source: freewrt/package/iptables/files/firewall.conf@ 2400aa1

#!/bin/sh

echo "please configure your interfaces and iptables rules"
exit 1
### Interfaces
WAN=eth0.1
LAN=eth0.0
WLAN=wlan0

######################################################################
### Default ruleset
######################################################################

### Create chains
iptables -N input_rule
iptables -N forwarding_rule
iptables -t nat -N prerouting_rule
iptables -t nat -N postrouting_rule

### Default policy
iptables -P INPUT DROP
iptables -P FORWARD DROP

### INPUT
###  (connections with the router as destination)

# base case
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --tcp-flags SYN SYN \! --tcp-option 2 -j DROP

# custom rules
iptables -A INPUT -j input_rule

# allow access from anything but WAN
iptables -A INPUT ${WAN:+\! -i $WAN} -j ACCEPT
# allow icmp messages
iptables -A INPUT -p icmp -j ACCEPT

# reject
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable

### OUTPUT
###  (connections with the router as source)

# base case
iptables -A OUTPUT -m conntrack --ctstate INVALID -j DROP
iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

### FORWARD
###  (connections routed through the router)

# base case
iptables -A FORWARD -m conntrack --ctstate INVALID -j DROP
iptables -A FORWARD -p tcp -o $WAN --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# custom rules
iptables -A FORWARD -j forwarding_rule
iptables -t nat -A PREROUTING -j prerouting_rule
iptables -t nat -A POSTROUTING -j postrouting_rule

# allow LAN to INTERNET
iptables -A FORWARD -i $LAN -o $WAN -j ACCEPT
# allow WLAN to INTERNET
#iptables -A FORWARD -i $WLAN -o $WAN -j ACCEPT
# Allow WLAN to LAN
#iptables -A FORWARD -i $WLAN -o $LAN -j ACCEPT

### MASQUERADING
echo 1 > /proc/sys/net/ipv4/ip_dynaddr
iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE

######################################################################
### Default ruleset end
######################################################################

###
### Connections to the router
###

# ssh
#iptables -A input_rule -i $WAN -p tcp -s <a.b.c.d> --dport 22 -j ACCEPT

# IPSec
#iptables -A input_rule -i $WAN -p esp -s <a.b.c.d> -j ACCEPT
#iptables -A input_rule -i $WAN -p udp -s <a.b.c.d> --dport 500 -j ACCEPT

# OpenVPN
#iptables -A input_rule -i $WAN -p udp -s <a.b.c.d> --dport 1194 -j ACCEPT

# PPTP
#iptables -A input_rule -i $WAN -p gre -j ACCEPT
#iptables -A input_rule -i $WAN -p tcp --dport 1723 -j ACCEPT

###
###  VPN traffic
###

# IPSec
#iptables -A forwarding_rule -o ipsec+ -j ACCEPT
#iptables -A forwarding_rule -i ipsec+ -j ACCEPT

# OpenVPN
#iptables -A forwarding_rule -o tun+ -j ACCEPT
#iptables -A forwarding_rule -i tun+ -j ACCEPT

###
### Port forwardings to LAN
###

#iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport 3389 -j DNAT --to 192.168.1.10
#iptables -A forwarding_rule -i $WAN -p tcp --dport 3389 -d 192.168.1.10 -j ACCEPT