NAT router with a DMZ of 10.0.0.* and clients on 10.0.1.*; one mail&ssh server and one ftp&web server.
|
#!/bin/sh
IPT='/usr/local/sbin/iptables'
$IPT -F
$IPT -X
$IPT -P FORWARD DROP
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A FORWARD -i eth1 -j ACCEPT
$IPT -A FORWARD -p tcp -m multiport --dports 22,25,993,21,80,443 -j ACCEPT
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -i lo -j ACCEPT
$IPT -t nat -F
$IPT -t nat -X
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t nat -N dmz
$IPT -t nat -A PREROUTING -i eth0 -j dmz
$IPT -t nat -A PREROUTING -d 64.12.48.32 -j dmz
$IPT -t nat -A OUTPUT -d 64.12.48.32 -j dmz
$IPT -t nat -A dmz -p tcp -m multiport --dports 22,25,993 -j DNAT --to-destination 10.0.0.2
$IPT -t nat -A dmz -p tcp -m multiport --dports 21,80,443 -j DNAT --to-destination 10.0.0.3
$IPT -t nat -A POSTROUTING -o eth0 -j MASQUERADE
$IPT -t nat -A POSTROUTING -s 10.0.0.0/8 -d 10.0.0.0/24 -j SNAT --to-source 10.0.0.1
~
|
阅读(1589) | 评论(0) | 转发(0) |
