NAT + SQUID + DNAT + FORWARD + FIREWALL

Article Title: NAT + SQUID + DNAT + FORWARD + FIREWALL. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
　　 Environment:
ADSL (eth0) Nic is not activated when it is started
Intranet (eth1) 192.168.0.1/24
　　
　　 Code:
#! /Bin/bash
/Sbin/modprobe ip_conntrack_ftp
/Sbin/modprobe ip_nat_ftp
/Sbin/iptables-F-t filter
/Sbin/iptables-F-t nat
/Sbin/iptables-P INPUT DROP
/Sbin/iptables-P OUTPUT ACCEPT
/Sbin/iptables-P FORWARD DROP
/Sbin/iptables-t nat-P PREROUTING ACCEPT
/Sbin/iptables-t nat-P POSTROUTING ACCEPT
/Sbin/iptables-t nat-P OUTPUT ACCEPT
　　
# Allow all in PRIVATE NET
/Sbin/iptables-a input-I lo-j ACCEPT
/Sbin/iptables-a input-I eth1-j ACCEPT
　　
# NAT
/Sbin/iptables-t nat-a postrouting-s 192.168.0.0/24-j MASQUERADE
　　
# Dnat radmin to PRIVATE in platinum.3322.org
/Sbin/iptables-a prerouting-t nat-p tcp-s! 192.168.0.0/24 -- dport 4899-j DNAT -- to 192.168.0.2: 4899
/Sbin/iptables-a prerouting-t nat-p tcp-s! 192.168.0.0/24 -- dport 5000-j DNAT -- to 192.168.0.3: 4899
　　
# SQUID
/Sbin/iptables-a prerouting-t nat-p tcp-s 192.168.0.0/24 -- dport 80-j DNAT -- to 192.168.0.1: 3128
　　
# FORWARD edit by Platinum
/Sbin/iptables-a forward-p tcp -- dport 21-j ACCEPT # FTP
/Sbin/iptables-a forward-p tcp -- dport 22-j ACCEPT # SSH
/Sbin/iptables-a forward-p udp -- dport 53-j ACCEPT # DNS
/Sbin/iptables-a forward-p tcp -- dport 80-j ACCEPT # HTTP
/Sbin/iptables-a forward-p tcp -- dport 443-j ACCEPT # HTTPS
/Sbin/iptables-a forward-p udp -- dport 8000-j ACCEPT # QQ
/Sbin/iptables-a forward-p tcp -- dport 25-j ACCEPT # SMTP
/Sbin/iptables-a forward-p tcp -- dport 110-j ACCEPT # POP3
/Sbin/iptables-a forward-p tcp -- dport 4899-j ACCEPT # RADMIN
/Sbin/iptables-a forward-p tcp -- dport 1863-j ACCEPT # MSN (you must allow port 443)
/Sbin/iptables-a forward-p icmp-j ACCEPT
　　
# Allow the third handshake
/Sbin/iptables-a input-m state -- state ESTABLISHED, RELATED-j ACCEPT
/Sbin/iptables-a forward-m state -- state ESTABLISHED, RELATED-j ACCEPT
　　
# Exchange the other packets '"SOURCE" and "TARGET", and SEND it !!!
/Sbin/iptables-a input-j MIRROR
　　
This firewall applies to static IP addresses and dynamic IP addresses.