#!/bin/bash

# Name of wan and lan interface
wan_interface=eth1
lan_interface=eth0
vbox_int=vboxnet0

# Where is iptables
BIN=/sbin/iptables

$BIN -X
$BIN -F
$BIN -F -t nat 
$BIN -F -t raw

#$BIN -P INPUT DROP
$BIN -P INPUT ACCEPT
$BIN -P OUTPUT ACCEPT
$BIN -P FORWARD ACCEPT

$BIN -A INPUT  -p icmp --icmp-type any -j ACCEPT
$BIN -A INPUT  -i lo -j ACCEPT
$BIN -A INPUT  -m state --state RELATED,ESTABLISHED -j ACCEPT
$BIN -A INPUT -i $vbox_int -j ACCEPT
$BIN -A INPUT  -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
$BIN -A INPUT  -m state --state NEW -m tcp -p tcp --dport 10000 -j ACCEPT
$BIN -A INPUT  -m state --state NEW -m tcp -p tcp --dport 10001 -j ACCEPT
#$BIN -A INPUT  -m state --state NEW -m tcp -p tcp --dport 55555 -j ACCEPT
#$BIN -A INPUT  -m state --state NEW -m tcp -p tcp --dport 631 -s 192.168.56.0/24 -j ACCEPT
#$BIN -A INPUT  -m state --state NEW -m tcp -p tcp --dport 5672 -j ACCEPT
$BIN -A INPUT  -j REJECT --reject-with icmp-host-prohibited

$BIN -t nat -A POSTROUTING -s 192.168.56.0/24 -o $wan_interface -j MASQUERADE
$BIN -t nat -A POSTROUTING -s 192.168.56.0/24 -o $lan_interface -j MASQUERADE


#$BIN -t nat -A PREROUTING -s 172.16.10.0/24 -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
#$BIN -t nat -A POSTROUTING -s 172.16.9.0/24 -o $wan_interface -j SNAT --to $wan_ip
#$BIN -t raw -A PREROUTING -s 172.16.10.0/24 -j ACCEPT
#$BIN -t raw -A PREROUTING -s 172.16.0.0/16 -m string --algo bm --string "youku.com" -j DROP
#$BIN -t raw -A PREROUTING -s 172.16.0.0/16 -m string --algo bm --string "ku6.com" -j DROP
#$BIN -t raw -A PREROUTING -s 172.16.0.0/16 -m string --algo bm --string "6.cn" -j DROP