Administrace komentářů

/etc/dhcpd.conf

ddns-update-style ad-hoc;
option broadcast-address 192.168.3.255;
use-host-decl-names on;
default-lease-time 1800;
max-lease-time 1800;

subnet 192.168.3.0 netmask 255.255.255.192 {
    range 192.168.3.2  192.168.3.62;
    option routers 192.168.3.1;
    option domain-name-servers 213.46.172.36, 213.46.172.37;
}

#! /bin/sh

EXTERNAL_INTERFACE="eth0"
INTERNAL_NETWORK="192.168.3.0/24"
ANYWHERE="0.0.0.0/0"                    # Match any IP address
UNPRIVPORTS="1024:65535"                # