### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
###--------------------------------------------------------------------------
- ### Config settings.
-
- ## This router is involved in a routing asymmetry.
- setconf(rp_filter, 0)
- setconf(log_martians, 0)
-
- ###--------------------------------------------------------------------------
- ### Network interfaces.
-
- m4_divert(44)m4_dnl
- ## Interface definitions.
- if_dmz=eth0.0
- if_trusted=eth0.1
- if_safe=$if_dmz,$if_trusted
- if_untrusted=eth0.3
- if_vpn=vpn-+
- if_iodine=dns+
- if_its_mz=$if_dmz,$if_trusted
- if_its_pi=$if_dmz,$if_trusted
-
- m4_divert(-1)
- ###--------------------------------------------------------------------------
### vampire-specific rules.
- m4_divert(82)m4_dnl
+ m4_divert(86)m4_dnl
## Externally visible services.
allowservices inbound tcp \
finger ident \
dns iodine \
ssh \
smtp submission \
+ rdesktop \
gnutella_svc \
ftp ftp_data \
rsync \
dnsresolver inbound
ntpclient inbound $ntp_servers
- run iptables -t nat -A outbound -j RETURN ! -o $if_dmz
+## NAT for RFC1918 addresses.
+for i in PREROUTING OUTPUT POSTROUTING; do
+ run iptables -t nat -P $i ACCEPT 2>/dev/null || :
+ run iptables -t nat -F $i 2>/dev/null || :
+done
+run iptables -t nat -F
+run iptables -t nat -X
+
+run iptables -t nat -N outbound
++run iptables -t nat -A outbound -j RETURN ! -o eth0.0
+run iptables -t nat -A outbound -j RETURN ! -s 172.29.198.0/23
+run iptables -t nat -A outbound -j RETURN -d 62.49.204.144/28
+run iptables -t nat -A outbound -j RETURN -d 172.29.198.0/23
+run iptables -t nat -A outbound -j SNAT --to-source 62.49.204.158
+run iptables -t nat -A POSTROUTING -j outbound
+
+## Set up NAT protocol helpers. In particular, SIP needs some special
+## twiddling.
+run modprobe nf_conntrack_sip \
+ ports=5060 \
+ sip_direct_signalling=0 \
+ sip_direct_media=0
+for p in ftp sip h323; do
+ run modprobe nf_nat_$p
+done
+
m4_divert(-1)
###----- That's all, folks --------------------------------------------------