iptables设置一例

转自互联网

只需要一个公网地址设在外接口上，内部用私网地址组网即可，在内部服务器提供Internet服务。

#!/bin/sh

#-------------------------------------------- # # 外接口eth0，开放 vpn ssh # 内接口eth1，绑定 dhcp dns squid # 向内部服务器转发 ftp smtp www pop3 # 支持透明代理 # # 胖头鱼：pangty@ta139.com # #--------------------------------------------

EXT_IF="eth0" INT_IF="eth1" EXT_IP="" #公网IP INT_IP="" #内接口IP SERVER_IP="" #内部服务器IP

# pptpd_vpn_service ssh TRUSTED_LOCAL_TCP_PORT="1723 22" TRUSTED_LOCAL_UDP_PORT="22"

# ftp-data ftp smtp http pop3 FWD_TCP_PORT="20 21 25 80 110" FWD_UDP_PORT="20 21 25 80 110"

# load any special modules modprobe ip_nat_ftp modprobe ip_conntrack_ftp modprobe ip_nat_irc modprobe ip_conntrack_irc

# turn on ip forwarding echo "1" > /proc/sys/net/ipv4/ip_forward

# setting up ip spoofing protection for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f done

# delete any existing chains iptables -F -t filter iptables -X -t filter iptables -Z -t filter iptables -F -t nat iptables -X -t nat iptables -Z -t nat

# setting up default policies iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT iptables -t nat -P PREROUTING ACCEPT iptables -t nat -P POSTROUTING ACCEPT iptables -t nat -P OUTPUT ACCEPT

#---------------------- filter ---------------------

# allow ping from internet iptables -A INPUT -i $EXT_IF -p icmp -j ACCEPT

# enable local traffic #------------------------------------------------------------------------ # iptables -A INPUT ! -i $EXT_IF -m state --state NEW -j ACCEPT # iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # # iptables -A FORWARD ! -i $EXT_IF -m state --state NEW -j ACCEPT # iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT #------------------------------------------------------------------------

iptables -N allowed iptables -A allowed ! -i $EXT_IF -m state --state NEW -j ACCEPT iptables -A allowed -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -j allowed iptables -A FORWARD -j allowed

for PORT in $TRUSTED_LOCAL_TCP_PORT; do iptables -A INPUT -i $EXT_IF -p tcp --dport $PORT -m state --state NEW -j ACCEPT

done

for PORT in $TRUSTED_LOCAL_UDP_PORT; do iptables -A INPUT -i $EXT_IF -p udp --dport $PORT -m state --state NEW -j ACCEPT

done

#---------------------- nat ---------------------

# port forwarding for PORT in $FWD_TCP_PORT; do iptables -A FORWARD -i $EXT_IF -o $INT_IF -d $SERVER_IP -p tcp --dport $PORT -m state --state NEW -j ACCEPT iptables -t nat -A PREROUTING -d $EXT_IP -p tcp --dport $PORT -j DNAT --to-destination $SERVER_IP iptables -t nat -A POSTROUTING -d $SERVER_IP -p tcp --dport $PORT -j SNAT --to-source $INT_IP done

for PORT in $FWD_UDP_PORT; do iptables -A FORWARD -i $EXT_IF -o $INT_IF -d $SERVER_IP -p udp --dport $PORT -m state --state NEW -j ACCEPT iptables -t nat -A PREROUTING -d $EXT_IP -p udp --dport $PORT -j DNAT --to-destination $SERVER_IP iptables -t nat -A POSTROUTING -d $SERVER_IP -p udp --dport $PORT -j SNAT --to-source $INT_IP done

# Transparent Proxy iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport 80 -j REDIRECT --to- port 3128

# SNAT or MASQUERADE #------------------------------------------------------------------------ # iptables -t nat -A POSTROUTING -o $EXT_IF -j SNAT --to-source $EXT_IP #------------------------------------------------------------------------ iptables -t nat -A POSTROUTING -o $EXT_IF -j MASQUERADE