Бадаюсь с iptables

eth8      Link encap:Ethernet  HWaddr 1c:af:f7:08:06:41  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::1eaf:f7ff:fe08:641/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:40 errors:0 dropped:0 overruns:0 frame:0
          TX packets:102 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:3068 (3.0 KB)  TX bytes:13499 (13.4 KB)
          Interrupt:16 

eth9      Link encap:Ethernet  HWaddr 00:e0:52:aa:35:6f  
          inet6 addr: fe80::2e0:52ff:feaa:356f/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1836 errors:0 dropped:109 overruns:0 frame:0
          TX packets:1881 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1614999 (1.6 MB)  TX bytes:291980 (291.9 KB)
          Interrupt:17 Base address:0xc400 

lo        Link encap:Локальная петля (Loopback)  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:16 errors:0 dropped:0 overruns:0 frame:0
          TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:960 (960.0 B)  TX bytes:960 (960.0 B)

ppp0      Link encap:Протокол PPP (Point-to-Point Protocol)  
          inet addr:82.142.148.172  P-t-P:194.67.0.113  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1
          RX packets:1738 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1861 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3 
          RX bytes:1570480 (1.5 MB)  TX bytes:249124 (249.1 KB)

#!/bin/sh
PATH=/usr/sbin:/sbin:/bin:/usr/bin
# delete all existing rules.
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
# Always accept loopback traffic
iptables -A INPUT -i lo -j ACCEPT
# Allow established connections, and those not coming from the outside
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ppp0 -j ACCEPT
iptables -A FORWARD -i ppp0 -o eth9 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow outgoing connections from the LAN side.
iptables -A FORWARD -i eth9 -o ppp0 -j ACCEPT
# Disabling SMB connections from Internet
iptables -A INPUT -i ppp0 -p tcp --dport microsoft-ds -j DROP
iptables -A INPUT -i ppp0 -p udp --dport microsoft-ds -j DROP
# SSH connect policy. Allow only 2 connections within 10 minute period.
iptables -I INPUT -p tcp --dport 22 -i ppp0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -i ppp0 -m state --state NEW -m recent --update --seconds 600 --hitcount 2 -j DROP
# Masquerade.
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth8 -j MASQUERADE
# mtu
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
# Don't forward from the outside to the inside.
iptables -A FORWARD -i ppp0 -o ppp0 -j REJECT
iptables -A FORWARD -i eth8 -o ppp0 -j REJECT
# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward

cat /etc/network/interfaces 
auto lo
iface lo inet loopback

auto eth8
iface eth8 inet static
		  address 192.168.1.1
                  netmask 255.255.255.0
                  network 192.168.1.0
                  broadcast 192.168.1.255
pre-up iptables-restore < /etc/iptables.up.rules

#!/bin/bash

/sbin/iptables -F
/sbin/iptables -t nat -F

echo 1 > /proc/sys/net/ipv4/ip_forward

/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -P FORWARD DROP

export LAN=eth8
export WAN=wimax0

/sbin/iptables -I INPUT 1 -i ${LAN} -j ACCEPT
/sbin/iptables -I INPUT 1 -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
/sbin/iptables -A INPUT -p TCP --dport ssh -i ${WAN} -j ACCEPT
/sbin/iptables -t mangle -A FORWARD -p tcp -o ${WAN}  --tcp-flags SYN,RST SYN  -j TCPMSS --clamp-mss-to-pmtu
/sbin/iptables -I FORWARD -i ${LAN} -d 192.168.0.0/255.255.0.0 -j DROP
/sbin/iptables -A FORWARD -i ${LAN} -s 192.168.0.0/255.255.0.0 -j ACCEPT
/sbin/iptables -A FORWARD -i ${WAN} -d 192.168.0.0/255.255.0.0 -j ACCEPT
/sbin/iptables -t nat -A POSTROUTING -o $WAN  -j MASQUERADE