iptables设置一例

Web	me09.cublog.cn

iptables设置一例

[ 作者:  加入时间:2006-04-07 11:58:49  来自:Linux联盟 ]

只需要一个公网地址设在外接口上，内部用私网地址组网即可，在内部服务器提供Internet服务。 #!/bin/sh #-------------------------------------------- # # 外接口eth0，开放 vpn ssh # 内接口eth1，绑定 dhcp dns squid # 向内部服务器转发 ftp smtp www pop3 # 支持透明代理 # # 胖头鱼：[e-mail] # #-------------------------------------------- EXT_IF="eth0" INT_IF="eth1" EXT_IP="" #公网IP INT_IP="" #内接口IP SERVER_IP="" #内部服务器IP # pptpd_vpn_service ssh TRUSTED_LOCAL_TCP_PORT="1723 22" TRUSTED_LOCAL_UDP_PORT="22" # ftp-data ftp smtp http pop3 FWD_TCP_PORT="20 21 25 80 110" FWD_UDP_PORT="20 21 25 80 110" # load any special modules modprobe ip_nat_ftp modprobe ip_conntrack_ftp modprobe ip_nat_irc modprobe ip_conntrack_irc # turn on ip forwarding echo "1" > /proc/sys/net/ipv4/ip_forward # setting up ip spoofing protection for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f done # delete any existing chains iptables -F -t filter iptables -X -t filter iptables -Z -t filter iptables -F -t nat iptables -X -t nat iptables -Z -t nat # setting up default policies iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT iptables -t nat -P PREROUTING ACCEPT iptables -t nat -P POSTROUTING ACCEPT iptables -t nat -P OUTPUT ACCEPT #---------------------- filter --------------------- # allow ping from internet iptables -A INPUT -i $EXT_IF -p icmp -j ACCEPT # enable local traffic #------------------------------------------------------------------------ # iptables -A INPUT ! -i $EXT_IF -m state --state NEW -j ACCEPT # iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # # iptables -A FORWARD ! -i $EXT_IF -m state --state NEW -j ACCEPT # iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT #------------------------------------------------------------------------ iptables -N allowed iptables -A allowed ! -i $EXT_IF -m state --state NEW -j ACCEPT iptables -A allowed -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -j allowed iptables -A FORWARD -j allowed for PORT in $TRUSTED_LOCAL_TCP_PORT; do iptables -A INPUT -i $EXT_IF -p tcp --dport $PORT -m state --state NEW -j  ACCEPT done for PORT in $TRUSTED_LOCAL_UDP_PORT; do iptables -A INPUT -i $EXT_IF -p udp --dport $PORT -m state --state NEW -j  ACCEPT done #---------------------- nat --------------------- # port forwarding for PORT in $FWD_TCP_PORT; do iptables -A FORWARD -i $EXT_IF -o $INT_IF -d $SERVER_IP  -p tcp --dport $PORT -m state --state NEW -j ACCEPT iptables -t nat -A PREROUTING -d $EXT_IP  -p tcp --dport $PORT -j DNAT --to-destination $SERVER_IP iptables -t nat -A POSTROUTING -d $SERVER_IP  -p tcp --dport $PORT -j SNAT --to-source $INT_IP done for PORT in $FWD_UDP_PORT; do iptables -A FORWARD -i $EXT_IF -o $INT_IF -d $SERVER_IP  -p udp --dport $PORT -m state --state NEW -j ACCEPT iptables -t nat -A PREROUTING -d $EXT_IP  -p udp --dport $PORT -j DNAT --to-destination $SERVER_IP iptables -t nat -A POSTROUTING -d $SERVER_IP  -p udp --dport $PORT -j SNAT --to-source $INT_IP done # Transparent Proxy iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport 80 -j REDIRECT --to- port 3128 # SNAT or MASQUERADE #------------------------------------------------------------------------ # iptables -t nat -A POSTROUTING -o $EXT_IF -j SNAT --to-source $EXT_IP #------------------------------------------------------------------------ iptables -t nat -A POSTROUTING -o $EXT_IF -j MASQUERADE # THE END收集整理