echo Starting NAT...

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -F INPUT

iptables -F OUTPUT

iptables -F FORWARD

iptables -P FORWARD ACCEPT




iptables -A FORWARD -s 192.168.0.3 -j DROP
iptables -A FORWARD -s 192.168.0.5 -j DROP





iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE








EXT_IP="LLL.KKK.MMM.NNN" # Он всё равно чаще всего один и тот же.
INT_IP="192.168.0.136" # См. выше.
EXT_IF=ppp0 # Внешний и внутренний интерфейсы.
INT_IF=eth0 # Для шлюза они вряд ли изменятся, поэтому можно прописать вручную.
FAKE_PORT="8888"
LAN_IP="192.168.0.1"
SRV_PORT="80"

# Здесь опять надо сделать проверку ввода данных, потому что операции всё ещё серьёзные.

iptables -t nat -A PREROUTING -d $EXT_IP -p tcp -m tcp --dport $FAKE_PORT -j DNAT --to-destination $LAN_IP:$SRV_PORT
iptables -t nat -A POSTROUTING -d $LAN_IP -p tcp -m tcp --dport $SRV_PORT -j SNAT --to-source $INT_IP
iptables -t nat -A OUTPUT -d $EXT_IP -p tcp -m tcp --dport $SRV_PORT -j DNAT --to-destination $LAN_IP
iptables -I FORWARD 1 -i $EXT_IF -o $INT_IF -d $LAN_IP -p tcp -m tcp --dport $SRV_PORT -j ACCEPT



echo NAT has been started!

echo "Starting Firewall script"

# FIREWALL RULES

# Flush all the rules
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD

# Default policies
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -P INPUT DROP

# Allow LOOPBACK traffic
iptables -A INPUT -s 127.0.0.1 -i lo -j ACCEPT
iptables -A OUTPUT -d 127.0.0.1 -o lo -j ACCEPT

# Allow DNS traffic for "ppp0 <-> Internet"
iptables -A INPUT -i ppp0 -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -o ppp0 -p udp --sport 53 -j ACCEPT

# Allow ICMP traffic "LAN <-> This machine"
iptables -A INPUT -s 192.168.0.0/24 -p icmp -j ACCEPT
iptables -A OUTPUT -d 192.168.0.0/24 -p icmp -j ACCEPT

# Allow FTP traffic for "LAN <-> This machine"
iptables -A INPUT -i eth0 -p tcp --dport 21 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 21 -j ACCEPT

# Allow TELNET traffic for "LAN <-> This machine"
iptables -A INPUT -i eth0 -p tcp --dport 777 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 777 -j ACCEPT

# Allow WEB traffic for "LAN <-> This machine"
iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 80 -j ACCEPT

# Allow TCP PORTS 1024:65535 for "LAN <-> This machine"
iptables -A INPUT -i eth0 -p tcp --dport 1024:65535 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 1024:65535 -j ACCEPT

# Deny IP ADDRESS FALSIFICATION
iptables -A INPUT -i ppp0 -s 192.168.0.0/24 -j DROP
iptables -A FORWARD -i ppp0 -s 192.168.0.0/24 -j DROP
iptables -A FORWARD -i eth0 ! -s 192.168.0.0/24 -j DROP
iptables -A INPUT -i eth0 ! -s 192.168.0.0/24 -j DROP



echo "Starting NAT script"

# NAT RULES

# Enable NAT sever
echo 1 > /proc/sys/net/ipv4/ip_forward

# Enable NAT
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

# Allow DNS traffic for "LAN <-> Internet"
iptables -A FORWARD -i eth0 -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -o eth0 -p udp --sport 53 -j ACCEPT

# Allow WEB traffic for "LAN <-> Internet"
iptables -A FORWARD -i eth0 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -o eth0 -p tcp --sport 80 -j ACCEPT

echo "Firewall & NAT scripts have been started!"

mkswap
swapon