*nat

# Reqired iptables rule for eth0 masquerading (enable only if not using a vpn)
-A POSTROUTING -o eth0 -j MASQUERADE

COMMIT

*filter
# Allowing iodine (ip-over-dns) traffic (enable only if not using a vpn)
-A FORWARD -i eth0 -o dns+ -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i dns+ -o eth0 -j ACCEPT
# Make sure "accepted" packets are allowed
-I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

###****BEGIN IPTABLES WIFI FIREWALL ****###
:FORWARD DROP
#Logging
-A FORWARD -i wlan0 -o eth0 -p tcp --syn -j LOG --log-prefix "syn packet:"
-I FORWARD 5 -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
# dns
-A FORWARD -i wlan0 -o eth0 -p udp --dport 53 -j ACCEPT
# http, https
-A FORWARD -i wlan0 -o eth0 -p tcp --dport 80 -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -p tcp --dport 443 -j ACCEPT
# irc
-A FORWARD -i wlan0 -o eth0 -p tcp --dport 7070 -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -p tcp --dport 1338 -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -p tcp --dport 6667 -j ACCEPT
# Allow PING from remote hosts.
-A FORWARD -i wlan0 -o eth0 -p icmp --icmp-type echo-request -j ACCEPT

###****BEGIN IPTABLES SERVER FIREWALL****###
:INPUT DROP
:OUTPUT ACCEPT
## Fine tune what traffic we want
# Reject spoofed packets
# Keep state.
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Loop device.
-A INPUT -i lo -j ACCEPT
# http, https
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
# smtp, submission
-A INPUT -p tcp --dport 25 -j ACCEPT
-A INPUT -p tcp --dport 587 -j ACCEPT
# pop3, pop3s
-A INPUT -p tcp --dport 110 -j ACCEPT
-A INPUT -p tcp --dport 995 -j ACCEPT
# imap, imaps
-A INPUT -p tcp --dport 143 -j ACCEPT
-A INPUT -p tcp --dport 993 -j ACCEPT
# ssh
-A INPUT -p tcp --dport 22 -j ACCEPT
# Allow PING from remote hosts.
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT
# ejabberd
#-A INPUT -p tcp --dport 5222 -j ACCEPT
#-A INPUT -p tcp --dport 5223 -j ACCEPT
#-A INPUT -p tcp --dport 5280 -j ACCEPT
# ldap/ldaps
#-A INPUT -p tcp --dport 389 -j ACCEPT
#-A INPUT -p tcp --dport 636 -j ACCEPT
# ftp.
#-A INPUT -p tcp --dport 20 -j ACCEPT
#-A INPUT -p tcp --dport 21 -j ACCEPT

###EXTRA IPTABLES STUFF###

##REQUIRED IPTABLES RULES FOR VPN AND VPN IP MASQUERADING
#--table nat --append POSTROUTING --out-interface tun0 -j MASQUERADE
#-t filter -A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
#-t filter -A FORWARD -i tun0 -o eth0 -j ACCEPT

##REQIRED IPTABLES RULES FOR IODINE OVER VPN
#-t filter -A FORWARD -i tun0 -o dns+ -m state --state RELATED,ESTABLISHED -j ACCEPT
#-t filter -A FORWARD -i dns+ -o tun0 -j ACCEPT
COMMIT

# Reqired iptables rule for eth0 masquerading (enable only if not using a vpn)
-A POSTROUTING -o eth0 -j MASQUERADE

COMMIT

*filter
# Allowing iodine (ip-over-dns) traffic (enable only if not using a vpn)
-A FORWARD -i eth0 -o dns+ -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i dns+ -o eth0 -j ACCEPT
# Make sure "accepted" packets are allowed
-I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

###****BEGIN IPTABLES WIFI FIREWALL ****###
:FORWARD DROP
#Logging
-A FORWARD -i wlan0 -o eth0 -p tcp --syn -j LOG --log-prefix "syn packet:"
-I FORWARD 5 -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
# dns
-A FORWARD -i wlan0 -o eth0 -p udp --dport 53 -j ACCEPT
# http, https
-A FORWARD -i wlan0 -o eth0 -p tcp --dport 80 -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -p tcp --dport 443 -j ACCEPT
# irc
-A FORWARD -i wlan0 -o eth0 -p tcp --dport 7070 -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -p tcp --dport 1338 -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -p tcp --dport 6667 -j ACCEPT
# Allow PING from remote hosts.
-A FORWARD -i wlan0 -o eth0 -p icmp --icmp-type echo-request -j ACCEPT

###****BEGIN IPTABLES SERVER FIREWALL****###
:INPUT DROP
:OUTPUT ACCEPT
## Fine tune what traffic we want
# Reject spoofed packets
# Keep state.
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Loop device.
-A INPUT -i lo -j ACCEPT
# http, https
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
# smtp, submission
-A INPUT -p tcp --dport 25 -j ACCEPT
-A INPUT -p tcp --dport 587 -j ACCEPT
# pop3, pop3s
-A INPUT -p tcp --dport 110 -j ACCEPT
-A INPUT -p tcp --dport 995 -j ACCEPT
# imap, imaps
-A INPUT -p tcp --dport 143 -j ACCEPT
-A INPUT -p tcp --dport 993 -j ACCEPT
# ssh
-A INPUT -p tcp --dport 22 -j ACCEPT
# Allow PING from remote hosts.
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT
# ejabberd
#-A INPUT -p tcp --dport 5222 -j ACCEPT
#-A INPUT -p tcp --dport 5223 -j ACCEPT
#-A INPUT -p tcp --dport 5280 -j ACCEPT
# ldap/ldaps
#-A INPUT -p tcp --dport 389 -j ACCEPT
#-A INPUT -p tcp --dport 636 -j ACCEPT
# ftp.
#-A INPUT -p tcp --dport 20 -j ACCEPT
#-A INPUT -p tcp --dport 21 -j ACCEPT

###EXTRA IPTABLES STUFF###

##REQUIRED IPTABLES RULES FOR VPN AND VPN IP MASQUERADING
#--table nat --append POSTROUTING --out-interface tun0 -j MASQUERADE
#-t filter -A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
#-t filter -A FORWARD -i tun0 -o eth0 -j ACCEPT

##REQIRED IPTABLES RULES FOR IODINE OVER VPN
#-t filter -A FORWARD -i tun0 -o dns+ -m state --state RELATED,ESTABLISHED -j ACCEPT
#-t filter -A FORWARD -i dns+ -o tun0 -j ACCEPT
COMMIT