Script firewall, Está correto?

Bom pessoal vou explicar

Tenho 03 Eth's
Eth0 = Router ( Internet )
Eth1= Lan Segura ( Acesso Full )
Eth2= Lan insegura ( Proxy)

Como este script quero deixar um nat full para a eth1 e o que passar pela eth2 cair no proxy

segue firewall

#!/bin/bash

IPT=`which iptables`;
LAN_ROUTER='eth0'
LAN_INTRANET_SEG='eth1'
LAN_INTRANET_LAB='eth2'
IP_ROUTER='10.68.25.1'
IP_INTRASEG='192.168.1.1'
IP_INTRALAB='192.168.2.1'
LAN_IP_ROUTER='10.68.25.0/8'
LAN_IP_SEG='192.168.1.0/24'
LAN_IP_LAB='192.168.2.0/24'

#ativa o roteamento dinamico
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/ip_dynaddr

# ================ POLITICAS PADRAO ===================
$IPT -t filter -P INPUT DROP
$IPT -t filter -P FORWARD DROP
$IPT -t filter -P OUTPUT ACCEPT
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P POSTROUTING ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT
$IPT -t mangle -P INPUT ACCEPT
$IPT -t mangle -P FORWARD ACCEPT

# Cria chain com regras de segurança
$IPT -N BLOCK
$IPT -A BLOCK -p icmp --icmp-type echo-request -j DROP
$IPT -A BLOCK -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
$IPT -A BLOCK -p tcp -m limit --limit 1/s -j ACCEPT
$IPT -A BLOCK -p tcp --tcp-flags SYN,ACK,FIN,RST SYN -m limit --limit 1/s -j ACCEPT
$IPT -A BLOCK -m unclean -j DROP
$IPT -A BLOCK -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A BLOCK -j LOG --log-prefix "FW_ALERT: "
$IPT -A BLOCK -j DROP

# Muda a prioridade dos pacotes (Type Of Service) para agilizar as coisas
$IPT -t mangle -A OUTPUT -o $LAN_ROUTER -p tcp -m multiport --dports 21,22,80,6667 -j TOS --set-tos 0x10

# Libera todo o trafego local
$IPT -t filter -A INPUT -i lo -j ACCEPT
$IPT -t filter -A INPUT -i $LAN_INTRANET_SEG -j ACCEPT
$IPT -t filter -A INPUT -i $LAN_INTRANET_LAB -j ACCEPT
$IPT -t filter -A FORWARD -i $LAN_INTRANET_SEG -j ACCEPT
$IPT -t filter -A FORWARD -i $LAN_INTRANET_LAB -j ACCEPT

# Libera a conexao para a rede interna
$IPT -t nat -A POSTROUTING -s $LAN_IP_SEG -j MASQUERADE
iptables -t nat -A PREROUTING -i $LAN_ROUTER -p tcp --dport 80 -j DNAT --to 192.168.2.1:3128

# Regras para evitar packet flood
$IPT -A INPUT -j BLOCK
$IPT -A FORWARD -j BLOCK

ainda estou terminando