Webinterface vom VDSL2-Modem im LAN erreichbar machen

K6B0x / # cat /root/iptables.sh
#!/bin/bash


# PPP
PPP_IF="ppp0"


# Lokal
LO_IF="lo"


# DNZ, LAN, WLAN
LAN_IF="eth0"
WLAN_IF="eth1"
DMZ_IF="eth2"
WAN_IF="eth3"


# Clients
AMD64="192.168.0.2"
BL4CKB0X="192.168.2.254"


# IP-Bereiche
LAN_IP="192.168.0.0/24"
WLAN_IP="192.168.1.0/24"
DMZ_IP="192.168.2.0/24"
WAN_IP="192.168.3.0/24"


# IPTV
IPTV1="193.158.35.0/24"
IPTV2="217.0.119.0/24"
IPTV3="224.0.0.0/4"
IPTV4="239.35.0.0/16"


# IPTables
IPTABLES="/sbin/iptables"


# Vorhandene Regeln löschen
$IPTABLES -F
$IPTABLES -t nat -F


# Standardverhalten
$IPTABLES -P OUTPUT  ACCEPT
$IPTABLES -P INPUT   DROP
$IPTABLES -P FORWARD DROP


# INPUT
$IPTABLES -A INPUT -i $LO_IF -j ACCEPT
$IPTABLES -A INPUT -i $LAN_IF -j ACCEPT
$IPTABLES -A INPUT -i $WLAN_IF -j ACCEPT
$IPTABLES -A INPUT -i $DMZ_IF -j ACCEPT
$IPTABLES -A INPUT -i $WAN_IF -j ACCEPT
$IPTABLES -A INPUT -i $PPP_IF -m state --state ESTABLISHED,RELATED -j ACCEPT


# INPUT - IPTV
$IPTABLES -I INPUT -d $IPTV3 -j ACCEPT


# FORWARD
$IPTABLES -A FORWARD -i $LO_IF -j ACCEPT
$IPTABLES -A FORWARD -i $LAN_IF -j ACCEPT
$IPTABLES -A FORWARD -i $WLAN_IF -j ACCEPT
$IPTABLES -A FORWARD -i $DMZ_IF -j ACCEPT
$IPTABLES -A FORWARD -i $WAN_IF -j ACCEPT
$IPTABLES -A FORWARD -i $PPP_IF -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu


# FORWARD - IPTV
$IPTABLES -I FORWARD -s $IPTV1 -d $IPTV3 -j ACCEPT
$IPTABLES -I FORWARD -s $IPTV2 -d $IPTV3 -j ACCEPT
$IPTABLES -I FORWARD -s $IPTV4 -d $IPTV3 -j ACCEPT
$IPTABLES -I FORWARD -d $IPTV3 -j ACCEPT


# POSTROUTING
$IPTABLES -t nat -A POSTROUTING -o $PPP_IF -s $LAN_IP -j MASQUERADE
$IPTABLES -t nat -A POSTROUTING -o $PPP_IF -s $WLAN_IP -j MASQUERADE
$IPTABLES -t nat -A POSTROUTING -o $PPP_IF -s $DMZ_IP -j MASQUERADE
$IPTABLES -t nat -A POSTROUTING -o $PPP_IF -s $WAN_IP -j MASQUERADE


# Postfix
$IPTABLES -t nat -A PREROUTING -p tcp --dport 25 -i $PPP_IF -j DNAT --to $BL4CKB0X
$IPTABLES -t nat -A PREROUTING -p tcp --dport 465 -i $PPP_IF -j DNAT --to $BL4CKB0X


# Dovecot
$IPTABLES -t nat -A PREROUTING -p tcp --dport 110 -i $PPP_IF -j DNAT --to $BL4CKB0X
$IPTABLES -t nat -A PREROUTING -p tcp --dport 143 -i $PPP_IF -j DNAT --to $BL4CKB0X
$IPTABLES -t nat -A PREROUTING -p tcp --dport 993 -i $PPP_IF -j DNAT --to $BL4CKB0X
$IPTABLES -t nat -A PREROUTING -p tcp --dport 993 -i $PPP_IF -j DNAT --to $BL4CKB0X


# Apache 2
$IPTABLES -t nat -A PREROUTING -p tcp --dport 80 -i $PPP_IF -j DNAT --to $BL4CKB0X
$IPTABLES -t nat -A PREROUTING -p tcp --dport 443 -i $PPP_IF -j DNAT --to $BL4CKB0X


# Openfire
$IPTABLES -t nat -A PREROUTING -p tcp --dport 3478:3479 -i $PPP_IF -j DNAT --to $BL4CKB0X
$IPTABLES -t nat -A PREROUTING -p tcp --dport 5222 -i $PPP_IF -j DNAT --to $BL4CKB0X
$IPTABLES -t nat -A PREROUTING -p tcp --dport 5223 -i $PPP_IF -j DNAT --to $BL4CKB0X
$IPTABLES -t nat -A PREROUTING -p tcp --dport 5229 -i $PPP_IF -j DNAT --to $BL4CKB0X
$IPTABLES -t nat -A PREROUTING -p tcp --dport 5269 -i $PPP_IF -j DNAT --to $BL4CKB0X
$IPTABLES -t nat -A PREROUTING -p tcp --dport 7777 -i $PPP_IF -j DNAT --to $BL4CKB0X


# Steam
$IPTABLES -t nat -A PREROUTING -p tcp --dport 27015 -i $PPP_IF -j DNAT --to $AMD64
$IPTABLES -t nat -A PREROUTING -p tcp --dport 27020:27050 -i $PPP_IF -j DNAT --to $AMD64
$IPTABLES -t nat -A PREROUTING -p udp --dport 27000:27020 -i $PPP_IF -j DNAT --to $AMD64


# FTP
$IPTABLES -t nat -A PREROUTING -p tcp --dport 1338 -i $PPP_IF -j DNAT --to $BL4CKB0X
$IPTABLES -t nat -A PREROUTING -p tcp --dport 40000:40100 -i $PPP_IF -j DNAT --to $BL4CKB0X