modprobe ip_conntrack_ftp


iptables -P FORWARD DROP
iptables -A FORWARD -i eth1 -s 172.16.12.0/24 -d 192.9.9.3 -p icmp --icmp-type echo-request -j ACCEPT
iptables -A FORWARD -i eth0 -d 172.16.12.0/24 -s 192.9.9.3 -p icmp --icmp-type echo-reply -j ACCEPT

iptables -A FORWARD -i eth1 -s 172.16.12.0/24  -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -d 172.16.12.0/24  -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

#accept dns connection
iptables -A FORWARD -i eth1 -s 172.16.12.0/24  -p udp --dport 53 -m state --state NEW,ESTABLISHED  -j ACCEPT
iptables -A FORWARD -i eth0 -d 172.16.12.0/24 -p udp --sport 53 -m state --state ESTABLISHED -j ACCEPT