iptables设置一例

王朝other·作者佚名  2008-05-18
窄屏简体版  字體: |||超大  

只需要一个公网地址设在外接口上,内部用私网地址组网即可,在内部服务器提供Internet服务。

#!/bin/sh

#--------------------------------------------

#

# 外接口eth0,开放 vpn ssh

# 内接口eth1,绑定 dhcp dns squid

# 向内部服务器转发 ftp smtp www pop3

# 支持透明代理

#

# 胖头鱼:pangty@ta139.com

#

#--------------------------------------------

EXT_IF="eth0"

INT_IF="eth1"

EXT_IP="" #公网IP

INT_IP="" #内接口IP

SERVER_IP="" #内部服务器IP

# pptpd_vpn_service ssh

TRUSTED_LOCAL_TCP_PORT="1723 22"

TRUSTED_LOCAL_UDP_PORT="22"

# ftp-data ftp smtp http pop3

FWD_TCP_PORT="20 21 25 80 110"

FWD_UDP_PORT="20 21 25 80 110"

# load any special modules

modprobe ip_nat_ftp

modprobe ip_conntrack_ftp

modprobe ip_nat_irc

modprobe ip_conntrack_irc

# turn on ip forwarding

echo "1" > /proc/sys/net/ipv4/ip_forward

# setting up ip spoofing protection

for f in /proc/sys/net/ipv4/conf/*/rp_filter; do

echo 1 > $f

done

# delete any existing chains

iptables -F -t filter

iptables -X -t filter

iptables -Z -t filter

iptables -F -t nat

iptables -X -t nat

iptables -Z -t nat

# setting up default policies

iptables -P INPUT DROP

iptables -P FORWARD DROP

iptables -P OUTPUT ACCEPT

iptables -t nat -P PREROUTING ACCEPT

iptables -t nat -P POSTROUTING ACCEPT

iptables -t nat -P OUTPUT ACCEPT

#---------------------- filter ---------------------

# allow ping from internet

iptables -A INPUT -i $EXT_IF -p icmp -j ACCEPT

# enable local traffic

#------------------------------------------------------------------------

# iptables -A INPUT ! -i $EXT_IF -m state --state NEW -j ACCEPT

# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#

# iptables -A FORWARD ! -i $EXT_IF -m state --state NEW -j ACCEPT

# iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

#------------------------------------------------------------------------

iptables -N allowed

iptables -A allowed ! -i $EXT_IF -m state --state NEW -j ACCEPT

iptables -A allowed -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -j allowed

iptables -A FORWARD -j allowed

for PORT in $TRUSTED_LOCAL_TCP_PORT; do

iptables -A INPUT -i $EXT_IF -p tcp --dport $PORT -m state --state NEW -j

ACCEPT

done

for PORT in $TRUSTED_LOCAL_UDP_PORT; do

iptables -A INPUT -i $EXT_IF -p udp --dport $PORT -m state --state NEW -j

ACCEPT

done

#---------------------- nat ---------------------

# port forwarding

for PORT in $FWD_TCP_PORT; do

iptables -A FORWARD -i $EXT_IF -o $INT_IF -d $SERVER_IP

-p tcp --dport $PORT -m state --state NEW -j ACCEPT

iptables -t nat -A PREROUTING -d $EXT_IP

-p tcp --dport $PORT -j DNAT --to-destination $SERVER_IP

iptables -t nat -A POSTROUTING -d $SERVER_IP

-p tcp --dport $PORT -j SNAT --to-source $INT_IP

done

for PORT in $FWD_UDP_PORT; do

iptables -A FORWARD -i $EXT_IF -o $INT_IF -d $SERVER_IP

-p udp --dport $PORT -m state --state NEW -j ACCEPT

iptables -t nat -A PREROUTING -d $EXT_IP

-p udp --dport $PORT -j DNAT --to-destination $SERVER_IP

iptables -t nat -A POSTROUTING -d $SERVER_IP

-p udp --dport $PORT -j SNAT --to-source $INT_IP

done

# Transparent Proxy

iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport 80 -j REDIRECT --to-

port 3128

# SNAT or MASQUERADE

#------------------------------------------------------------------------

# iptables -t nat -A POSTROUTING -o $EXT_IF -j SNAT --to-source $EXT_IP

#------------------------------------------------------------------------

iptables -t nat -A POSTROUTING -o $EXT_IF -j MASQUERADE

# THE END

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
 
 
© 2005- 王朝網路 版權所有 導航