1. #!/bin/bash
2.  
3. IPTABLES=iptables
4. IPTABLES6=ip6tables
5.  
6. set -x
7.  
8. modprobe ipt_LOG # old?
9. modprobe ip6t_LOG # old?
10.  
11. modprobe nf_log_ipv4
12. modprobe nf_log_ipv6
13.  
14. sysctl net.netfilter.nf_log.2=nf_log_ipv4
15. sysctl net.netfilter.nf_log.10=nf_log_ipv6
16.  
17. echo 1 > /proc/sys/net/ipv4/ip_forward || fail "Can not set IP forwarding"
18.  
19. echo "   Clearing any existing rules and setting default policy.."
20. $IPTABLES -P INPUT ACCEPT ; $IPTABLES -F INPUT
21. $IPTABLES -P OUTPUT ACCEPT ; $IPTABLES -F OUTPUT
22. $IPTABLES -P FORWARD DROP ; $IPTABLES -F FORWARD
23. $IPTABLES -t nat -F ; $IPTABLES -t raw -F
24.  
25. $IPTABLES6 -P INPUT ACCEPT ; $IPTABLES6 -F INPUT
26. $IPTABLES6 -P OUTPUT ACCEPT ; $IPTABLES6 -F OUTPUT
27. $IPTABLES6 -P FORWARD DROP ; $IPTABLES6 -F FORWARD
28. $IPTABLES6 -t nat -F ; $IPTABLES6 -t raw -F
29.  
30. EXTIF="ens3" # my NIC that connects into Gateway to Internet
31. INTIF="galaxy1" # the tuntap - my NIC that connects into the Client(s) that want to NAT through me
32.  
33. echo "   Enabling SNAT (MASQUERADE) functionality on $EXTIF"
34.  
35. $IPTABLES6 -A FORWARD -j LOG
36.  
37. $IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE # ***
38.  
39. $IPTABLES -A INPUT -i "$INTIF" -j ACCEPT
40. $IPTABLES -A OUTPUT -o "$INTIF" -j ACCEPT
41. $IPTABLES -A FORWARD -j ACCEPT