#!/bin/bash

[ -x $IPTABLES ] || exit 43

# ----------------------------- filter_out_lan chain -------------------------------

    $IPTABLES -F filter_out_vpn_lan
    $IPTABLES -A filter_out_vpn_lan -o $LANIF -p all -j ACCEPT

# ------------------------------ filter_in_lan chain -------------------------------

    $IPTABLES -F filter_in_vpn_lan

    $IPTABLES -A filter_in_vpn_lan -i $VPN_LANIF -o $VPN_LANIF -j ACCEPT	# Everything inside VPN
    $IPTABLES -A filter_in_vpn_lan -i $VPN_LANIF -o $LANIF -j ACCEPT		# Everything LAN-VPN

    $IPTABLES -A filter_in_vpn_lan -i $VPN_LANIF -p tcp --dport 8888 -j ACCEPT
    $IPTABLES -A filter_in_vpn_lan -i $VPN_LANIF -p tcp --dport 222 -j ACCEPT

    $IPTABLES -A filter_in_vpn_lan -i $VPN_LANIF -p tcp --dport 21 -j ACCEPT
    $IPTABLES -A filter_in_vpn_lan -i $VPN_LANIF -p tcp --dport 20 -j ACCEPT
    $IPTABLES -A filter_in_vpn_lan -i $VPN_LANIF -p tcp --dport 2121 -j ACCEPT
    $IPTABLES -A filter_in_vpn_lan -i $VPN_LANIF -p tcp --dport 2120 -j ACCEPT
    $IPTABLES -A filter_in_vpn_lan -i $VPN_LANIF -p tcp --dport 49200:50200 -j ACCEPT
    $IPTABLES -A filter_in_vpn_lan -i $VPN_LANIF -p tcp --dport 59200:60200 -j ACCEPT

# drop all remaining

    $IPTABLES -A filter_in_vpn_lan -i $VPN_LANIF -m state --state RELATED,ESTABLISHED -j ACCEPT
    $IPTABLES -A filter_in_vpn_lan -i $VPN_LANIF -m state --state NEW,INVALID -j DROP
    $IPTABLES -A filter_in_vpn_lan -i $VPN_LANIF -j DROP