#!/bin/sh
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -t nat -F PREROUTING
iptables -t nat -F POSTROUTING
iptables -t nat -F OUTPUT

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

#SNAT
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.25 --dport 22 -j SNAT --to-source 192.168.0.1
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.25 --dport 80 -j SNAT --to-source 192.168.0.1
iptables -t nat -A POSTROUTING  -s 192.168.0.0/24 -o eth1 -j SNAT --to-source 12.34.56.78

#DNAT
iptables -t nat -A PREROUTING -i eth1 -p tcp -d 12.34.56.78 --dport 22 -j DNAT --to 192.168.0.25:22
iptables -t nat -A PREROUTING -i eth1 -p tcp -d 12.34.56.78 --dport 80 -j DNAT --to-destination 192.168.0.25:80

#NAT_OUTPUT
iptables -t nat -A OUTPUT -d 12.34.56.78 -p tcp --dport 80 -j DNAT --to-destination 192.168.0.25
iptables -t nat -A OUTPUT -d 12.34.56.78 -p tcp --dport 22 -j DNAT --to-destination 192.168.0.25

#FORWARD_FILTER
iptables -A FORWARD -j DROP -p udp -m length --length 20:70 -m string --hex-string "|7F FF FF FF|" --algo kmp --from 32 --to 44
iptables -A FORWARD -j DROP -p tcp -m multiport --dports 135,139,445
iptables -A FORWARD -j DROP -p udp -m multiport --dports 137,138

#INPUT_FILTER
iptables -A INPUT -s 127.0.0.1/32 -j ACCEPT 
iptables -A INPUT -s 192.168.0.0/24 -p tcp --dport 5222 -j ACCEPT
iptables -A INPUT -p tcp --dport 5222 -j DROP