fwgen.rb

#!/usr/bin/env ruby

interface = 'eth0'
host = nil
`ifconfig #{interface}`.each do |line|
  host = $1 if line =~ /inet addr:([\d\.]+)/
end

map = {
  2 => { 80 => :tcp },                                 # www
  3 => {},                                             # mysql
  
  10 => { 411 => :tcp },                               # verlihub
  11 => { [4040,9000] => :tcp },                              # media
  
  20 => { 25565 => :tcp },                             # minecraft
  21 => { [28900, 14667, 4711] => :tcp, [14567, 14690, 27900, 22000] => :udp, 23000..23009 => :udp }, # bf1942
  22 => { 27000..27040 => :udp, 27015 => :tcp },       # hlds
  23 => { 27960 => :udp },                             # quake3
  24 => { [6500,7777,7778,7787,13000,27900] => :udp }, # ut3
  
  100 => { 5900 => :all }                              # winxp
}

def iptables(protocol, source_ip, source_port, destination_ip, destination_port)
  if protocol == :all
    iptables(:tcp, source_ip, source_port, destination_ip, destination_port)
    iptables(:udp, source_ip, source_port, destination_ip, destination_port)
  else
    puts "iptables -t nat -I PREROUTING -d #{source_ip.to_s} -p #{protocol.to_s} --dport #{source_port.to_s} -j DNAT --to-destination #{destination_ip.to_s}:#{destination_port.to_s}"
  end
end

puts "#!/bin/sh"

map.each do |dest, sets|
  if dest < 100
    iptables(:tcp, host, "1#{"%02d" % dest}22", "10.0.0.#{dest.to_s}", 22)
  end
  sets.each do |ports, protocol|
    [*ports].each do |port|
      iptables(protocol, host, port, "10.0.0.#{dest.to_s}", port)
    end
  end
end

puts "iptables -I FORWARD -m state -d 10.0.0.0/24 --state NEW,RELATED,ESTABLISHED -j ACCEPT"

init.d-iptables.sh

#!/bin/sh

. /lib/lsb/init-functions

do_start () {
	log_action_msg "Starting firewall"

	. /etc/firewall
}

do_stop () {
	log_action_msg "Stopping firewall"

	iptables -P INPUT ACCEPT
	iptables -P FORWARD ACCEPT
	iptables -P OUTPUT ACCEPT

	iptables -t nat -P PREROUTING ACCEPT
	iptables -t nat -P POSTROUTING ACCEPT
	iptables -t nat -P OUTPUT ACCEPT

	iptables -t mangle -P PREROUTING ACCEPT
	iptables -t mangle -P POSTROUTING ACCEPT
	iptables -t mangle -P INPUT ACCEPT
	iptables -t mangle -P OUTPUT ACCEPT
	iptables -t mangle -P FORWARD ACCEPT

	iptables -F
	iptables -t nat -F
	iptables -t mangle -F

	iptables -X
	iptables -t nat -X
	iptables -t mangle -X

	service libvirt-bin reload

	sleep 1
}

case "$1" in
	start)
		do_stop
		do_start
	;;
		restart|reload|force-reload)
		do_stop
		do_start
	;;
		stop)
		do_stop
	;;
	*)
		echo "Usage: $0 start|stop" >&2
		exit 3
	;;
esac