#!/bin/sh

IPTABLES="/sbin/iptables"

# Verejna ip
INET_IP="111.111.111.111"
INET_IFACE="eth0"

# Implicitni politikou je zahazovat nepovolene pakety
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP

# Povolené IP
$IPTABLES –A INPUT –p TCP --dport 20000 –j ACCEPT # port pro vsechny
$IPTABLES -A INPUT -i $INET_IFACE -m mac --mac-source 00:11:22:33:44:55 -j ACCEPT # Kony doma
$IPTABLES -A INPUT -i $INET_IFACE -m mac --mac-source 00:22:44:55:66:77 -j ACCEPT # Kony doma verejka
$IPTABLES -A INPUT -i $INET_IFACE -m mac --mac-source 00:33:44:99:00:00 -j ACCEPT # Router brana