##!/bin/bash
#First we flush our current rules
iptables -F
iptables -t nat -F

#Setup default policies to handle unmatched traffic
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

#LAN2 = INNET
export LAN2=eth2
#LAN = SRNET
export LAN=eth1
#WAN = CUNET
export WAN=eth0

#Then we lock our services so they only work from the LAN / LAN2
iptables -I INPUT 1 -i ${LAN} -j ACCEPT
iptables -I INPUT 1 -i ${LAN2} -j ACCEPT
iptables -I INPUT 1 -i lo -j ACCEPT

#Dont do theese, we still need DNS and DHCP to work, and we have theese restrictions set in dhcpd and dnsmasq
#iptables -A INPUT -p UDP --dport bootps -i ${WAN} -j REJECT
#iptables -A INPUT -p UDP --dport domain -i ${WAN} -j REJECT

#Allow access to our ssh server from the WAN
iptables -A INPUT -p TCP --dport ssh -i ${WAN} -j ACCEPT

#Drop TCP / UDP packets to privileged ports on WAN
iptables -A INPUT -p TCP -i ${WAN} -d 0/0 --dport 0:1023 -j DROP
iptables -A INPUT -p UDP -i ${WAN} -d 0/0 --dport 0:1023 -j DROP

#Finally we add the rules for NAT for LAN (We will leave LAN2 unrouted)
iptables -I FORWARD -i ${LAN} -d 10.0.1.0/255.255.0.0 -j DROP
iptables -A FORWARD -i ${LAN} -s 10.0.1.0/255.255.0.0 -j ACCEPT
iptables -A FORWARD -i ${WAN} -d 10.0.1.0/255.255.0.0 -j ACCEPT
iptables -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE

#Tell the kernel that ip forwarding is OK
echo 1 > /proc/sys/net/ipv4/ip_forward
for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 1 > $f ; done

#Save and restart
#/etc/init.d/iptables save
#/etc/init.d/iptables restart
iptables-save > /etc/firewall.conf
/etc/network/if-up.d/iptables