прошу помощи со скриптом iptables для шлюза

#!/bin/bash
# ******************************************************** Define variables
#
# list of allowed hosts
IMEX="80.247.XX.XXX"            # allowed_machine1 (white_provider_IP)
AVANTEL="109.202.X.XXX"         # allowed_machine2 (white_provider_IP)
DEBUG="192.168.0.65"
# FG="79.122.XXX.XX"            # this_machine_white_provider_IP(WAN)
FG="192.168.0.254" #debug
#
EXT_PORTS="22,3333,3335,3336,5555,6666,8080,9998"                               # accesible WAN port
INT_PORTS="25,53,80,110,143,443,445,1024,2041,2042,5060,5190,11024"             # accessible LAN ports
T_PORT="3389"                   # target port for terminals RDP
#
IPT="/sbin/iptables"            # iptables location
EXT_IF="eth0"                   # external WAN interface
INT_IF="eth1"                   # internal LAN interface
# ******************************************************* End v. defenition
#
echo "\n\tIPTABLES MODIFICATION STARTED\n"
# flashing all rules (twice and separate - to be sure)
$IPT -F && $IPT -t mangle -F && $IPT -t nat -F && $IPT -t filter -F && $IPT -F && echo " - all rules was flushed"
#
# Allow loopback traffic
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT && echo " - local traffic allowed"
#
# Allow packets of established and  related connections
$IPT -A INPUT -i $EXT_IF -p all -m state --state ESTABLISHED,RELATED -j ACCEPT  # WAN
$IPT -A INPUT -i $INT_IF -p all -m state --state ESTABLISHED,RELATED -j ACCEPT  # LAN
echo " - inside initialized connections allowed"
#
# allow Internet access to DEFINED PORTS on external(WAN)interface for DIFENED hosts
$IPT -A INPUT -i $EXT_IF -p tcp -s $IMEX,$AVANTEL,$DEBUG -m multiport --dport $EXT_PORTS -j ACCEPT && echo " - hosts "$IMEX" and "$AVANTEL" added to TRUSTED"
#
# allow NAT (WAN > - - -GATEWAY- - - > LAN) RDP protocol
$IPT -t nat -A PREROUTING -p tcp -d $FG --dport 3333 -j DNAT --to-destination  192.168.1.250:$T_PORT    # RTS
$IPT -t nat -A PREROUTING -p tcp -d $FG --dport 3335 -j DNAT --to-destination  192.168.1.4:$T_PORT      # MAV
$IPT -t nat -A PREROUTING -p tcp -d $FG --dport 3336 -j DNAT --to-destination  192.168.1.2:$T_PORT      # RDC1
$IPT -t nat -A PREROUTING -p tcp -d $FG --dport 5555 -j DNAT --to-destination  192.168.1.232:$T_PORT    # buh-sh
echo " - RDP NAT activated"
#
# Set default policy to DROP ALL
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP && echo " - polycy drop ALL(exclude upper rules) aplied"
#
# port forwarding ()
echo "\n\tIPTABLES MODIFICATION COMPLETED\n"
#

#!/bin/bash
# ******************************************************** Define variables
#
IMEX="80.247.XX.XXX"            # allowed_machine1 (white_provider1_IP)
AVANTEL="109.202.X.XXX"         # allowed_machine2 (white_provider2_IP)
#
DEBUG="192.168.0.65"            # Client_PC_betta_tester
#
MY_NW1="192.168.1.0/24"            # My NetWork1 on eth1 (add 2nd in future)
FG="192.168.0.254"                 #debug (replace with WHITE_ip_of_company_F.XX.Group in future)
D_GW="192.168.0.210"            # default gateway (edit in future)
#
#
EXT_PORTS="22,3333,3335,3336,5555,6666,8080,9998"                     # accesible WAN port
INT_PORTS="25,53,80,110,143,443,445,1024,2041,2042,5060,5190,11024" # accessible LAN ports
#
T_PORT="3389"                   # target Terminals RDP
P_PORT="3128"                    # target Proxy squid3
#
IPT="/sbin/iptables"            # iptables location
#
EXT_IF="eth0"                   # external WAN interface
INT_IF="eth1"                   # internal LAN interface
# ******************************************************* End v. defenition
#
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP                # DROP ALL
$IPT -P FORWARD DROP
$IPT -t mangle -F 
$IPT -t nat -F                     # CLEAR ALL
$IPT -t filter -F 
$IPT -F 
$IPT -A INPUT     -i lo -j ACCEPT    # ALLOW LOOPBACK TRAFFIC
$IPT -A OUTPUT     -o lo -j ACCEPT
# Allow packets of established and  related connections
$IPT -A INPUT     -m state --state ESTABLISHED,RELATED -j ACCEPT  # WAN
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT  # LAN
# Allow IN/OUT connections on trusted ports in LAN 
$IPT -A INPUT     -i $INT_IF -m multiport --dport $INT_PORTS -s $MY_NW1 -j ACCEPT
$IPT -A OUTPUT     -i $INT_IF -m multiport --dport $INT_PORTS -s $MY_NW1 -j ACCEPT
# Allow remote access fot trusted IP's
$IPT -A INPUT -i $EXT_IF -p tcp -s $IMEX,$AVANTEL,$DEBUG -m multiport --dport $EXT_PORTS -j ACCEPT        # DEBUG (temp var)
# RDP port map
$IPT -t nat -A PREROUTING -p tcp -d $FG --dport 3333 -j DNAT --to-destination  192.168.1.250:$T_PORT    # RTS
$IPT -t nat -A PREROUTING -p tcp -d $FG --dport 3335 -j DNAT --to-destination  192.168.1.4:$T_PORT      # MAV
$IPT -t nat -A PREROUTING -p tcp -d $FG --dport 3336 -j DNAT --to-destination  192.168.1.2:$T_PORT      # RDC1
$IPT -t nat -A PREROUTING -p tcp -d $FG --dport 5555 -j DNAT --to-destination  192.168.1.232:$T_PORT    # buh-sh
# FLUSHED ROUTE RECOVERY NEEDED HERE !!!!!!!!!!!!!!!
# ip r a default gw $D_GW
service networking stop && service networking start