My firewall.sh:
#!/bin/bash
IPTABLES='/usr/sbin/iptables'
EXTIF='eth0' INTIF1='eth1' INTIF2='eth2'
/bin/echo 1 > /proc/sys/net/ipv4/ip_forward
$IPTABLES -F $IPTABLES -t nat -F $IPTABLES -X
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
$IPTABLES -A FORWARD -m state --state ESTABLISHED -j ACCEPT $IPTABLES -A FORWARD -p icmp -m state --state RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF1 -o $EXTIF -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF2 -o $EXTIF -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT --protocol tcp --dport 22 -j ACCEPT $IPTABLES -A INPUT --protocol tcp --dport 25 -j ACCEPT $IPTABLES -A INPUT --protocol tcp --dport 143 -j ACCEPT
$IPTABLES -A FORWARD -i eth0 -d 192.168.0.3 --protocol tcp --dport 80 -j ACCEPT
$IPTABLES -A PREROUTING -i eth0 -t nat -p tcp --dport 80 -j DNAT --to 192.168.0.3:80
After the script runs:
linux:~ # iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:smtp
ACCEPT tcp -- anywhere anywhere tcp dpt:imap
Chain FORWARD (policy ACCEPT)
target prot opt source destination ACCEPT all -- anywhere anywhere state ESTABLISHED
ACCEPT icmp -- anywhere anywhere state RELATED
ACCEPT all -- anywhere anywhere state NEW,ESTABLISHED
ACCEPT all -- anywhere anywhere state NEW,ESTABLISHED
ACCEPT tcp -- anywhere 192.168.0.3 tcp dpt:http flags:FIN,SYN,RST,ACK/SYN state NEW
Chain OUTPUT (policy ACCEPT)
target prot opt source destination linux:~ # iptables -t nat --list
Chain PREROUTING (policy ACCEPT)
target prot opt source destination DNAT tcp -- anywhere anywhere tcp dpt:http to:192.168.0.3
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination MASQUERADE all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT) target prot opt source destination
Anyone have any ideas what I'm doing wrong?
Thanks, Nathan
