# REMISE à ZERO des règles de filtrage
iptables -F
iptables -t nat -F
 
 
# DEBUT des "politiques par défaut"
 
iptables -P INPUT DROP
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
 
 
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -p igmp -j ACCEPT
 
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
 
 
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.0.3:80
 
 

ext="xl0"
in="em0"
 
block in on $ext all
pass out on $ext all
pass in on $in all
pass out on $in all
 
nat on $ext inet from $in to any -> ($ext)
rdr on $ext proto tcp from any to ($ext) 80  -> 192.168.0.2 port 80
pass in port ssh