firewall.rb

#!/usr/bin/env ruby

host = '192.168.1.14'

map = {
  # www
  2 => { 80 => :tcp },

  # mysql
  3 => {},

  # app
  4 => {},

  # verlihub
  10 => { 411 => :tcp },

  # minecraft
  20 => { 25565 => :tcp },

  # bf1942
  21 => { [28900, 14667, 4711] => :tcp, [14567, 14690, 27900, 22000] => :udp, 23000..23009 => :udp },

  # hlds
  22 => { 27000..27040 => :udp, [27005, 27015] => :all },

  # quake3
  23 => { 27960..27984 => :udp },

  # ut3 ,27900
  24 => { [6500,7777,7778,7787,13000] => :udp },

  # winxp
  100 => { 3389 => :all, 28800..28805 => :tcp, 2300..2400 => :udp, 6073 => :udp }
}

def iptables(protocol, source_ip, source_port, destination_ip, destination_port)
  if protocol == :all
    iptables(:tcp, source_ip, source_port, destination_ip, destination_port)
    iptables(:udp, source_ip, source_port, destination_ip, destination_port)
  else
    puts "iptables -t nat -I PREROUTING -d #{source_ip.to_s} -p #{protocol.to_s} --dport #{source_port.to_s} -j DNAT --to-destination #{destination_ip.to_s}:#{destination_port.to_s}"
  end
end

puts "#!/bin/sh"

map.each do |dest, sets|
  sets.each do |ports, protocol|
    [*ports].each do |port|
      iptables(protocol, host, port, "10.0.0.#{dest.to_s}", port)
    end
  end
end

puts "iptables -I FORWARD -m state -d 10.0.0.0/24 --state NEW,RELATED,ESTABLISHED -j ACCEPT"