#!/bin/sh

IPT="/sbin/iptables"

wan_if="ethA"
lan_if="ethB"

lan="a.b.c.d/e"
wan_ip="f.g.h.i"

lan_to_me_allow_tcp="21 22 25 3306"
lan_to_me_allow_udp="53"

wan_to_me_allow_tcp="22"
wan_to_me_allow_udp=""

icmp_allow="3 5 8 11 12"

chains=`cat /proc/net/ip_tables_names 2>/dev/null`
for i in $chains; do
		$IPT -t $i -F
		$IPT -t $i -X
done

$IPT -P INPUT DROP 
$IPT -P FORWARD DROP
$IPT -P OUTPUT ACCEPT

if [ -n "$icmp_allow" ]; then
	for type in $icmp_allow; do
		$IPT -A INPUT -p icmp --icmp-type $type -j ACCEPT
		$IPT -A FORWARD -p icmp --icmp-type $type -j ACCEPT
	done
fi

$IPT -A FORWARD -i $lan_if -s $lan -m state --state NEW -j ACCEPT
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A INPUT -i $wan_if -p all -s 10.0.0.0/8 -j DROP
$IPT -A INPUT -i $wan_if -p all -s 172.16.0.0/12 -j DROP
$IPT -A INPUT -i $wan_if -p all -s 192.168.0.0/16 -j DROP
$IPT -A INPUT -i $lan_if -p all -s ! $lan -j DROP

$IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

if [ -n "$wan_to_me_allow_tcp" ]; then
	for port in $wan_to_me_allow_tcp; do
		$IPT -A INPUT -p tcp -i $wan_if --dport $port -j ACCEPT
		$IPT -A INPUT -p tcp -i lo --dport $port -j ACCEPT
	done
fi

if [ -n "$wan_to_me_allow_udp" ]; then
	for port in $wan_to_me_allow_udp; do
		$IPT -A INPUT -p udp -i $wan_if --dport $port -j ACCEPT
		$IPT -A INPUT -p udp -i lo --dport $port -j ACCEPT
	done
fi

if [ -n "$lan_to_me_allow_tcp" ]; then
	for port in $lan_to_me_allow_tcp; do
		$IPT -A INPUT -p tcp -i $lan_if --dport $port -j ACCEPT
		$IPT -A INPUT -p tcp -i lo --dport $port -j ACCEPT
	done
fi

if [ -n "$lan_to_me_allow_udp" ]; then
	for port in $lan_to_me_allow_udp; do
		$IPT -A INPUT -p udp -i $lan_if --dport $port -j ACCEPT
		$IPT -A INPUT -p udp -i lo --dport $port -j ACCEPT
	done
fi

$IPT -t nat -A POSTROUTING -o $wan_if -j SNAT --to-source $wan_ip

