_NET/$LAN_MASK -o $2 -j MASQUERADE
					;;
				esac
			}
		;;
		forward)
			config_get proto "$CONFIG_SECTION" proto
			config_get dport "$CONFIG_SECTION" dport
			config_get dports "$CONFIG_SECTION" dports
			config_get sport "$CONFIG_SECTION" sport
			config_get sports "$CONFIG_SECTION" sports
			config_get dest "$CONFIG_SECTION" dest
			config_get source "$CONFIG_SECTION" source
			config_get target "$CONFIG_SECTION" target

			sports=`echo $sports | sed 's/-/:/'`
			dports=`echo $dports | sed 's/-/:/'`
			[ -n "$dports" ] && dports="-m multiport --dports $dports"
			[ -n "$sports" -a -z "$dports" ] && sports="-m multiport --sports $sports"
			[ -n "$sports" -a -n "$dports" ] && sports="--sports $sports"

			iptables -A PREROUTING -t nat -p $proto ${source:+ --source $source} ${dest:+ -d $dest} ${dport:+ --dport $dport} ${dports:+ $dports} ${sports:+ $sports} -j DNAT --to $target
			iptables -A FORWARD -p $proto -m state --state NEW ${source:+ --source $source} ${dest:+ -d $dest} ${dport:+ --dport $dport} ${dports:+ $dports} ${sports:+ $sports} -j ACCEPT
		;;
		accept)
			config_get proto "$CONFIG_SECTION" proto
			config_get dport "$CONFIG_SECTION" dport
			config_get dports "$CONFIG_SECTION" dports
			config_get sport "$CONFIG_SECTION" sport
			config_get sports "$CONFIG_SECTION" sports
			config_get dest "$CONFIG_SECTION" dest
			config_get source "$CONFIG_SECTION" source

			sports=`echo $sports | sed 's/-/:/'`
			dports=`echo $dports | sed 's/-/:/'`
			[ -n "$dports" ] && dports="-m multiport --dports $dports"
			[ -n "$sports" -a -z "$dports" ] && sports="-m multiport --sports $sports"
			[ -n "$sports" -a -n "$dports" ] && sports="--sports $sports"

			iptables -A INPUT -p $proto -m state --state NEW ${source:+ --source $source} ${dest:+ -d $dest} ${dport:+ --dport $dport} ${dports:+ $dports} ${sports:+ $sports} -j ACCEPT
		;;
			
	esac
}