Someone

#!/bin/bashiptables -F INPUTiptables -F OUTPUTiptables -F FORWARDiptables -Fiptables -F -t natiptables -F -t mangleiptables -Xiptables -X -t natiptables -X -t mangle# Setup default policies to handle unmatched trafficpolicy_1(){iptables -P INPUT   DROPiptables -P OUTPUT  DROPiptables -P FORWARD DROP}policy_2(){iptables -P INPUT   ACCEPTiptables -P OUTPUT  ACCEPTiptables -P FORWARD ACCEPT}policy_2# My Interfacesexport LAN=eth0export WAN=eth1IP_LAN=`ifconfig $LAN | grep -e "inet addr" | awk {'print $2'} | awk -F: {'print $2'}`IP_WAN=`ifconfig $WAN | grep -e "inet addr" | awk {'print $2'} | awk -F: {'print $2'}`# Kernel Settingsecho 1 > /proc/sys/net/ipv4/ip_forwardecho 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcastsecho 0 > /proc/sys/net/ipv4/conf/all/accept_source_routeecho 0 > /proc/sys/net/ipv4/conf/all/accept_redirectsecho 0 > /proc/sys/net/ipv4/conf/all/send_redirectsecho 1 > /proc/sys/net/ipv4/conf/all/rp_filterecho 0 > /proc/sys/net/ipv4/conf/all/log_martiansfor f in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 1 > $f ; done######## NAT / PROXY #############################iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADEiptables -t nat -A PREROUTING  -i $LAN -p tcp --dport 80    -j REDIRECT --to-ports 3128iptables -t nat -A PREROUTING  -i $WAN -p tcp --dport 5900  -j DNAT --to-destination 192.168.10.127iptables -t nat -A PREROUTING  -i $WAN -p tcp --dport 2401  -j DNAT --to-destination 192.168.10.127iptables -t nat -A PREROUTING  -i $WAN -p tcp --dport 22    -j DNAT --to-destination 192.168.10.127iptables -t nat -A PREROUTING  -i $WAN -p tcp --dport 3389 -j DNAT --to-destination 192.168.10.3iptables -t nat -A PREROUTING  -i $WAN -p udp --dport 5900  -j DNAT --to-destination 192.168.10.127####### RFC1918iptables -A INPUT -i $LAN -s 127.0.0.1 -j DROPiptables -A INPUT -i $WAN -s $IP_LAN -j DROPiptables -A INPUT -i $WAN -s 127.0.0.1 -j DROPiptables -A INPUT -i $WAN -s 10.0.0.0/8 -j DROPiptables -A INPUT -i $WAN -s 172.16.0.0/12 -j DROP#iptables -A INPUT -i $WAN -s 192.168.0.0/16 -j DROP# Drop Class E & Diptables -A INPUT   -i $LAN -s 240.0.0.0/5 -j DROPiptables -A INPUT   -i $WAN -s 240.0.0.0/5 -j DROPiptables -A INPUT   -i $LAN -s 224.0.0.0/4 -j DROPiptables -A INPUT   -i $WAN -s 224.0.0.0/4 -j DROPiptables -A FORWARD -i $LAN -s 240.0.0.0/5 -j DROPiptables -A FORWARD -i $WAN -s 240.0.0.0/5 -j DROPiptables -A FORWARD -i $LAN -s 224.0.0.0/4 -j DROPiptables -A FORWARD -i $WAN -s 224.0.0.0/4 -j DROP# Previously initiated and accepted exchanges bypass rule checkingiptables -A INPUT   -m state --state NEW,ESTABLISHED,RELATED -j ACCEPTiptables -A OUTPUT  -m state --state NEW,ESTABLISHED,RELATED -j ACCEPTiptables -A FORWARD -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT# Allow incoming port 22 (ssh) connections on LAN interfaceiptables -A INPUT  -i $LAN -p tcp --dport 5900 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPTiptables -A INPUT  -i $LAN -p udp --dport 5900 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT# Allow ICMPiptables -A INPUT   -p icmp -j ACCEPTiptables -A OUTPUT  -p icmp -j ACCEPTiptables -A FORWARD -p icmp -j ACCEPT# Allow localhost trafficiptables -A INPUT  -i lo -j ACCEPTiptables -A OUTPUT -o lo -j ACCEPT