Administrace komentářů

#konfigurace stavovy firewall iptables


#vycisteni vsech retezcu
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD

#vsechno zakazeme
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP


#####################INPUT###############################

#povolime webovy server na eth0
iptables -A INPUT -p TCP -i eth0 --dport 80 -j ACCEPT

#povolime prichozi DNS na eth0
iptables -A INPUT -p TCP -i eth0 --dport 53 -j ACCEPT
iptables -A INPUT -p UDP -i eth0 --dport 53 -j ACCEPT

#povolit servisni pakety ICMP (echo, traceroute)
iptables -A INPUT -p ICMP -i eth0 --icmp-type 0 -j ACCEPT
iptables -A INPUT -p ICMP -i eth0 --icmp-type 3 -j ACCEPT
iptables -A INPUT -p ICMP -i eth0 --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP -i eth0 --icmp-type 11 -j ACCEPT

#povolime vsechny prichozi pakety z eth1 (LAN)
iptables -A INPUT -p ALL -i eth1 -j ACCEPT
iptables -A INPUT -p ALL -i lo -j ACCEPT

#umoznime odchozim pripojenim z tohoto pocitace odpovidat
iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p icmp
iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p tcp
iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p udp

#logujeme vsechny ostatni prichozi pakety
iptables -A INPUT -j LOG

###########################OUTPUT###########

#povolime vystup z IP eth0 //je to bezpecne?
iptables -A OUTPUT -p ALL -s 127.0.0.1 ACCEPT //musi zde byt?
iptables -A OUTPUT -p ALL -s 1.2.3.4 ACCEPT


#################Routovani##################//nevim zda je to spravne
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE