NAT iptables防火墙(script)

答案：
#!/bin/sh 
# make me executable (chmod a+x rc.firewall ) and run me on boot 
# 
# djweis@sjdjweis.com 
# iptables firewall script 
# this script is meant to be run once per boot 
# the rules will be double added if you try to run it twice 
# if you need to add another rule during runtime, change the 
# -A to a -I to add it to the top of the list of rules 
# if you use -A it will go at the end after the reject rule :-( 
# 

# inte易做图ce definitions 
BAD_IFACE=eth0 
DMZ_IFACE=eth1 
DMZ_ADDR=x.x.x.96/28 
GOOD_IFACE=eth2 
GOOD_ADDR=192.168.1.0/24 
MASQ_SERVER=x.x.x.98 
FTP_SERVER=x.x.x.100 
MAIL_SERVER=x.x.x.99 
MAIL_SERVER_INTERNAL=192.168.1.3 
# testing 
#set -x 
ip route del x.x.x.96/28 dev $BAD_IFACE 
ip route del x.x.x.96/28 dev $DMZ_IFACE 
ip route add x.x.x.97 dev $BAD_IFACE 
ip route add x.x.x.96/28 dev $DMZ_IFACE 
# we need proxy arp for the dmz network 
echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp 
echo 1 > /proc/sys/net/ipv4/conf/eth1/proxy_arp 
# turn on ip forwarding 
echo 1 > /proc/sys/net/ipv4/ip_forward 
# turn on antispoofing protection 
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f; done 
# flush all rules in the filter table 
#iptables -F 
# flush built in rules 
iptables -F INPUT 
iptables -F OUTPUT 
iptables -F FORWARD 
# deny everything for now 
iptables -A INPUT -j DROP 
iptables -A FORWARD -j DROP 
iptables -A OUTPUT -j DROP 
# make the chains to define packet directions 
# bad is the internet, dmz is our dmz, good is our masqed network 
iptables -N good-dmz 
iptables -N bad-dmz 
iptables -N good-bad 
iptables -N dmz-good 
iptables -N dmz-bad 
iptables -N bad-good 
iptables -N icmp-acc 
# accept related packets 
iptables -A FORWARD -m state --state INVALID -j DROP 
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
# internal client masqing 
iptables -t nat -A POSTROUTING -s $GOOD_ADDR -o $BAD_IFACE -j SNAT --to $MASQ_SERVER 
# mail server masqing 
iptables -t nat -A PREROUTING -p tcp -d $MAIL_SERVER --dport smtp -j DNAT --to $MAIL_SERVER_INTERNAL:25 
iptables -t nat -A PREROUTING -p tcp -d $MAIL_SERVER --dport http -j DNAT --to $MAIL_SERVER_INTERNAL:80 
iptables -t nat -A PREROUTING -p tcp -d $MAIL_SERVER --dport https -j DNAT --to $MAIL_SERVER_INTERNAL:443 
# to allow the above to work you need something like 
# iptables -A bad-good -p tcp --dport smtp -d $MAIL_SERVER_INTERNAL -j ACCEPT 
# set which addresses jump to which chains 
iptables -A FORWARD -s $GOOD_ADDR -o $DMZ_IFACE -j good-dmz 
iptables -A FORWARD -s $GOOD_ADDR -o $BAD_IFACE -j good-bad 
iptables -A FORWARD -s $DMZ_ADDR -i $DMZ_IFACE -o $BAD_IFACE -j dmz-bad 
iptables -A FORWARD -s $DMZ_ADDR -i $DMZ_IFACE -o $GOOD_IFACE -j dmz-good 
iptables -A FORWARD -o $DMZ_IFACE -j bad-dmz 
iptables -A FORWARD -o $GOOD_IFACE -j bad-good 
# drop anything that doesn't fit these 
iptables -A FORWARD -j LOG --log-prefix "chain-jump " 
iptables -A FORWARD -j DROP 
# icmp acceptance 
iptables -A icmp-acc -p icmp --icmp-type destination-unreachable -j ACCEPT 
iptables -A icmp-acc -p icmp --icmp-type source-quench -j ACCEPT 
iptables -A icmp-acc -p icmp --icmp-type time-exceeded -j ACCEPT 
iptables -A icmp-acc -p icmp --icmp-type echo-request -j ACCEPT 
iptables -A icmp-acc -p icmp --icmp-type echo-reply -j ACCEPT 
# iptables -A icmp-acc -j LOG --log-prefix "icmp-acc " 
iptables -A icmp-acc -j DROP 
# from internal to dmz 
iptables -A good-dmz -p tcp --dport smtp -j ACCEPT 
iptables -A good-dmz -p tcp --dport pop3 -j ACCEPT 
iptables -A good-dmz -p udp --dport domain -j ACCEPT 
iptables -A good-dmz -p tcp --dport domain -j ACCEPT 
iptables -A good-dmz -p tcp --dport www -j ACCEPT 
iptables -A good-dmz -p tcp --dport https -j ACCEPT 
iptables -A good-dmz -p tcp --dport ssh -j ACCEPT 
iptables -A good-dmz -p tcp --dport telnet -j ACCEPT 
iptables -A good-dmz -p tcp --dport auth -j ACCEPT 
iptables -A good-dmz -p tcp --dport ftp -j ACCEPT 
iptables -A good-dmz -p tcp --dport 1521 -j ACCEPT 
iptables -A good-dmz -p icmp -j icmp-acc 
iptables -A good-dmz -j LOG --log-prefix "good-dmz " 
