#!/bin/sh

#iptaibles rules for NAT

#ifaces:
LO_IFACE="lo"
LO_IP="127.0.0.1"

INET_IFACE="ppp0"

LAN_IFACE="eth0"

MY_NET="eth1"

#echo $INET_IFACE

iptables="/usr/sbin/iptables"

# delete all existing rules.
#
$iptables -F
$iptables -t nat -F
$iptables -t mangle -F
$iptables -X

# Always accept loopback traffic
$iptables -A INPUT -i $LO_IFACE -j ACCEPT

# Allow established connections, and those not coming from the outside
$iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A INPUT -m state --state NEW -i ! $INET_IFACE -j ACCEPT
$iptables -A FORWARD -i $INET_IFACE -o $MY_NET -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow outgoing connections from the LAN side.
$iptables -A FORWARD -i $MY_NET -o $INET_IFACE -j ACCEPT

# Masquerade.
$iptables -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE

# Don't forward from the outside to the inside.
$iptables -A FORWARD -i $INET_IFACE -o $INET_IFACE -j REJECT

iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu