#!/bin/sh
#
#
# 1.1 Internet Configuration.
#
INET_PROVIDER_IP="192.168.1.155"
INET_PROVIDER_IFACE="eth1"
INET_PROVIDER_BROADCAST="192.168.1.255"
#LAN_IP_SED="192.168.1.244
# 1.2 Local Area Network configuration.
#
# LAN's IP range and localhost IP. /24 means to only use the first 24
# bits of the 32 bit IP address. the same as netmask 255.255.255.0
#
LAN_ORG_IP="192.168.2.254"
LAN_ORG_IP_RANGE="192.168.2.0/24"
LAN_ORG_IFACE="eth0"
#LAN_IP_SED="192.168.1.244"
####LAN_IP2="192.168.10.254"
####LAN_IP_RANGE2="192.168.10.0/24"
#LAN_IP_RANGE="192.168.1.253"
####LAN_IFACE2="eth2"
###LAN_IFACE2="eth0"
#LAN_IP_SED="192.168.10.1"
####LAN_IP_SED2="192.168.10.1"
# 1.3 Virtual Private Network
OPENVPN_IFACE="tun+"
OPENVPN_RANGE="10.10.10.0/24"
OPENVPN_PORT="1194"
# 1.4 Localhost Configuration.
#
LO_IFACE="lo"
LO_IP="127.0.0.1"
# 1.5 IPTables Configuration.
#
IPTABLES="/sbin/iptables"
# flush all the rules in the filter and nat tables.
# Drop all
$IPTABLES -F
$IPTABLES -X
$IPTABLES -F -t nat
$IPTABLES -X -t nat
$IPTABLES -F -t mangle
$IPTABLES -X -t mangle
###########################################################################
# 2. Module loading.
#
#
# Needed to initially load modules
#
/sbin/depmod -a
#
# 2.1 Required modules
#
#
# Needed to initially load modules
#
/sbin/depmod -a
#
# 2.1 Required modules
#
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_state
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_conntrack_ftp
#
# 2.2 Non-Required modules
#
#/sbin/modprobe ipt_owner
#/sbin/modprobe ipt_REJECT
#/sbin/modprobe ipt_MASQUERADE
#/sbin/modprobe ip_conntrack_irc
#/sbin/modprobe ip_nat_irc
###########################################################################
#
# 3. /proc set up.
#
#
# 3.1 Required proc configuration
#
echo "1" > /proc/sys/net/ipv4/ip_forward
#
# 3.2 Non-Required proc configuration
#
#echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
#echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp
#echo "1" > /proc/sys/net/ipv4/ip_dynaddr
#
# 4.1.1 Set policies
#
#$IPTABLES -P INPUT DROP
#$IPTABLES -P OUTPUT DROP
#$IPTABLES -P FORWARD DROP
#$IPTABLES -t nat -F PREROUTING
#$IPTABLES -t nat -F POSTROUTING
#
# 4.1.2 Create userspecified chains
#
#
# Create chain for bad tcp packets
#
$IPTABLES -A INPUT -i $OPENVPN_IFACE -s $OPENVPN_RANGE -j ACCEPT
$IPTABLES -A INPUT -i $LAN_ORG_IFACE -s $LAN_ORG_IP_RANGE -p gre -j ACCEPT
#Главное правило, пропускать пакеты для установления соединения
${FW} -A INPUT -i $LAN_ORG_IFACE -s $LAN_ORG_IP_RANGET -p tcp --dport 1194 -j ACCEPT
${FW} -A OUTPUT -o $OPENVPN_IFACE -d $OPENVPN_RANGE-j ACCEPT
${FW} -A OUTPUT -o $LAN_ORG_IFACE -d $LAN_ORG_IP_RANGE -p gre -j ACCEPT
${FW} -A OUTPUT -o $LAN_ORG_IFACE -d $LAN_ORG_IP_RANGE -p tcp --sport 1194 -j ACCEPT
${FW} -A OUTPUT -o $LAN_ORG_IFACE -d $LAN_ORG_IP_RANGE -p udp --sport 1194 -j ACCEPT
${FW} -A FORWARD -i $OPENVPN_IFACE -s $OPENVPN_RANGE -d 0/0 -j ACCEPT
${FW} -A FORWARD -s 0/0 -d $OPENVPN_RANGE -o $OPENVPN_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
#Для каждой цепочки (INPUT, OUTPUT, FORWARD) поставить правила в начала или вместо "A" ставить "I"
$IPTABLES -t nat -A POSTROUTING -s $OPENVPN_RANGE -o $INET_PROVIDER_IFACE -j SNAT --to-source $INET_PROVIDER_IP
