==== Script de firewall no Debian ====
A primeira coisa que precisamos fazer é liberar o repasse de pacotes entre as interfaces de rede, no kernel:
<code bash>
# vim /etc/sysctl.conf
[...]
net.ipv4.ip_forward=1
[...]
</code>

Releia:
<file bash>
# sysctl -p
net.ipv4.ip_forward = 1
</file>

Adicione o cabeçalho para inicialização durante o boot:
<file bash>
# head /etc/init.d/ssh > /etc/init.d/firewall
</file>

Conceda a permissão de execução para o script:
<file bash>
# chmod +x /etc/init.d/firewall
</file>

Script de gerenciamento completo:
<file bash>
# cat /etc/init.d/firewall 
</file>
<code bash firewall.sh>
#!/bin/bash

### BEGIN INIT INFO
# Provides:		firewall
# Required-Start:	$remote_fs $syslog
# Required-Stop:	$remote_fs $syslog
# Default-Start:	2 3 4 5
# Default-Stop:		0 1 6
# Short-Description:	Firewal
### END INIT INFO

case $1 in

stop)

	# Definindo Politica ACCEPT - ACEITA TUDO
	iptables -t filter -P OUTPUT ACCEPT
	iptables -t filter -P INPUT ACCEPT
	iptables -t filter -P FORWARD ACCEPT

	# Limpar as Regras de todas as tableas
	iptables -t filter -F
	iptables -t nat -F
	iptables -t mangle -F
	iptables -t raw -F
	iptables -t security -F

	# Bloquear a passagem de pacotes pelo kernel
	echo 0 > /proc/sys/net/ipv4/ip_forward
	echo -e "[\033[0;32m ok\033[m ] Stopping Security Firewall"

;;


start)
	$0 stop
	sleep 0.5
	echo -e "[\033[0;32m ok\033[m ] Starting Security Firewall"
	# liberar a passagem de pacotes pelo kernel
	echo 1 > /proc/sys/net/ipv4/ip_forward

	# Iniciando as Regras
	bash /etc/firewall/rules
;;

restart)
	$0 start
;;

*)
	echo 'POR FAVOR USE "stop|start|restart"'
;;

esac
</code>

Arquivo com as regras:
<file bash>
# cat /etc/firewall/rules
</file>
<code bash rule.sh> 
#!/bin/bash

WAN=eth1

iptables -F
iptables -t nat -F
iptables -t mangle -F

iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P INPUT ACCEPT

iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
</code>

Para que ele seja iniciado junto com sistema quando a máquina for ligada, podemos colocar o "script"nos níveis de execução:
<file bash>
# insserv -d firewall
# ls -l /etc/rc2.d/
</file>