echo 0 > /proc/sys/net/ipv4/ip_forward

LAN_NIC1='eth0'
LAN_NIC2='eth1'
LAN_ADDR='192.168.x.x/24'
WAN_NIC='ppp0'

# Zera tudo
iptables -F
iptables -t nat -F
iptables -t mangle -F

# Politica inicial dos chains é apenas aceitar a saida, esta é que libera o NAT
iptables -A FORWARD -j ACCEPT -i $LAN_NIC1 -s $LAN_ADDR
iptables -A FORWARD -j ACCEPT -i $LAN_NIC2 -s $LAN_ADDR
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# Serviços disponiveis
#
iptables -A INPUT -j ACCEPT -p tcp --dport 3050
#
iptables -A INPUT -j ACCEPT -p tcp --dport 1049
#
iptables -A INPUT -j ACCEPT -p tcp --dport 443
#
iptables -A INPUT -j ACCEPT -p tcp --dport 1999
#
iptables -A INPUT -j ACCEPT -p udp --dport 1999
#
iptables -A INPUT -j ACCEPT -p tcp --dport 4662
#
iptables -A INPUT -j ACCEPT -p udp --dport 4672
#
iptables -A INPUT -j ACCEPT -p tcp --dport 22
#
iptables -A INPUT -j ACCEPT -p tcp --dport 25
#
iptables -A INPUT -j ACCEPT -p tcp --dport 139
#
iptables -A INPUT -j ACCEPT -p tcp --dport 53
#
iptables -A INPUT -j ACCEPT -p tcp --dport 445
#
iptables -A INPUT -j ACCEPT -p tcp --dport 631
#
iptables -A INPUT -j ACCEPT -p tcp --dport 3128
#
iptables -A INPUT -j ACCEPT -p tcp --dport 8080
#
iptables -A INPUT -j ACCEPT -p tcp --dport 3306
#
iptables -A INPUT -j ACCEPT -p tcp --dport 10000
#
iptables -A INPUT -j ACCEPT -p tcp --dport 445
#
iptables -A INPUT -j ACCEPT -p tcp --dport 953
#
iptables -A INPUT -j ACCEPT -p tcp --dport 23
#
iptables -A INPUT -j ACCEPT -p tcp --dport 110
#
iptables -A INPUT -j ACCEPT -p tcp --dport 143
#
#
# Libera todas as portas para a rede interma
#
iptables -A INPUT -j ACCEPT -p tcp -i ! $LAN_NIC1
#
iptables -A INPUT -j ACCEPT -p udp -i ! $LAN_NIC1
#
iptables -A INPUT -j ACCEPT -p icmp -i ! $LAN_NIC1
#
# STATE RELATED for router
#
# Sem isso, é necessário colocar -P INPUT ACCEPT. Deve ser por causa do
#
# 3-way handshaking.
#
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# Redirecionamento de portas para Outlook e Skype
#
#iptables -t nat -A PREROUTING -s 192.168.x.x/24 -i eth1 -p TCP --dport 80 -j REDIRECT --to-port 3128
#
iptables -t nat -A PREROUTING -s 192.168.x.x/24 -i eth1 -p UDP --dport 80 -j REDIRECT --to-port 3128
#
iptables -t nat -A PREROUTING -s 192.168.x.x/24 -i eth0 -p TCP --dport 80 -j REDIRECT --to-port 3128
#
iptables -t nat -A PREROUTING -s 192.168.X.X/24 -i eth0 -p UDP --dport 80 -j REDIRECT --to-port 3128
#
iptables -I POSTROUTING -j MASQUERADE -t nat -s 192.168.X.X/24 -p tcp --dport 25 -o eth0
#
iptables -I POSTROUTING -j MASQUERADE -t nat -s 192.168.X.X/24 -p tcp --dport 110 -o eth0
#
iptables -I POSTROUTING -j MASQUERADE -t nat -s 192.168.X.X/24 -p tcp --dport 995 -o eth0
#
iptables -I POSTROUTING -j MASQUERADE -t nat -s 192.168.X.X/24 -p tcp --dport 465 -o eth0
#
iptables -I POSTROUTING -j MASQUERADE -t nat -s 192.168.X.X/24 -p udp --dport 53 -o eth0
#
iptables -I POSTROUTING -j MASQUERADE -t nat -s 192.168.X.X/24 -p udp --dport 443 -o eth0
#
iptables -I POSTROUTING -j MASQUERADE -t nat -s 192.168.X.X/24 -p tcp --dport 443 -o eth0
#
iptables -I POSTROUTING -j MASQUERADE -t nat -s 192.168.X.X/24 -p tcp --dport 446 -o eth0
#
# Habilita o forward
#
echo 1 > /proc/sys/net/ipv4/ip_forward
clear
echo "REGRAS DO FIREWALL HABILITADAS!!!"
sleep 5
iptables -L
sleep 5
clear
iptables -t nat -L
exit 0
#---------------x--------------#