Ang iptables problem
jeg har patchet min kerne med iptables version 1.27a og forsøger og kører følgende script :#!/bin/bash
## Disable routing inden regler påføres
echo 0 > /proc/sys/net/ipv4/ip_forward
## Regler flushes og policies sættes
/sbin/iptables -t nat -F POSTROUTING
/sbin/iptables -t nat -F PREROUTING
/sbin/iptables -F
/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -N INSPECT 2> /dev/null
/sbin/iptables -N INSDROP 2> /dev/null
/sbin/iptables -N INSWARNDROP 2> /dev/null
## Logging af nye pakker skal startes
/sbin/iptables -A FORWARD -m state --state NEW -j LOG --log-prefix IPTABLE_NEW --log-level 4
## Statistik startes.
/sbin/iptables -A FORWARD
##
## Folk med forkerte iper som ikke ville skifte
## Bannes også på mac
/sbin/iptables -A FORWARD -p all -s 172.16.1.105 -j DROP
/sbin/iptables -A FORWARD -p all -s 172.16.1.25 -j DROP
/sbin/iptables -A FORWARD -p all -s 172.16.1.78 -j DROP
/sbin/iptables -A FORWARD -p all -s 172.16.1.146 -j DROP
/sbin/iptables -A FORWARD -p all -s 172.16.1.147 -j DROP
/sbin/iptables -A FORWARD -p all -s 172.16.1.79 -j DROP
/sbin/iptables -A FORWARD -p all -m mac --mac-source 00:08:02:49:C3:93 -j DROP
## På grund af problemer med forkert opsatte maskiner der router LAN trafik igennem
## firewall'en pga. forkert subnetmasker er denne linie tilføjet 26-08-2001 af AZK
/sbin/iptables -A FORWARD -s 172.16.0.0/16 -d 172.0.0.0/8 -j DROP
/sbin/iptables -A FORWARD -s 192.168.1.0/24 -j DROP
## Source NAT alle LAN connections til vores externe IP, hvis
## trafikken fra disse ikke er til en af vores LAN IP net.
/sbin/iptables -t nat -A POSTROUTING -s 172.16.1.0/24 -d ! 172.16.0.0/16 -j SNAT --to ´externip'
/sbin/iptables -t nat -A POSTROUTING -s 172.16.12.0/24 -d ! 172.16.0.0/16 -j SNAT --to øexternipø
/sbin/iptables -t nat -A POSTROUTING -s 172.16.13.0/24 -d ! 172.16.0.0/16 -j SNAT --to extern ip
/sbin/iptables -t nat -A POSTROUTING -s 172.16.14.0/24 -d ! 172.16.0.0/16 -j SNAT --to extern ip
/sbin/iptables -t nat -A POSTROUTING -s 172.16.22.0/24 -d ! 172.16.0.0/16 -j SNAT --to extern ip
/sbin/iptables -t nat -A POSTROUTING -s 172.16.23.0/24 -d ! 172.16.0.0/16 -j SNAT --to extern ip
/sbin/iptables -t nat -A POSTROUTING -s 172.16.24.0/24 -d ! 172.16.0.0/16 -j SNAT --to extern ip
/sbin/iptables -t nat -A POSTROUTING -s 172.16.32.0/24 -d ! 172.16.0.0/16 -j SNAT --to 195.41.207.2
/sbin/iptables -t nat -A POSTROUTING -s 172.16.33.0/24 -d ! 172.16.0.0/16 -j SNAT --to 195.41.207.2
/sbin/iptables -t nat -A POSTROUTING -s 172.16.34.0/24 -d ! 172.16.0.0/16 -j SNAT --to 195.41.207.2
