Cara
Esse é um exemplo, modifique-o conforme a sua necessidade !!!!
#!/bin/bash
# tutorial
http://www.zago.eti.br/firewall/iptables-modelos.html
# :r !lynx -dump
http://www.zago.eti.br/firewall/fireaula.sh
##### definir variaveis
iptables=/usr/sbin/iptables
EXTERNA=eth0
INTERNA=eth1
##### carregar modulos
/sbin/modprobe iptable_nat
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_REJECT
/sbin/modprobe ipt_MASQUERADE
##### Zera regras
$iptables -F
$iptables -X
$iptables -F -t nat
$iptables -X -t nat
$iptables -F -t mangle
$iptables -X -t mangle
$iptables -P INPUT DROP
$iptables -P OUTPUT DROP
$iptables -P FORWARD DROP
##### Filtros - DROP nos pacotes TCP indesejaveis
$iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j LOG --log-level 6 --log-prefix "FIREWALL: NEW sem syn: "
$iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
##### ACCEPT (libera) pacotes de retorno da internet
$iptables -A INPUT -i ! $EXTERNA -j ACCEPT
$iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A OUTPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
$iptables -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
##### negar e log de port scanners
$iptables -N SCANNER
$iptables -A SCANNER -m limit --limit 15/m -j LOG --log-level 6 --log-prefix "DIVERSOS: port scanner: "
$iptables -A SCANNER -j DROP
$iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -i $EXTERNA -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags ALL NONE -i $EXTERNA -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags ALL ALL -i $EXTERNA -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags ALL FIN,SYN -i $EXTERNA -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -i $EXTERNA -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -i $EXTERNA -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -i $EXTERNA -j SCANNER
##### Log de acesso por porta
$iptables -A INPUT -p tcp --dport 21 -i $EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: ftp: "
$iptables -A INPUT -p tcp --dport 23 -i $EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: telnet: "
$iptables -A INPUT -p tcp --dport 25 -i $EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: smtp: "
$iptables -A INPUT -p tcp --dport 80 -i $EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: http: "
$iptables -A INPUT -p tcp --dport 110 -i $EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: pop3: "
$iptables -A INPUT -p udp --dport 111 -i $EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: rpc: "
$iptables -A INPUT -p tcp --dport 137:139 -i $EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: samba: "
$iptables -A INPUT -p udp --dport 137:139 -i $EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: samba: "
$iptables -A INPUT -p tcp --dport 161:162 -i $EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: snmp: "
$iptables -A INPUT -p tcp --dport 3128 -i $EXTERNA -j LOG --log-level 6 --log-prefix "FIREWALL: squid: "
##### Regras BitTorrent
# Fechando as portas do samba o perigo mora aqui caso fique de cara para a internet.
$iptables -A INPUT -p tcp -i $EXTERNA --syn --dport 139 -j DROP
$iptables -A INPUT -p tcp -i $EXTERNA --syn --dport 138 -j DROP
$iptables -A INPUT -p tcp -i $EXTERNA --syn --dport 137 -j DROP
# Fechar NFS (portmap) para o mundo
$iptables -A INPUT -p tcp -i $EXTERNA --syn --dport 111 -j DROP
##### Libera acesso externo para ssh e servidor web
#$iptables -A INPUT -p tcp --dport 80 -i $EXTERNA -j ACCEPT
#$iptables -A INPUT -p tcp --dport 80 -i $INTERNA -j ACCEPT
#$iptables -A INPUT -p tcp --dport 22 -i $EXTERNA -j ACCEPT
$iptables -A INPUT -p tcp --dport 22 -i $INTERNA -j ACCEPT
# Regras Iptables para Bloquear ataques Brute Force no SSH
# copia da Dicas-L
#
http://www.dicas-l.com.br/dicas-l/20060724.php
$iptables -A INPUT -p tcp --syn --dport 22 -m recent --name sshattack --set
$iptables -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack --rcheck --seconds 60 --hitcount 3 -j LOG --log-prefix 'SSH REJECT: '
$iptables -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack --rcheck --seconds 60 --hitcount 3 -j REJECT --reject-with tcp-reset
$iptables -A FORWARD -p tcp --syn --dport 22 -m recent --name sshattack --set
$iptables -A FORWARD -p tcp --dport 22 --syn -m recent --name sshattack --rcheck --seconds 60 --hitcount 3 -j LOG --log-prefix 'SSH REJECT: '
$iptables -A FORWARD -p tcp --dport 22 --syn -m recent --name sshattack --rcheck --seconds 60 --hitcount 3 -j REJECT --reject-with tcp-reset
##### Redirecionar ssh na porta 2222
$iptables -t nat -A PREROUTING -p tcp -s 200.204.198.164 --dport 2222 -i $EXTERNA -j DNAT --to 192.168.1.144:22
##### Liberar Conectividade Social para todos
# liberando acesso a toda a rede 200.201 e pode liberar sites alem da CAIXA.
$iptables -t nat -A PREROUTING -p tcp -d 200.201.0.0/16 -j ACCEPT
$iptables -A FORWARD -p tcp -d 200.201.0.0/16 -j ACCEPT
##### excluir estacoes do proxy, passa direto pelo NAT
$iptables -t nat -A PREROUTING -i $INTERNA -s 192.168.1.37/32 -p tcp -m multiport --dport 80,443 -j ACCEPT
$iptables -t nat -A PREROUTING -i $INTERNA -s 192.168.1.53/32 -p tcp -m multiport --dport 80,443 -j ACCEPT
##### Squid - proxy
#utilize somente uma das opções abaixo, comente as demais
# redireciona o trafego da porta 80 para 3128, execeto a estacao
# com IP 192.168.1.6
#$iptables -t nat -A PREROUTING -i $INTERNA -s \! 192.168.1.6 -p tcp -m multiport --dport 80,443 -j REDIRECT --to-ports 3128
# redireciona o trafego da prota 80 para 3128 (squid)
$iptables -t nat -A PREROUTING -p tcp -m multiport -s 192.168.1.0/24 --dport 80,443 -j REDIRECT --to-ports 3128
## NAT para os demais serviços que trabalham em outras portas,
# como exemplo, libera o acesso a cliente de e-mail e ssh
$iptables -A POSTROUTING -t nat -o $EXTERNA -j MASQUERADE
echo "1" > /proc/sys/net/ipv4/ip_forward
##### VNC
# Redireciona portas na primeira maquina vnc troque o ip conforme a maquina que deseja acessar.
iptables -A FORWARD -i $EXTERNA -p tcp --dport 5800:5900 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $EXTERNA -p udp --dport 5800:5900 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -i $EXTERNA --dport 5800:5900 -j DNAT --to 192.168.1.144:5800-5900
iptables -t nat -A PREROUTING -p udp -i $EXTERNA --dport 5800:5900 -j DNAT --to 192.168.1.144:5800-5900
#Redirecionar para maquina VNC ouvindo na 5801
iptables -A FORWARD -i $EXTERNA -p tcp --dport 5801:5901 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $EXTERNA -p udp --dport 5801:5901 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -i $EXTERNA --dport 5801:5901 -j DNAT --to 192.168.1.144:5801-5901
iptables -t nat -A PREROUTING -p udp -i $EXTERNA --dport 5801:5901 -j DNAT --to 192.168.1.144:5801-5901
#####
