BASH - ipTables firewall for DMZ

Firewalling your Linux box.
This firewall script is intended to work an a firewall with LAN and DMZ zones.
Everything is blocked and then allowed as nessesary.
Firewall Script

FW=/sbin/iptables
echo 0 > /proc/sys/net/ipv4/ip_forward
OFF_IP=192.168.2.110 # Firewalls exterior IP.
INET_IF=eth0 # Internet interface
DMZ_IF=eth1 # DMZ Interface
LAN_IF=eth2 # LAN interface
SRV1=172.16.1.2 # DMZ Server

echo "Remove all prior rules including NAT"
$FW -F ; $FW -X ; $FW -Z ; $FW -F -t nat
echo "Set policy"
$FW -P INPUT DROP
$FW -P FORWARD DROP
$FW -P OUTPUT ACCEPT
echo "Allow connections established from LAN or DMZ."
$FW -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
$FW -A FORWARD -j ACCEPT -m state --state ESTABLISHED,RELATED
$FW -t nat -A POSTROUTING -o $INET_IF -j SNAT --to-source $OFF_IP
echo "INPUT rules"
# Accept trafic from DMZ and LAN
$FW -A INPUT -i lo -j ACCEPT # Server can connect locally
$FW -A INPUT -i $DMZ_IF -j ACCEPT
$FW -A INPUT -i $LAN_IF -j ACCEPT
# Route trafic from DMZ, LO2, LO3
$FW -A FORWARD -i $DMZ_IF -j ACCEPT
$FW -A FORWARD -i $LAN_IF -j ACCEPT
$FW -A FORWARD -i lo -j ACCEPT
echo "Allow SSH from the Internet."
$FW -A INPUT -j ACCEPT -p tcp --dport 22

echo "Allow ICMP packages (Ping)"
$FW -A FORWARD -p icmp --icmp-type echo-request -j ACCEPT
$FW -A FORWARD -p icmp --icmp-type echo-reply -j ACCEPT
$FW -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
$FW -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT

echo "Ports that will be forwarded for DMZ server, insert as best fitted."
FORWARDPORTS="25 80 443"
for port in $FORWARDPORTS
do
echo $port
$FW -A FORWARD -j ACCEPT -p tcp --dport $port
$FW -A FORWARD -j ACCEPT -p udp --dport $port
$FW -t nat -A PREROUTING -p tcp -d $OFF_IP --dport $port -j DNAT --to $SRV1
$FW -t nat -A PREROUTING -p udp -d $OFF_IP --dport $port -j DNAT --to $SRV1
done
# start routing
echo 1 > /proc/sys/net/ipv4/ip_forward
Installation

# mkdir /etc/firewall
# nano /etc/firewall/firewall.sh <- Copy'n'Paste the script, save and exit.
# chmod +x /etc/firewall/firewall.sh
# nano /etc/init.d/firewall <- Copy'n'Paste the init script, save and exit.
# update-rc.d firewall defaults <- To install the init script.
# update-rc.d -f firewall remove <- To remove the init script again
Init script

#! /bin/sh
# /etc/init.d/blah
#

# Some things that run always
touch /var/lock/blah

# Carry out specific functions when asked to by the system
case "$1" in
  start)
    echo "Starting script blah "
    echo "Could do more here"
    ;;
  stop)
    echo "Stopping script blah"
    echo "Could do more here"
    ;;
  *)
    echo "Usage: /etc/init.d/blah {start|stop}"
    exit 1
    ;;
esac

exit 0