Raspbian Assess Point

# /etc/dnsmasq.conf
pid-file=/var/run/dnsmasq/dnsmasq.pid
log-facility=/var/log/dnsmasq.log
user=dnsmasq
group=dnsmasq
domain=dmal.net
nameserver 127.0.0.1
resolv-file=~/.dnsmasq/resolv.conf
no-hosts
interface=wlan0
no-dhcp-interface=lo,tun0,eth0,wlan1
bind-interfaces
domain-needed
bogus-priv
dhcp-range=192.168.55.10,192.168.55.90,255.25 5.255.0,12h
dhcp-option=3,192.168.55.1
dhcp-host=00:00:00:00:00:00,192.168.55.15

# /etc/hostapd/hostapd.conf
interface=wlan0
driver=nl80211
ssid=ap.an.net
hw_mode=g
ieee80211n=1
ht_capab=[HT40-][SHORT-GI-40]
channel=6
macaddr_acl=0
#macaddr_acl=1
# accept_mac_file=/etc/hostapd/hostapd.accept
wmm_enabled=1
auth_algs=1
ignore_broadcast_ssid=0
# ignore_broadcast_ssid=1
wpa=2
# wpa_psk_file=/etc/hostapd/hostapd.wpa_psk
wpa_passphrase=@@@@@@
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP

# /etc/network/interfaces
# interfaces(5) file used by ifup(8) and ifdown(8)

# Please note that this file is written to be used with dhcpcd
# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'

# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto lo
iface lo inet loopback

iface eth0 inet manual

iface default inet manual

auto wlan0

allow-hotplug wlan0

iface wlan0 inet static
address 192.168.1.46/24
gateway 192.168.1.1
broadcast 192.168.1.255
name_server 192.168.1.1

# address 192.168.4.253/24
# gateway 192.168.4.1
# broadcast 192.168.4.255
# name_server 192.168.4.1

wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

# pre-up iptables-restore < /etc/network/iptables.wlan1.rules
pre-up iptables-restore < /etc/network/iptables.eth0.rules

# Generated by iptables-save v1.4.21 on Wed Oct 18 14:35:05 2017
*mangle
:PREROUTING ACCEPT [2192:2054765]
:INPUT ACCEPT [2041:2047089]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [893:46436]
:POSTROUTING ACCEPT [893:46436]
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Wed Oct 18 14:35:05 2017
# Generated by iptables-save v1.4.21 on Wed Oct 18 14:35:05 2017
*nat
:PREROUTING ACCEPT [298:19605]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i tun0 -p udp -m udp --dport 55 -j REDIRECT --to-ports 55
-A PREROUTING -i tun0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
-A PREROUTING -s 127.0.0.1/32 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 4628
-A PREROUTING -s 127.0.0.1/32 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8624
-A PREROUTING -i wlan0 -p tcp -m tcp --dport 19730 -j REDIRECT --to-ports 19730
-A PREROUTING -i wlan0 -p udp -m udp --dport 55 -j REDIRECT --to-ports 55
-A PREROUTING -i wlan0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Wed Oct 18 14:35:05 2017
# Generated by iptables-save v1.4.21 on Wed Oct 18 14:35:05 2017
*filter
:INPUT DROP [370:30016]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [893:46436]
:sshguard - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j sshguard
-A INPUT -p tcp -m tcp --dport 1:65535 -m state --state NEW -m hashlimit --hashlimit-upto 1/hour --hashlimit-burst 5 --hashlimit-mode srcip --hashlimit-name MPB --hashlimit-htable-expire 90000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1:65535 --tcp-flags SYN,RST,ACK SYN -j DROP
-A INPUT -p tcp -m state --state NEW -m tcp --dport 55 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -p tcp -m state --state NEW -m tcp --dport 55 -j ACCEPT

-A FORWARD -i wlan0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o wlan0 -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -j ACCEPT
COMMIT
# Completed on Wed Oct 18 14:35:05 2017

# Generated by iptables-save v1.4.21 on Wed Oct 18 14:40:05 2017
*mangle
:PREROUTING ACCEPT [629:586227]
:INPUT ACCEPT [588:584207]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [247:12844]
:POSTROUTING ACCEPT [247:12844]
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Wed Oct 18 14:40:05 2017
# Generated by iptables-save v1.4.21 on Wed Oct 18 14:40:05 2017
*nat
:PREROUTING ACCEPT [76:4385]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i tun0 -p udp -m udp --dport 55 -j REDIRECT --to-ports 55
-A PREROUTING -i tun0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
-A PREROUTING -s 127.0.0.1/32 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 4628
-A PREROUTING -s 127.0.0.1/32 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8624
-A PREROUTING -i wlan0 -p tcp -m tcp --dport 19730 -j REDIRECT --to-ports 19730
-A PREROUTING -i wlan0 -p udp -m udp --dport 55 -j REDIRECT --to-ports 55
-A PREROUTING -i wlan0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
-A POSTROUTING -o wlan1 -j MASQUERADE
COMMIT
# Completed on Wed Oct 18 14:40:05 2017
# Generated by iptables-save v1.4.21 on Wed Oct 18 14:40:05 2017
*filter
:INPUT DROP [100:7954]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [247:12844]
:sshguard - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j sshguard
-A INPUT -p tcp -m tcp --dport 1:65535 -m state --state NEW -m hashlimit --hashlimit-upto 1/hour --hashlimit-burst 5 --hashlimit-mode srcip --hashlimit-name MPB --hashlimit-htable-expire 90000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1:65535 --tcp-flags SYN,RST,ACK SYN -j DROP
-A INPUT -p tcp -m state --state NEW -m tcp --dport 55 -j ACCEPT

-A FORWARD -i wlan0 -o wlan1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i wlan1 -o wlan0 -j ACCEPT
-A FORWARD -i wlan0 -o wlan1 -j ACCEPT
COMMIT
# Completed on Wed Oct 18 14:40:05 2017