# New connections are set at 0
/sbin/iptables -A FORWARD -m state --state NEW -j CONNMARK --set-mark 0
# Already been through 6 packets in the connection... just pass.
/sbin/iptables -A FORWARD -m connmark --mark 6 -j ACCEPT
# Drop anything set to be dropped.
/sbin/iptables -A FORWARD -m connmark --mark 15 -j DROP
# Log and Drop anything set to be logged and dropped.
/sbin/iptables -A FORWARD -m connmark --mark 13 -j INSWARNDROP
# Static filters.
/sbin/iptables -A FORWARD -p UDP --dport 41170 -j INSDROP
/sbin/iptables -A FORWARD -p TCP --dport 4661,4662 -j INSDROP
/sbin/iptables -A FORWARD -p UDP --dport 4665 -j DROP
/sbin/iptables -A FORWARD -p TCP --dport 1080 -j INSDROP
/sbin/iptables -A FORWARD -p UDP --dport 1080 -j INSDROP
/sbin/iptables -A FORWARD -s 172.16.0.0/16 -d 212.112.132.151 -j DROP # Jubii Stream
/sbin/iptables -A FORWARD -s 172.16.0.0/16 -d news.tele.dk -j DROP # TeleDK's news server
/sbin/iptables -A FORWARD -s 172.16.0.0/16 -d 140.95.15.143 -j DROP # music city.com
/sbin/iptables -A FORWARD -d 212.249.10.247 -p all -j DROP # share reactor
/sbin/iptables -A FORWARD -d 63.217.29.252 -p all -j DROP # mp3sound.com
# Begraenser NEWS til en TCP forbindelse
/sbin/iptables -A FORWARD -p tcp --syn --dport nntp -m iplimit --iplimit-above 1 -j DROP
/sbin/iptables -A FORWARD -p tcp --dport 21 -m iplimit --iplimit-above 1 -j DROP
/sbin/iptables -A FORWARD -p tcp --dport 20 -m iplimit --iplimit-above 1 -j DROP
# Inspect these types of traffic.
/sbin/iptables -A FORWARD -p ICMP -j INSPECT
/sbin/iptables -A FORWARD -p UDP -j INSPECT
/sbin/iptables -A FORWARD -p TCP -m connmark --mark 5 -j INSPECT
/sbin/iptables -A FORWARD -p TCP -m connmark --mark 4 -j INSPECT
/sbin/iptables -A FORWARD -p TCP -m connmark --mark 3 -j INSPECT
# Incrememnt the packet counters.
/sbin/iptables -A FORWARD -m connmark --mark 5 -j CONNMARK --set-mark 6
/sbin/iptables -A FORWARD -m connmark --mark 4 -j CONNMARK --set-mark 5
/sbin/iptables -A FORWARD -m connmark --mark 3 -j CONNMARK --set-mark 4
/sbin/iptables -A FORWARD -m connmark --mark 2 -j CONNMARK --set-mark 3
/sbin/iptables -A FORWARD -m connmark --mark 1 -j CONNMARK --set-mark 2
/sbin/iptables -A FORWARD -m connmark --mark 0 -j CONNMARK --set-mark 1
/sbin/iptables -A FORWARD -j ACCEPT
#Build INSPECT
#Gnutella
/sbin/iptables -A INSPECT -p TCP -m string --string "GNUTELLA CONNECT/0.6" -j INSDROP
#/sbin/iptables -A INSPECT -p TCP -m string --string "GNUTELLA/0.6" -j INSDROP
#FastTrack (KaZaA, Grokster)
/sbin/iptables -A INSPECT -p TCP -m string --string "X-Kazaa-Username:" -j INSDROP
/sbin/iptables -A INSPECT -p TCP -m string --string "X-Kazaa-Network:" -j INSDROP
/sbin/iptables -A INSPECT -p TCP -m string --string "X-Kazaa-SupernodeIP:" -j INSDROP
#DirectConnect
/sbin/iptables -A INSPECT -p TCP -m string --string "\$ValidateNick " -j INSDROP
/sbin/iptables -A INSPECT -p TCP -m string --string "\$HubName " -j INSDROP
#IMesh
/sbin/iptables -A INSPECT -p UDP -m string --string "fileshare" -j INSDROP
#Swaptor/FileNavigator
/sbin/iptables -A INSPECT -p TCP -m string --string "2000 Server ready" -j INSDROP
#Build INSDROP
/sbin/iptables -A INSDROP -j CONNMARK --set-mark 15
/sbin/iptables -A INSDROP -j DROP
#Build INSWARNDROP
/sbin/iptables -A INSWARNDROP -j CONNMARK --set-mark 13
/sbin/iptables -A INSWARNDROP -j LOG --log-level 0 --log-ip-options --log-prefix "INS Warning"
/sbin/iptables -A INSWARNDROP -j DROP
#
# Forwarding startes.
echo 1 > /proc/sys/net/ipv4/ip_forward
denne fejl ender jeg med :
og jeg har valgt de brugte moduler med i kernen
: bad interpreter: No such file or directory
er der nogen som lige kan komme med en forklaring
og jeg kan afsætte flere points hvis det er :)