#!/bin/shIPT="/sbin/iptables"echo 1 > /proc/sys/net/ipv4/ip_forward$IPT -F$IPT -X$IPT -P INPUT DROP$IPT -P FORWARD DROP$IPT -P OUTPUT DROPINET_IFACE_WAN="ppp0"INET_IFACE_LAN="eth0"TCP_PORTS_LAN="0:65535" UDP_PORTS_LAN="0:65535" TCP_PORTS_WAN="20,21,25,80,110,2020,10000"UDP_PORTS_WAN="53"$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT$IPT -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT$IPT -A INPUT -i lo -j ACCEPT$IPT -A OUTPUT -o lo -j ACCEPT$IPT -A INPUT -i ppp+ -j ACCEPT$IPT -A INPUT -p gre -j ACCEPTiptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 128iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPTiptables -A FORWARD -i ppp+ -o ppp0 -j ACCEPTiptables -t nat -A POSTROUTING -o ppp0 -s 192.168.1.0/24 -j MASQUERADE$IPT -A INPUT -p tcp -m multiport -i $INET_IFACE_LAN --dport $TCP_PORTS_LAN -j ACCEPT$IPT -A INPUT -p udp -m multiport -i $INET_IFACE_LAN --dport $UDP_PORTS_LAN -j ACCEPT$IPT -A INPUT -p tcp -m multiport -i $INET_IFACE_WAN --dport $TCP_PORTS_WAN -j ACCEPT$IPT -A INPUT -p udp -m multiport -i $INET_IFACE_WAN --dport $UDP_PORTS_WAN -j ACCEPT$IPT -A INPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPTexit 0