#!/bin/bash

#wifi侧网口的IP
wifi_end_ip=192.168.16.224
#tv侧网口的IP
tv_end_ip=192.168.15.224

phone_ip=192.168.16.101
tv_ip=192.168.15.101

#allow fwd
echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -F
iptables -F -t nat
iptables -P INPUT ACCEPT

#default drop fwd
iptables -P FORWARD DROP

#mssfix
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
#accept established
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

#allow fwd
iptables -A FORWARD -s ${phone_ip} -j ACCEPT
iptables -A FORWARD -s ${tv_ip} -j ACCEPT

#为了避免map后ssh 22端口连不进本级，跳过22端口
iptables -t nat -A PREROUTING -p tcp --dport 22 -j RETURN

#phone: DNAT + SNAT
iptables -t nat -A PREROUTING -s ${phone_ip} -d ${wifi_end_ip} -j DNAT --to-destination ${tv_ip}
iptables -t nat -A POSTROUTING -s ${phone_ip} -d ${tv_ip} -j SNAT --to-source ${tv_end_ip}

#tv: DNAT + SNAT
iptables -t nat -A PREROUTING -s ${tv_ip} -d ${tv_end_ip} -j DNAT --to-destination ${phone_ip}
iptables -t nat -A POSTROUTING -s ${tv_ip} -d ${phone_ip} -j SNAT --to-source ${wifi_end_ip}




