asterisk.ru

WAN="ppp0"
WAN_ADDR="88.87.76.35"
LAN="eth1"
LAN_ADDR="192.168.0.51"

WAN_CLOSE="3000 3128 5222 9090 9091 139 445 2727 5000 4520 2000"

DHCP_RANGE="192.168.0.1-192.168.0.254"

SAVE_FILE="/var/lib/iptables/rules-save"

set -e

echo -n "Clean all tables..."
iptables -t nat -F
iptables -F
iptables -F FORWARD
iptables -F INPUT
iptables -F OUTPUT
echo OK

echo -n "Set default policities..."
iptables -P FORWARD DROP
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
echo OK

echo -n "Upping nat..."
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o $WAN -j SNAT --to-source $WAN_ADDR
iptables -t nat -A POSTROUTING -o $LAN -j SNAT --to-source $LAN_ADDR
echo OK

#asterisk
iptables -t nat -A PREROUTING -p udp --dport 5060 -i $WAN -j DNAT --to 192.168.0.65

iptables -t nat -A PREROUTING -p udp -d 192.168.0.51 --dport 4000:4999 -j DNAT --to-destination 192.168.0.65
iptables -t nat -A POSTROUTING -p udp --dst 192.168.0.65 --dport 4000:4999 -j SNAT --to-source 192.168.0.51
iptables -t nat -A PREROUTING -p udp --dport 4000:4999 -i $WAN -j DNAT --to 192.168.0.65

iptables -t nat -A PREROUTING -p udp -d 192.168.0.51 --dport 10000:20000 -j DNAT --to-destination 192.168.0.65
iptables -t nat -A POSTROUTING -p udp --dst 192.168.0.65 --dport 10000:20000 -j SNAT --to-source 192.168.0.51
iptables -t nat -A PREROUTING -p udp --dport 10000:20000 -i $WAN -j DNAT --to 192.168.0.65
#end of asterisk

echo -n "Allow dhcp range"
iptables -A FORWARD -m iprange --dst-range $DHCP_RANGE -j ACCEPT
iptables -A FORWARD -m iprange --src-range $DHCP_RANGE -j ACCEPT
echo OK

iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

echo "Deny ports to WAN:"
for WAN_CLOSE_PORT in $WAN_CLOSE; do
echo -en " deny port $WAN_CLOSE_PORT..."
iptables -A INPUT -p tcp --dport $WAN_CLOSE_PORT -i $WAN -j DROP
echo OK
done

echo -n "Save settings to $SAVE_FILE..."
iptables-save -c > $SAVE_FILE
echo OK