Настройка сети

IP1=a.b.c.d
IP2=192.168.1.1
GATE1=a.b.c.e
GATE2=192.168.1.1

TABLE1=P1
M1=1

TABLE2=P2
M2=10

ip route flush table $TABLE1
ip route add default via $GATE1 table $TABLE1
ip route del default via $GATE1
ip route add default via $GATE1 metric $M1
ip rule del table $TABLE1
ip rule del table $TABLE1
ip rule add from $IP1 table $TABLE1

ip route flush table $TABLE2
ip route add default via $GATE2 table $TABLE2
ip route del default via $GATE2
ip route add default via $GATE2 metric $M2
ip rule del table $TABLE2
ip rule add from $IP2 table $TABLE2

ip rule add from 10.1.0.0/24 table $TABLE1
ip route add 10.1.0.0/24 via 10.1.0.1 dev br0 table $TABLE1
ip route flush cache

iptables -F
iptables -F -t nat
iptables -F -t mangle
iptables -X
iptables -t nat -X
iptables -t mangle -X

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A INPUT -i eth3 -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -o br0 -j ACCEPT
iptables -A OUTPUT -o eth3 -j ACCEPT

iptables -A INPUT -p all -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p all -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p all -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

iptables -A INPUT -m state --state INVALID -j DROP
iptables -A FORWARD -m state --state INVALID -j DROP

iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP

iptables -A FORWARD -i br0 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o br0 -j REJECT

iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/24 -j SNAT --to-source a.b.c.d

iptables -A INPUT -i eth0 -p tcp --dport  80 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport  80 -j ACCEPT
...