#! /bin/bash
# Project by Platinum, 2005-05-12"
# Set MODE (LAN or ADSL)
MODE="ADSL"
# Set default gateway (如果MODE==ADSL,此项可以忽略)
GATEWAY="外网网关"
# Set Interface WAN (如果MODE==ADSL,此项可以忽略)
WAN_IP="外网IP地址"
WAN_ETH="外网网卡"
WAN_MASK="外网掩码"
# Set Interface LAN
LAN_IP="内网IP地址"
LAN_NET="内网网络地址"
LAN_ETH="内网网卡"
LAN_MASK="内网掩码"
# Set manager
MANAGER_IP="内网管理员IP"
MANAGER_MAC="内网管理员MAC"
# Initialize modules
modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
# Initialize Interface LAN
ifconfig $LAN_ETH $LAN_IP netmask $LAN_MASK
# Initialize policy
iptables -P INPUT DROP
iptables -P FORWARD ACCEPT
iptables -F
iptables -t nat -F
# Deny ACK attack
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
# Initialize Rules
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i $LAN_ETH -s $MANAGER_IP -m mac --mac-source $MANAGER_MAC -j ACCEPT
# Added in 2006.02.08, accept all icmp packets except echo-request rate 5/s
# ========== begin ==========
iptables -A INPUT -p icmp --icmp-type 8 -m limit --limit 5/s -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 8 -j DROP
iptables -A INPUT -p icmp -j ACCEPT
# =========== end ===========
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
case "$MODE" in
LAN)
# Initialize Interface WAN
ifconfig $WAN_ETH $WAN_IP netmask $WAN_MASK
iptables -t nat -A POSTROUTING -s $LAN_NET -o $WAN_ETH -j SNAT --to $WAN_IP
;;
ADSL)
iptables -t nat -A POSTROUTING -s $LAN_NET -o ppp0 -j MASQUERADE
GATEWAY=`ifconfig ppp0|grep inet|awk '{print $3}'|awk -F: '{print $2}'`
;;
esac
ip route replace default via $GATEWAY