Stuff

table nat {    chain POSTROUTING {        # masquerade private IP addresses        saddr 172.31.255.68 daddr 137.217.0.0/16 proto udp dport 53 outerface $DEV_WORLD SNAT to 89.250.115.68;        saddr $NET_PRIVATE daddr ! 137.217.0.0/16 outerface $DEV_WORLD SNAT to $CLUSTER_OUT;    }}---def $DEV_WORLD = eth0;def $DEV_PRIVATE = eth1;def $DEV_DMZ_BOXED = eth2;def $DEV_DMZ_PUBLIC = eth3;def $NET_PUBLIC = (89.250.114.8/29 89.250.126.80/28);def $NET_PRIVATE = 172.31.255.64/26;def $NET_DMZ_BOXED = 172.31.255.128/27;def $NET_DMZ_PUBLIC = 89.250.115.64/26;def $NET_DMZ_CUSTOMER = 89.250.115.160/26;def $NET_VPN_PRIVATE = 172.31.128.0/24;def $NET_BOXED_UK = 89.250.127.16/28;# our static IP addressdef $HOST_STATIC = (89.250.115.228 89.250.115.161 172.31.255.66 89.250.115.65);#def $CLUSTER_OUT = 194.24.253.37;def $CLUSTER_OUT = 89.250.115.228;def $CLUSTER_IN = 172.31.255.65;---table filter {    chain INPUT {        policy ACCEPT;        # connection tracking        mod state state INVALID DROP;        mod state state (ESTABLISHED RELATED) ACCEPT;        # allow local connections        interface lo ACCEPT;        # allow VPNs        interface tap+ ACCEPT;        # Hack        interface $DEV_DMZ_PUBLIC ACCEPT;        # Accept igmp-based things like VRRP and OSPF        daddr 224.0.0.0/16 ACCEPT;        # respond to ping, but limit that        proto icmp {            icmp-type echo-request mod limit limit 10/s ACCEPT;            DROP;        }---def &FORWARD_HOST($proto, $port, $dest) = {        table nat chain PREROUTING interface $DEV_WORLD daddr $HOST_STATIC proto $proto dport $port DNAT to $dest;        table filter chain FORWARD interface $DEV_WORLD proto $proto daddr $dest dport $port ACCEPT;}## convenience function which creates both the nat/DNAT and the filter/FORWARD rule#def &FORWARD_PORT($proto, $sport, $dport, $dest) = {        table nat chain PREROUTING interface $DEV_WORLD daddr $CLUSTER_OUT proto $proto dport $sport DNAT to "$dest:$dport";        table filter chain FORWARD interface $DEV_WORLD proto $proto daddr $dest dport $sport ACCEPT;}## Function to accept and tarpit services#def &TARPIT_PORT($source, $dest, $proto, $port) = {        saddr $source proto $proto daddr $dest dport $port mod state state NEW mod recent update seconds 60 hitcount 10 DROP;        saddr $source proto $proto daddr $dest dport $port mod state state NEW mod recent set ACCEPT;}    chain FORWARD {        policy DROP;        # connection tracking        mod state state INVALID DROP;        mod state state (ESTABLISHED RELATED) ACCEPT;        # Hack        #interface $DEV_DMZ_PUBLIC ACCEPT;        saddr 0/0 daddr $NET_DMZ_PUBLIC proto icmp {                icmp-type echo-request mod limit limit 10/s ACCEPT;                DROP;        }        saddr $NET_DMZ_PUBLIC daddr 0/0 proto icmp {                icmp-type echo-request mod limit limit 10/s ACCEPT;                DROP;        }--        # VPN stuff        saddr (172.31.128.0/22 172.31.248.0/21 89.250.115.0/24) {                daddr (172.31.255.68 172.31.255.86) proto (tcp udp) dport (domain) ACCEPT;                daddr (172.31.255.64/26) proto (tcp udp) dport (netbios-ns netbios-dgm netbios-ssn microsoft-ds kerberos) ACCEPT;                daddr (172.31.255.64/26) proto (tcp) dport (http) ACCEPT;                daddr (89.250.115.0/24 172.31.248.0/24 172.20.0.0/20 172.31.255.64/26) proto icmp {                        icmp-type echo-request mod limit limit 10/s ACCEPT;                        DROP;                }        }&FORWARD_PORT(tcp, https, 443, 89.250.115.79);&FORWARD_PORT(tcp, http, 80, 89.250.115.79);&TARPIT_PORT(0/0, 89.250.115.188, tcp, 5900);&TARPIT_PORT(0/0, 89.250.115.189, tcp, rdp);