#Add the Iptables masquerade module(s)
modprobe ipt_MASQUERADE
# Flush out the current iptables filter table rules.
iptables -F;
iptables -t nat -F;
iptables -t mangle -F;
# filter table. contains the built-in chains
# INPUT (for packets coming into the box itself),
# FORWARD (for packets being routed through the box),
# OUTPUT (for locally-generated packets).
# In the NAT table. Append to the POSTROUTING chain, a rule that on output to interface eth1
# performs an action to ? map the source ip address of the outgoing
# packet to be the ip address of the interface it is going out on, eg -
# make it look like it originated on eth1.
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
# turn on ip forwarding. (yes, this is an obscure control.)
echo 1 > /proc/sys/net/ipv4/ip_forward
# turn off ignoring icmp requests
echo 0 >/proc/sys/net/ipv4/icmp_echo_ignore_all
#
# Block spoofed (should only be local) addresses
iptables -A INPUT -i eth0 -s 10.0.0.0/8 -j DROP
iptables -A INPUT -i eth0 -s 172.16/12 -j DROP
iptables -A INPUT -i eth0 -s 192.168/12 -j DROP
# let in identd requests
#iptables -A INPUT -i eth0 -p TCP --dport 113 -j ACCEPT
#iptables -A INPUT -i eth0 -p UDP --dport 113 -j ACCEPT
# let in ssh on eth0
#iptables -A INPUT -i eth0 -p TCP --dport 22 -j ACCEPT
#iptables -A INPUT -i eth0 -p UDP --dport 22 -j ACCEPT
# IN the filter table (the default) Append a rule to the INPUT chain that says
# accept incoming packets from interface eth1 which are coming into connect to port
# 25 for SMTP access. And port 113 for identd access
iptables -A INPUT -i eth0 -p TCP --dport 25 -j ACCEPT
iptables -A INPUT -i eth0 -p TCP --dport 88 -j ACCEPT
iptables -A INPUT -i eth0 -p TCP --dport 443 -j ACCEPT
# SMB / Windows filesharing, don't let it outside this LAN
iptables -A FORWARD -p tcp --sport 137 -j DROP
iptables -A FORWARD -p udp --sport 137 -j DROP
iptables -A FORWARD -p tcp --sport 138 -j DROP
iptables -A FORWARD -p udp --sport 138 -j DROP
iptables -A FORWARD -p tcp --sport 139 -j DROP
iptables -A FORWARD -p udp --sport 139 -j DROP
# IN the filter table (the default) Append a rule to the INPUT chain that says
# accept incoming packets which are part of an already established connection
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# IN the filter table (the default) Append a rule to the INPUT chain that says
# accept incoming packets that are starting new connections from any interface EXCEPT eth1.
iptables -A INPUT -m state --state NEW -i ! eth0 -j ACCEPT
# iptables -A INPUT -j LOG --log-prefix "New not syn:"
# iptables -A INPUT -j LOG --log-prefix "New not syn:"
iptables -P INPUT DROP #only if the first two are succesful
iptables -A INPUT -p UDP --sport 67 --dport 68 -j DROP