Forum Debian Users Gang

witam wszystkich
jestem nowy tutaj:)
mam problem taki

posiadam w domu server na debianie. mam do niego podpiete 2 dsle i oczywiscie siec lokalna ktora ma dostep do netu:)
chodzi mi o to ze potrzebuje zablokowac dostep jednemu komputerowi tylko do jednej stronki i do gg
jak to zrobic bo za bardzo sie nie znam na tym a administrator ktory to robil jest w tej chwili niedostepny:( samemu sobie raczej nie poradze
moj plik *masq.sh wyglada tak

#!/bin/bash -x
porty="22 23 25 53 80 110 7171 28960 21 20 8074 443 5001 5002 5003 5004 5005 5030 14011 14016 17001 5579 44405 27015"
arp -f
iptables="/sbin/iptables"
$iptables -P INPUT ACCEPT
$iptables -F
$iptables -X
$iptables -F -t nat
$iptables -F -t mangle
$iptables -t nat -P PREROUTING DROP
$iptables -t nat -A PREROUTING -i lo -j ACCEPT
$iptables -t nat -A PREROUTING -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -t nat -A PREROUTING --source 192.168.0.254/32 -m state --state NEW -j ACCEPT
$iptables -t nat -A PREROUTING --source 195.177.64.192/28 -m state --state NEW -j ACCEPT
$iptables -t nat -A PREROUTING --source 212.244.219.32/27 -m state --state NEW -j ACCEPT
$iptables -t nat -A PREROUTING --source 80.55.186.40/29 -m state --state NEW -j ACCEPT
$iptables -t nat -A PREROUTING --source 80.53.247.120/29 -m state --state NEW -j ACCEPT
$iptables -t nat -A PREROUTING -d 80.55.186.40/29 -m state --state NEW -j ACCEPT
$iptables -t nat -A PREROUTING -d 80.53.247.120/29 -m state --state NEW -j ACCEPT
$iptables -t nat -A PREROUTING -d 10.0.0.1 -m state --state NEW -j ACCEPT
for klienci in `cat /etc/ethers | grep -v "^#" | sed -e "s/ /G/"`; do
`echo $klienci | awk -F G '{ print "iptables -t nat -A PREROUTING -m mac --mac-source " $1 " -s " $2 " -j ACCEPT"; }'`
done
#$iptables -t nat -A PREROUTING -i eth0 -j mark --set-mark 3
$iptables -P INPUT DROP
$iptables -A INPUT -i lo -j ACCEPT
$iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A INPUT --source 10.0.0.0/24 -m state --state NEW -j ACCEPT
$iptables -A INPUT --source 212.244.219.32/27 -m state --state NEW -j ACCEPT
$iptables -A INPUT --source 195.136.113.40/28 -m state --state NEW -j ACCEPT
$iptables -A INPUT --source 80.55.186.40/29 -m state --state NEW -j ACCEPT
$iptables -A INPUT --source 80.53.247.120/29 -m state --state NEW -j ACCEPT
$iptables -A INPUT -p tcp --dport 25 -j ACCEPT
$iptables -A INPUT -p tcp --dport 113 -j ACCEPT
$iptables -A INPUT -p tcp --dport 110 -j ACCEPT
$iptables -A INPUT -p udp --dport 25 -j ACCEPT
$iptables -A INPUT -p udp --dport 113 -j ACCEPT
$iptables -A INPUT -p udp --dport 110 -j ACCEPT
$iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
$iptables -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
$iptables -t nat -A POSTROUTING -o eth1 -s 10.0.0.0/24 -j SNAT --to 80.55.186.42
$iptables -t nat -A POSTROUTING -o eth2 -s 10.0.0.0/24 -j SNAT --to 80.53.247.122

$iptables -t mangle -A POSTROUTING -o eth0 -s 10.0.0.1/32 -d 10.0.0.0/24 -j MARK --set-mark 0x60
$iptables -t mangle -A POSTROUTING -m mark --mark 0x60 -j ACCEPT

$iptables -t mangle -A POSTROUTING -d 212.244.219.32/27 -o eth1 -p tcp --sport 22 -j MARK --set-mark 0x50
$iptables -t mangle -A POSTROUTING -d 212.244.219.32/27 -o eth2 -p tcp --sport 22 -j MARK --set-mark 0x50
for x in $porty; do
$iptables -t mangle -A PREROUTING -i eth1 -p tcp --sport $x -j MARK --set-mark 0x1
$iptables -t mangle -A PREROUTING -i eth1 -p udp --sport $x -j MARK --set-mark 0x1
$iptables -t mangle -A PREROUTING -i eth2 -p tcp --sport $x -j MARK --set-mark 0x2
$iptables -t mangle -A PREROUTING -i eth2 -p udp --sport $x -j MARK --set-mark 0x2
$iptables -t mangle -A PREROUTING -i eth0 -p tcp --dport $x -j MARK --set-mark 0x50
$iptables -t mangle -A PREROUTING -i eth0 -p udp --dport $x -j MARK --set-mark 0x50
done
$iptables -t mangle -A PREROUTING -m mark --mark 0x1 -j ACCEPT
$iptables -t mangle -A PREROUTING -m mark --mark 0x2 -j ACCEPT
$iptables -t mangle -A PREROUTING -m mark --mark 0x50 -j ACCEPT

$iptables -t mangle -A PREROUTING -i eth1 -j MARK --set-mark 0x10
$iptables -t mangle -A PREROUTING -m mark --mark 0x10 -j ACCEPT
$iptables -t mangle -A PREROUTING -i eth2 -j MARK --set-mark 0x20
$iptables -t mangle -A PREROUTING -m mark --mark 0x20 -j ACCEPT



jak by mi ktos mogl pomoc to by bylo super. jezeli cos jeszcze jest potrzebne to napisze jak bede wiedzial o co chodzi:)
pozdrawiam