Forum Debian Users Gang

#!/bin/sh

#zmienne
LAN_IFACE="eth0"
WLAN_IFACE="ath0"
WAN_IFACE="ppp0"

ipt="/sbin/iptables"
mod="/sbin/modprobe"

#ladowanie modulow

$mod ip_tables
$mod ip_conntrack
$mod iptable_filter
$mod iptable_nat
$mod iptable_mangle
$mod ipt_LOG
$mod ipt_limit
$mod ipt_state
$mod ipt_MASQUERADE

#czyszczenie

$ipt -F
$ipt -t nat -F
$ipt -t mangle -F
$ipt -X
$ipt -t nat -X
$ipt -t mangle -X

#domyslna polityka

$ipt -P INPUT DROP
$ipt -P FORWARD DROP
$ipt -P OUTPUT ACCEPT
$ipt -t nat -P OUTPUT ACCEPT
$ipt -t nat -P PREROUTING ACCEPT
$ipt -t nat -P POSTROUTING ACCEPT
$ipt -t mangle -P PREROUTING ACCEPT
$ipt -t mangle -P POSTROUTING ACCEPT

$ipt -A INPUT -i lo -j ACCEPT

#maskarada

$ipt -t nat -A POSTROUTING -o $WAN_IFACE -j MASQUERADE

#regulki

$ipt -A INPUT -p tcp -i $WLAN_IFACE --dport 22  -m state --state NEW -j ACCEPT
$ipt -A INPUT -i $WLAN_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT

$ipt -A INPUT -i $LAN_IFACE -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT



$ipt -A FORWARD -i $WAN_IFACE -o $LAN_IFACE -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$ipt -A FORWARD -i $WAN_IFACE -o $WLAN_IFACE -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


$ipt -A FORWARD -i $LAN_IFACE -o $WAN_IFACE -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


$ipt -A FORWARD -i $WLAN_IFACE -o $WAN_IFACE -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$ipt -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
$ipt -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
$ipt -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT