JAWUG

#!/bin/sh
. /etc/functions.sh

WIFI=eth1

IPT=/usr/sbin/iptables

for T in filter nat mangle ; do
  $IPT -t $T -F
  $IPT -t $T -X
done
WIFI=eth1

$IPT -t filter -A INPUT -m state --state INVALID -j DROP
$IPT -t filter -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -t filter -A INPUT -p icmp -j ACCEPT
$IPT -t filter -A INPUT -p tcp --dport 5001 -j ACCEPT

$IPT -A FORWARD -i $WIFI -p tcp -d 196.14.60.55 --dport 5001 -j ACCEPT
$IPT -t nat -A PREROUTING -p tcp --dport 5000 -j DNAT --to-destination 196.14.60.55:5000
$IPT -t nat -A POSTROUTING -o eth1 -j MASQUERADE

$IPT -t filter -A INPUT -i $WIFI -p tcp -j REJECT --reject-with tcp-reset
$IPT -t filter -A INPUT -i $WIFI -j REJECT --reject-with icmp-port-unreachable
$IPT -t filter -A FORWARD -m state --state INVALID -j DROP
$IPT -t filter -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -t filter -A FORWARD -i $WIFI -m state --state NEW,INVALID -j DROP
$IPT -t filter -A FORWARD -o $WIFI -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu