#!/bin/sh
IPT=/sbin/iptables
WANIF=eth0
LANIF=eth1

firewall_start() {

        #==================== INPUT ===================
        $IPT -A INPUT -i $WANIF -m state --state ESTABLISHED,RELATED -j ACCEPT

        $IPT -A INPUT -i $WANIF -p tcp --dport 22 -j ACCEPT

        $IPT -A INPUT -i $WANIF -p icmp -j ACCEPT

        $IPT -A INPUT -i $LANIF -j ACCEPT

        $IPT -P INPUT DROP

        #==================== NAT ===================
        $IPT -A POSTROUTING -t nat -o $WANIF -j MASQUERADE

        $IPT -A FORWARD -i $WANIF -p tcp --dport 80 -d 10.0.0.101 -j ACCEPT

        $IPT -A PREROUTING -t nat -j DNAT -i $WANIF -p tcp --dport 80 --to-destination 192.168.1.101:80



        #==================== FORWARD ===================
        $IPT -A FORWARD -i $WANIF -m state --state ESTABLISHED,RELATED -j ACCEPT

        $IPT -A FORWARD -i $LANIF -j ACCEPT

        $IPT -P FORWARD DROP
}

firewall_stop() {

        $IPT -F
        $IPT -t nat -F
        $IPT -P INPUT ACCEPT
        $IPT -P FORWARD ACCEPT
}

firewall_restart() {
        firewall_stop
        sleep 2
        firewall_start
}

case $1 in 'start' )
firewall_start
;;
'stop' )
firewall_stop
;;
'restart' )
firewall_restart
;;
*)
echo "usage: -bash {start|stop|restart}"
;;
esac

-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i eth0 -p icmp -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A FORWARD -d 10.0.0.101/32 -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth1 -j ACCEPT