iptables实例

只需要一个公网地址设在外接口上，内部用私网地址组网即可，在内部服务器提供Internet服务。

#!/bin/sh

#--------------------------------------------
#
# 外接口eth0，开放 vpn ssh
# 内接口eth1，绑定 dhcp dns squid
# 向内部服务器转发 ftp smtp www pop3
# 支持透明代理
#
# 胖头鱼：[e-mail]
#
#--------------------------------------------

EXT_IF="eth0"
INT_IF="eth1"
EXT_IP="" #公网IP
INT_IP="" #内接口IP
SERVER_IP="" #内部服务器IP

# pptpd_vpn_service ssh
TRUSTED_LOCAL_TCP_PORT="1723 22"
TRUSTED_LOCAL_UDP_PORT="22"

# ftp-data ftp smtp http pop3
FWD_TCP_PORT="20 21 25 80 110"
FWD_UDP_PORT="20 21 25 80 110"

# load any special modules
modprobe ip_nat_ftp
modprobe ip_conntrack_ftp
modprobe ip_nat_irc
modprobe ip_conntrack_irc

# turn on ip forwarding
echo "1" > /proc/sys/net/ipv4/ip_forward

# setting up ip spoofing protection
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $f
done

# delete any existing chains
iptables -F -t filter
iptables -X -t filter
iptables -Z -t filter
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat

# setting up default policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT

#---------------------- filter ---------------------

# allow ping from internet
iptables -A INPUT -i $EXT_IF -p icmp -j ACCEPT

# enable local traffic
#------------------------------------------------------------------------
# iptables -A INPUT ! -i $EXT_IF -m state --state NEW -j ACCEPT
# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# iptables -A FORWARD ! -i $EXT_IF -m state --state NEW -j ACCEPT
# iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#------------------------------------------------------------------------

iptables -N allowed
iptables -A allowed ! -i $EXT_IF -m state --state NEW -j ACCEPT
iptables -A allowed -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -j allowed
iptables -A FORWARD -j allowed

for PORT in $TRUSTED_LOCAL_TCP_PORT; do
iptables -A INPUT -i $EXT_IF -p tcp --dport $PORT -m state --state NEW -j
ACCEPT

done

for PORT in $TRUSTED_LOCAL_UDP_PORT; do
iptables -A INPUT -i $EXT_IF -p udp --dport $PORT -m state --state NEW -j
ACCEPT

done

#---------------------- nat ---------------------

# port forwarding
for PORT in $FWD_TCP_PORT; do
iptables -A FORWARD -i $EXT_IF -o $INT_IF -d $SERVER_IP
-p tcp --dport $PORT -m state --state NEW -j ACCEPT
iptables -t nat -A PREROUTING -d $EXT_IP
-p tcp --dport $PORT -j DNAT --to-destination $SERVER_IP
iptables -t nat -A POSTROUTING -d $SERVER_IP
-p tcp --dport $PORT -j SNAT --to-source $INT_IP
done

for PORT in $FWD_UDP_PORT; do
iptables -A FORWARD -i $EXT_IF -o $INT_IF -d $SERVER_IP
-p udp --dport $PORT -m state --state NEW -j ACCEPT
iptables -t nat -A PREROUTING -d $EXT_IP
-p udp --dport $PORT -j DNAT --to-destination $SERVER_IP
iptables -t nat -A POSTROUTING -d $SERVER_IP
-p udp --dport $PORT -j SNAT --to-source $INT_IP
done

# Transparent Proxy
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport 80 -j REDIRECT --to-
port 3128


# SNAT or MASQUERADE
#------------------------------------------------------------------------
# iptables -t nat -A POSTROUTING -o $EXT_IF -j SNAT --to-source $EXT_IP
#------------------------------------------------------------------------
iptables -t nat -A POSTROUTING -o $EXT_IF -j MASQUERADE

# THE END