#!/bin/sh

# Sample Linux firewall configuration

dir=`dirname $0`
if [ -f $dir/.cfg ] ; then
    . $dir/.cfg
fi
if [ X$EXT_IP = X ] ; then
    EXT_IP=158.64.137.1
fi
INT_IP=10.10.0.1
INT_NET=10.10.0.0/255.255.0.0
WEBSERVER_IP=10.10.0.2
FTPSERVER_IP=10.10.0.2
MAILSERVER_IP=10.10.0.3


# Protecting the internal network
#   accept only ssh, and return packets from our own outgoing connections
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth1 -j REJECT


# Ftp support
modprobe ip_nat_ftp
modprobe ip_conntrack_ftp


# Network address translation
iptables -t nat -I POSTROUTING -s $INT_NET -j SNAT --to-source $EXT_IP

# Incoming nat
do_inc_nat() {
    PORT=$1
    DEST=$2
    iptables -t nat -I PREROUTING \
	-p tcp -d $EXT_IP --dport $PORT \
	-j DNAT --to-destination $DEST
    iptables -I FORWARD \
	-p tcp -d $EXT_IP --dport $PORT \
	--j ACCEPT
}

do_inc_nat 80 $WEBSERVER_IP
do_inc_nat 25 $MAILSERVER_IP
do_inc_nat 21 $FTPSERVER_IP

# Transparent squid proxy support
iptables -t nat -I PREROUTING -p tcp --dport 80 -i eth0 \
  -j DNAT --to-destination $INT_IP:3128

# Do not forget to activate the following lines in /etc/squid.conf:
# httpd_accel_uses_host_header on
# httpd_accel_with_proxy on
# httpd_accel_host virtual


# To clean up this:
# iptable -F
# iptable -t nat -F