iptables -t mangle -A OUTPUT -p tcp -m multiport --dports 25,80,8245 -j MARK --set-mark 0x1
iptables -t nat -A POSTROUTING -o $interfaceWWW -p tcp -m multiport --dports 25,80,8245 -j SNAT --to $localIP

#/etc/iproute2/rt_tables

#
# reserved values
#
255	local
254	main
253	default
0	unspec
#
# local
#
#1	inr.ruhep
1     connection


#/etc/network/if-up.d/parefeu

#!/bin/sh
#
set -e
if [ "$IFACE" = eth0 ]; then

/sbin/ip route add 192.168.10.0/24 dev eth0 src 192.168.10.140 table connection
/sbin/ip route add default via 192.168.10.254 table connection
/sbin/ip rule add from 192.168.1.140 table connection

fi


#/etc/network/if-down.d/parefeu

#!/bin/sh
#
set -e
if [ "$IFACE" = eth0 ]; then

/sbin/ip route del 192.168.10.0/24 dev eth0 src 192.168.10.140 table connection
/sbin/ip route del default via 192.168.10.254 table connection
/sbin/ip rule del from 192.168.10.140 table connection

fi

root@cubie:~# /usr/local/bin/noip2 -C

Auto configuration for Linux client of no-ip.com.

Multiple network devices have been detected.

Please select the Internet interface from this list.

By typing the number associated with it.
0       eth0
1       tun0
0

root@cubie:~# /usr/local/bin/noip2 -S
1 noip2 process active.

Process 27804, started as noip2, (version 2.1.9)
Using configuration from /usr/local/etc/no-ip2.conf
Last IP Address set 83.149.126.77
Account xxxxx@yyyyy.net
configured for:
        host  xyz.myftp.biz
        host  xyz.serveftp.com
        host  xyz.sytes.net
Executing username=xyz..... upon successful update.
Updating every 30 minutes via /dev/eth0

COMMENT UTILISER LE CLIENT SANS LIRE LE RESTE DU TEXTE

Operation usuelle?
/usr/local/bin/noip2 -C       configure un client
/usr/local/bin/noip2          Lance un client
/usr/local/bin/noip2 -S       affiche des infos sur les clients lances
/usr/local/bin/noip2 -D pid   change l'etat de debug pour le client pid
/usr/local/bin/noip2 -K pid   termine le client pid

Si vous etes derriere un parefeu, vous devrez avoir besoin d'autoriser le port
8245 (TCP) dans les deux directions.

#!/bin/sh
interfaceWWW="eth0"
interfaceVPN="tun0"
localIP="192.168.10.140"
network="192.168.10.0/24"
vpnPort1="443"
sshport="29561"
torrentPorts="23951,28306,28308,28311"
ftpportstart="40110"
ftpportend="40210"
serverport="80,443,8245"

# Rappel IPTables .
#
#           /----------\         /-------\         /-----------\
# IN--->---< PREROUTING >--->---< FORWARD >--->---< POSTROUTING >--->--OUT
#           \----------/         \-------/         \-----------/
#              \                                            /
#               \                                          /
#             /-----\         /-------------\         /------\
#            < INPUT >--->---< LOCAL PROCESS >--->---< OUTPUT >
#             \-----/         \-------------/         \------/

 start() {
# Dans cette partie, on met en place le firewall
#vidage des chaines
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -Z INPUT
iptables -Z OUTPUT
iptables -Z FORWARD

#destruction des chaines personnelles
#stratégies par défaut

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# boucle locale 

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT 

#on accepte tout le réseau local :)
iptables -A INPUT -s $network -j ACCEPT
iptables -A OUTPUT -d $network -j ACCEPT
iptables -A FORWARD -s $network -j ACCEPT 

#on autorise toutes les connexions déjà etablies

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# ICMP
iptables -A OUTPUT -p icmp -o $interfaceWWW -j ACCEPT


#on autorise les connexions sortantes vers le VPN sur interfaceWWW pour initialiser les connexions VPN
iptables -A OUTPUT -p TCP --dport $vpnPort1 -m state --state NEW -o $interfaceWWW -j ACCEPT

#on accepte tous les débits sur le port 80...443 https... venant d'internet (serveur APACHE)
iptables -A INPUT -p TCP -m multiport --dports $serverport -m state --state NEW  -i $interfaceWWW -j ACCEPT
iptables -A INPUT -p UDP -m multiport --dports $serverport -m state --state NEW  -i $interfaceWWW -j ACCEPT

#VSFTPD
iptables -A INPUT -p TCP -m multiport --dports $ftpportstart:$ftpportend -m state --state NEW  -i $interfaceWWW -j ACCEPT
iptables -A INPUT -p UDP -m multiport --dports $ftpportstart:$ftpportend -m state --state NEW  -i $interfaceWWW -j ACCEPT


## SSH
iptables -A OUTPUT -p TCP --dport $sshport -m state --state NEW -o $interfaceWWW -j ACCEPT

### P2P
iptables -A INPUT -p TCP -m multiport --dports $torrentPorts -m state --state NEW -i $interfaceVPN -j ACCEPT


#on autorise les connexions sortantes sur le VPN
iptables -A OUTPUT -m state --state NEW -o $interfaceVPN -j ACCEPT

#on autorise les connexions sortantes vers le 25 sur interfaceWWW
iptables -A OUTPUT -p TCP --dport 25 -m state --state NEW -o $interfaceWWW -j ACCEPT

#on autorise les DNS sortantes pour initialiser la connexion : port 53
iptables -A OUTPUT -p UDP --dport 53 -m state --state NEW -o $interfaceWWW -j ACCEPT

echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/$interfaceWWW/rp_filter
ip rule add fwmark 0x1 table connection

#on fait passer les connections SMTP et no-ip sur la connection internet standard
iptables -t mangle -A OUTPUT -p tcp -m multiport --dports 25,8245 -j MARK --set-mark 0x1
iptables -t nat -A POSTROUTING -o $interfaceWWW -p tcp -m multiport --dports 25,8245 -j SNAT --to $localIP


}
 

 
 stop() {

     iptables -P INPUT ACCEPT
     iptables -P FORWARD ACCEPT
     iptables -P OUTPUT ACCEPT
     iptables -F
 }
  
 case "$1" in
  start)
         start
         ;;
  stop)
         stop
         ;;
 restart)
         stop && start
         ;;
 *)
         echo "Usage $0 {start|stop|restart}"
         exit 1
 esac
  
 exit 0

man ufw