Freesco, NND, CDN, EOS

#!/bin/sh

TAB="iptables"

WAN="xxx.xxx.xxx.xxx"      #Public IP
IF_WAN="eth0"           #Interface of public IP

LAN="10.1.1.0/24"       #LAN
IF_LAN="eth1"           #Interface of LAN

#Cleaning tables
$TAB -F
$TAB -F -t nat
$TAB -X -t nat
$TAB -F -t mangle
$TAB -X -t mangle
$TAB -F -t filter
$TAB -X -t filter

#Protection against DOS syn-flood attack
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
#Forwardig between interfaces
echo "1" > /proc/sys/net/ipv4/ip_forward

# DEFAULT POLICY
$TAB -P INPUT DROP
$TAB -P FORWARD DROP
$TAB -P OUTPUT ACCEPT

$TAB -A INPUT -i lo -j ACCEPT

# INPUT
$TAB -I INPUT -p tcp --dport 21 -j ACCEPT #ftp
$TAB -I INPUT -p tcp --dport 22 -j ACCEPT #ssh
$TAB -I INPUT -p tcp --dport 53 -j ACCEPT #dns-tcp
$TAB -I INPUT -p udp --dport 53 -j ACCEPT #dns-udp
$TAB -I INPUT -p tcp --dport 80 -j ACCEPT #http

$TAB -A INPUT -s $LAN -d 0/0 -j ACCEPT
$TAB -A INPUT -s 0/0 -d $LAN -j ACCEPT

$TAB -A INPUT -d $WAN -m state --state ESTABLISHED,RELATED -j ACCEPT
$TAB -A INPUT -d $LAN -m state --state ESTABLISHED,RELATED -j ACCEPT


# FILTER
$TAB -t filter -A FORWARD -s 10.1.1.2 -d 0/0 -j ACCEPT
$TAB -t filter -A FORWARD -d 10.1.1.2 -s 0/0 -j ACCEPT


# NAT
$TAB -t nat -A POSTROUTING -s 10.1.1.2 -d 0.0.0.0/0 -j SNAT --to-source $WAN
#$TAB -t nat -A POSTROUTING -s 10.1.1.3 -d 0.0.0.0/0 -j SNAT --to-source $WAN

# PORTS FORWARDING
$TAB -t nat -I PREROUTING -p tcp -i $IF_LAN -d $WAN --dport 6666 -j DNAT --to 10.1.1.2

Masquerade
This target is only valid in the nat table, in the POSTROUTING chain. It should only be used with dynamically assigned IP (dialup) connections: if you have a static IP address, you should use the SNAT target. Masquerading is equivalent to specifying a mapping to the IP address of the interface the packet is going out, but also has the effect that connections are forgotten when the interface goes down. This is the correct behavior when the next dialup is unlikely to have the same interface address (and hence any established connections are lost anyway).