Instead of reinventing (and unexpectedly exposing your whole network) you should use something like shorewall to setup your firewall. http://shorewall.net/