iptables -A good-dmz -j DROP 
# from external to dmz 
iptables -A bad-dmz -p tcp --dport smtp -j ACCEPT 
iptables -A bad-dmz -p udp --dport domain -j ACCEPT 
iptables -A bad-dmz -p tcp --dport domain -j ACCEPT 
iptables -A bad-dmz -p udp --sport domain -j ACCEPT 
iptables -A bad-dmz -p tcp --sport domain -j ACCEPT 
iptables -A bad-dmz -p tcp --dport www -j ACCEPT 
iptables -A bad-dmz -p tcp --dport https -j ACCEPT 
iptables -A bad-dmz -p tcp --dport ssh -j ACCEPT 
iptables -A bad-dmz -p tcp -d $FTP_SERVER --dport ftp -j ACCEPT 
iptables -A bad-dmz -p icmp -j icmp-acc 
iptables -A bad-dmz -j LOG --log-prefix "bad-dmz " 
iptables -A bad-dmz -j DROP 
# from internal to external 
iptables -A good-bad -j ACCEPT 
# iptables -t nat -A POSTROUTING -o $BAD_IFACE -j SNAT --to $MASQ_SERVER 
#iptables -A good-bad -p tcp -j MASQ 
#iptables -A good-bad -p udp -j MASQ 
#iptables -A good-bad -p icmp -j MASQ 
#ipchains -A good-bad -p tcp --dport www -j MASQ 
#ipchains -A good-bad -p tcp --dport ssh -j MASQ 
#ipchains -A good-bad -p udp --dport 33434:33500 -j MASQ 
#ipchains -A good-bad -p tcp --dport ftp -j MASQ 
#ipchains -A good-bad -p icmp --icmp-type ping -j MASQ 
#ipchains -A good-bad -j REJECT -l 
# from dmz to internal 
# iptables -A dmz-good -p tcp ! --syn --sport smtp -j ACCEPT 
iptables -A dmz-good -p tcp --dport smtp -j ACCEPT 
iptables -A dmz-good -p tcp --sport smtp -j ACCEPT 
iptables -A dmz-good -p udp --sport domain -j ACCEPT 
iptables -A dmz-good -p tcp ! --syn --sport domain -j ACCEPT 
iptables -A dmz-good -p tcp ! --syn --sport www -j ACCEPT 
iptables -A dmz-good -p tcp ! --syn --sport ssh -j ACCEPT 
iptables -A dmz-good -p tcp -d 192.168.1.34 --dport smtp -j ACCEPT 
iptables -A dmz-good -p icmp -j icmp-acc 
iptables -A dmz-good -j LOG --log-prefix "dmz-good " 
iptables -A dmz-good -j DROP 
# from dmz to external 
iptables -A dmz-bad -p tcp --dport smtp -j ACCEPT 
iptables -A dmz-bad -p tcp --sport smtp -j ACCEPT 
iptables -A dmz-bad -p udp --dport domain -j ACCEPT 
iptables -A dmz-bad -p tcp --dport domain -j ACCEPT 
iptables -A dmz-bad -p tcp --dport www -j ACCEPT 
iptables -A dmz-bad -p tcp --dport https -j ACCEPT 
iptables -A dmz-bad -p tcp --dport ssh -j ACCEPT 
iptables -A dmz-bad -p tcp --dport ftp -j ACCEPT 
iptables -A dmz-bad -p tcp --dport whois -j ACCEPT 
iptables -A dmz-bad -p tcp --dport telnet -j ACCEPT 
iptables -A dmz-bad -p udp --dport ntp -j ACCEPT 
# ipchains -A good-bad -p udp --dport 33434:33500 -j MASQ 
iptables -A dmz-bad -p icmp -j icmp-acc 
iptables -A dmz-bad -j LOG --log-prefix "dmz-bad " 
iptables -A dmz-bad -j DROP 
# from external to internal 
iptables -A bad-good -p tcp --dport smtp -d $MAIL_SERVER_INTERNAL -j ACCEPT 
iptables -A bad-good -p tcp --dport http -d $MAIL_SERVER_INTERNAL -j ACCEPT 
iptables -A bad-good -p tcp --dport https -d $MAIL_SERVER_INTERNAL -j ACCEPT 
iptables -A bad-good -j LOG --log-prefix "bad-good " 
iptables -A bad-good -j REJECT 
# rules for this machine itself 
iptables -N bad-if 
iptables -N dmz-if 
iptables -N good-if 
# set up the jumps to each chain 
iptables -A INPUT -i $BAD_IFACE -j bad-if 
iptables -A INPUT -i $DMZ_IFACE -j dmz-if 
iptables -A INPUT -i $GOOD_IFACE -j good-if 
# external iface 
iptables -A bad-if -p icmp -j icmp-acc 
iptables -A bad-if -j ACCEPT 
#ipchains -A bad-if -i ! ppp0 -j DENY -l 
#ipchains -A bad-if -p TCP --dport 61000:65095 -j ACCEPT 
#ipchains -A bad-if -p UDP --dport 61000:65095 -j ACCEPT 
#ipchains -A bad-if -p ICMP --icmp-type pong -j ACCEPT 
#ipchains -A bad-if -j icmp-acc 
#ipchains -A bad-if -j DENY 
# dmz iface 
iptables -A bad-if -p icmp -j icmp-acc 
iptables -A dmz-if -j ACCEPT 
# internal iface 
iptables -A good-if -p tcp --dport ssh -j ACCEPT 
iptables -A good-if -p ICMP --icmp-type ping -j ACCEPT 
iptables -A good-if -p ICMP --icmp-type pong -j ACCEPT 
iptables -A good-if -j icmp-acc 
iptables -A good-if -j DROP 

# remove the complete blocks 
iptables -D INPUT 1 
iptables -D FORWARD 1 
iptables -D OUTPUT 1 

上一个：Linux下的网关设置
下一个：恢复IpTables的默认设置(Script)