##First we flush our current rules
 iptables -F
 iptables -t nat -F

##Setup default policies to handle unmatched traffic
 iptables -P INPUT ACCEPT
 iptables -P OUTPUT ACCEPT
 iptables -P FORWARD DROP

##Copy and paste these examples ...
 export LAN=eth1
 export WAN=eth0

##Then we lock our services so they only work from the LAN
 iptables -I INPUT 1 -i ${LAN} -j ACCEPT
 iptables -I INPUT 1 -i lo -j ACCEPT
 iptables -A INPUT -p UDP --dport bootps -i ! ${LAN} -j REJECT
 iptables -A INPUT -p UDP --dport domain -i ! ${LAN} -j REJECT

##(Optional) Allow access to our ssh server from the WAN
 iptables -A INPUT -p TCP --dport ssh -i ${WAN} -j ACCEPT

##Drop TCP / UDP packets to privileged ports
 iptables -A INPUT -p TCP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP
 iptables -A INPUT -p UDP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP

##Finally we add the rules for NAT
 iptables -I FORWARD -i ${LAN} -d 10.5.0.0/255.255.0.0 -j DROP
 iptables -A FORWARD -i ${LAN} -s 10.5.0.0/255.255.0.0 -j ACCEPT
 iptables -A FORWARD -i ${WAN} -d 10.5.0.0/255.255.0.0 -j ACCEPT
 iptables -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE

# allow IPsec
#
# IKE negotiations
iptables -I INPUT  -p udp --sport 500 --dport 500 -j ACCEPT
iptables -I OUTPUT -p udp --sport 500 --dport 500 -j ACCEPT
# ESP encryption and authentication
iptables -I INPUT  -p 50 -j ACCEPT
iptables -I OUTPUT -p 50 -j ACCEPT


##Tell the kernel that ip forwarding is OK
 echo 1 > /proc/sys/net/ipv4/ip_forward
 for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 1 > $f ; done

##This is so when we boot we don't have to run the rules by hand
 /etc/init.d/iptables save
 rc-update add iptables default
 nano /etc/sysctl.conf

##Add/Uncomment the following lines:
 net.ipv4.ip_forward = 1
 net.ipv4.conf.default.rp_filter = 1


