Hjælp til iptables

når du ikke selv er indstillet på at lære hvordan det virker så kan jeg kun anbefale denne generator:

http://easyfwgen.morizot.net/gen/

Noe enklere: http://arne.dyndns.dk/iptables/

Omtrnt slik (har ikke tid til å detaljsjekke syntaksen akkurat nå.)


#!/bin/sh

# iptables script generator: Ny Beta-2004
# Kommer uten noen form for garanti!
# e-mail: webmaster@im-learning.com

# Enable forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# WAN_NIC='eth0'
# LAN_NIC='eth1'
# LAN_CARD_IP='10.0.0.1/24'
# FORWARD_IP='10.0.0.2'

# Load some kernel modules
modprobe ip_nat_ftp
modprobe ip_conntrack_ftp

# Flush
iptables -t nat -F
iptables -F
iptables -X
iptables -Z

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Enable Masquerade and statefull inspection all forwarding
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Open ports on router pc for server/services
iptables -A INPUT -i eth1 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT

# STATE RELATED for local processes on firewall machine
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Laget det litt enklere (uten noen server funksjoner):
http://www.eksperten.dk/spm/630098

Ellers med serverfunksjoner:

Enkel gateway firewall med server funksjoner på gatewaymaskin-

#!/bin/sh

# Kommer uten noen form for garanti!

# Enable forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# Load some kernel modules
modprobe ip_nat_ftp
modprobe ip_conntrack_ftp

# Flush
iptables -t nat -F
iptables -F
iptables -X
iptables -Z

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Enable Masquerade and statefull inspection all forwarding
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -m state –state ESTABLISHED,RELATED -j ACCEPT

# Open ports on router pc for server/services
iptables -A INPUT -i eth1 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth0 -p tcp –dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp –dport 20 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp –dport 21 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp –dport 110 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp –dport 25 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp –dport 22 -j ACCEPT

# STATE RELATED for local processes on firewall machine
iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT

hvad er eth0 eller eth1 lan

eth0 = Wan Eth1=Lan

tusind tak for svaret :)