IPTABLES=/sbin/iptables
EXTIF="ppp0"
INTIF="eth0"
IFCONFIG=/sbin/ifconfig
LSMOD=/sbin/lsmod
DEPMOD=/sbin/depmod
MODPROBE=/sbin/modprobe
GREP=/bin/grep
AWK=/bin/awk
SED=/bin/sed
WEBSERVER="192.168.0.254"

printf "\nExternal Interface:  $EXTIF\nInternal Interface:  $INTIF\n\n"

#CRITICAL:  Enable IP forwarding since it is disabled by default since
#
echo "Enabling forwarding.."
echo "1" > /proc/sys/net/ipv4/ip_forward

# Dynamic IP users:
#
#   If you get your IP address dynamically from SLIP, PPP, or DHCP, 
#   enable this following option.  This enables dynamic-address hacking
#   which makes the life with Diald and similar programs much easier.
#
echo "Enabling DynamicAddr.."
echo "1" > /proc/sys/net/ipv4/ip_dynaddr

# Set external IP Var
INTIP="192.168.0.45"
echo "Internal ip is $INTIP"

#Clearing any previous configuration
#
#  Unless specified, the defaults for INPUT and OUTPUT is ACCEPT
#    The default for FORWARD is DROP (REJECT is not a valid policy)
#
echo "Clearing any existing rules and setting default policy.."
$IPTABLES -P INPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -F FORWARD
$IPTABLES -t nat -F

echo "FWD: Allow all connections OUT and only existing and related ones IN"
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG

echo "Enabling SNAT (MASQUERADE) functionality on $EXTIF"
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE


# This is for forwarding http requests to the webserver.
# It's still kind off dodgy, but it works at the moment so thats good.
#
echo "Forwarding all http requests to $WEBSERVER"
# Forward packets coming in from the outside
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination $WEBSERVER:80

# Allow forwarded packets
iptables -A FORWARD -p tcp --dport 80 -d $WEBSERVER -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Make responses on the internal network go through the firewall
iptables -t nat -A POSTROUTING -p tcp -d $WEBSERVER --dport 80 -j SNAT --to-source $INTIP

#!/sbin/runscript

IPTABLES=/sbin/iptables
EXTIF="ppp0"
INTIF="eth0"
IFCONFIG=/sbin/ifconfig
LSMOD=/sbin/lsmod
DEPMOD=/sbin/depmod
MODPROBE=/sbin/modprobe
GREP=/bin/grep
AWK=/bin/awk
SED=/bin/sed
WEBSERVER="192.168.0.57"

# Flush tables and set policies
echo "Clearing any existing rules and setting default policy.."
$IPTABLES -t filter -P INPUT ACCEPT
$IPTABLES -t filter -F INPUT
$IPTABLES -t filter -P OUTPUT ACCEPT
$IPTABLES -t filter -F OUTPUT
$IPTABLES -t filter -P FORWARD ACCEPT
$IPTABLES -t filter -F FORWARD
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -F PREROUTING
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t nat -F POSTROUTING
$IPTABLES -t nat -P OUTPUT ACCEPT
$IPTABLES -t nat -F OUTPUT

start() {
        ebegin "Loading Firewall"

# Enable IP forwarding
echo "Enabling Forwarding.."
echo "1" > /proc/sys/net/ipv4/ip_forward

# Enable Dynamic IP
echo "Enabling DynamicAddr.."
echo "1" > /proc/sys/net/ipv4/ip_dynaddr

# Set external IP
EXTON=`ifconfig | grep $EXTIF`
if [ $? -eq 0 ]
then
   EXTIP=`ifconfig $EXTIF | grep inet | cut -d : -f 2 | cut -d ' ' -f 1`
   echo "External interface is $EXTIF with ip address: $EXTIP"
else
   echo "External interface is $EXTIF"
fi

# Set internal IP
INTIP=`ifconfig $INTIF | grep inet | cut -d : -f 2 | cut -d ' ' -f 1`
echo "Internal interface is $INTIF with ip address: $INTIP"

# Set up gateway/routing
echo "Enabling SNAT (MASQUERADE) functionality on $EXTIF"
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

# Port forward http requests to the web server
echo "Set up http forwarding to $WEBSERVER"
$IPTABLES -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination $WEBSERVER:80

        eend 0
}

stop() {
        ebegin "Clearing Firewall"
        eend 0
}