Iptables

# Mapping Public IP (124.xx.xx.xx :eth0) to Private IP (192.168.2.10 :eth1)

$ iptables -A FORWARD -p TCP -i eth0 -d 192.168.2.10 --dport 80 -j ACCEPT
$ iptables -t nat -A PREROUTING -p TCP -i eth0 -d 124.xx.xx.xx --dport 80 -j DNAT --to-destination 192.168.2.10

** iptables -t nat -A POSTROUTING -o eth0 -s 192.168.2.10 -j SNAT --to-source 124.xx.xx.xx


# Internet Sharing

$ iptables -A INPUT -d 192.168.2.0/24 -i eth1 -j INBOUND
$ iptables -A INPUT -d 124.158.108.149/32 -i eth1 -j INBOUND

$ iptables -A FORWARD -i eth1 -j OUTBOUND
$ iptables -A FORWARD -d 192.168.2.0/24 -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
$ iptables -A FORWARD -d 192.168.2.0/24 -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT

$ iptables -A FORWARD -i eth1 -j ACCEPT

$ iptables -A OUTPUT -o eth1 -j OUTBOUND


$ iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE


# VPN server setup (vpn subnet: 10.8.0.0)

$ iptables -A INPUT -d 10.8.0.1/32 -i tun0 -j INBOUND          // 10.8.0.1 tunnel accessible
$ iptables -A INPUT -d 124.158.xx.xx/32 -i tun0 -j INBOUND     // 124.158.xx.xx tunnel accessible
$ iptables -A INPUT -d 192.168.2.0/24 -i tun0 -j INBOUND       // 192.168.2.0 subnet tunnel accessible

$ iptables -A FORWARD -d 10.8.0.0/24 -j ACCEPT             // all ports open

$ iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE



# Enables packet forwarding by kernel

$ echo 1 > /proc/sys/net/ipv4/ip_forward



# Open

$ iptables -A INPUT -p tcp --dport 80 -j ACCEPT
$ iptables -A INPUT -s 192.168.1.100 -j ACCEPT # Only open to 192.168.1.100



# Block

$ iptables -A OUTPUT -p tcp --dport 6881:6889 -j DROP # Block to BitTorent
$ iptables -A OUTPUT -d 69.50.139.114 -j DROP # Block to 69.50.139.114



# All Open / Block

$ iptables -F / -Z / -X  # clear

$ iptables -P INPUT ACCEPT / DROP
$ iptables -P OUTPUT ACCEPT / DROP
$ iptables -P FORWARD ACCEPT / DROP



# Save / Restore

$ iptables-save > /etc/iptables.up.rules
$ iptables-restore < /etc/iptables.up.rules