old-firewall/rules/01-output-snat

#!/bin/bash
rules() {
    iptables --table filter $flag FORWARD -i ${IF_WAN} -o ${IF_LAN} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    iptables --table nat $flag POSTROUTING -s ${NET_LAN} -o ${IF_WAN} -j SNAT --to-source ${HOST_KASHA_WAN}
    # will fix the --to-source line, i promise
    iptables --table nat $flag POSTROUTING -s ${NET_LAN} -d 10.8.0.0/16 -j SNAT --to-source 10.9.1.45
    if ${HAVE_WAN2}; then
        iptables --table nat $flag POSTROUTING -s 10.24.20.10 -o ${IF_WAN} -j SNAT --to-source ${HOST_KASHA_WAN2}
    fi
    # we want to be able to access 192.168.0.1, regardles of which snat we're using
    iptables --table nat $append POSTROUTING -s ${NET_LAN} -d ${NET_WAN} -j SNAT --to-source ${HOST_KASHA_WAN}
}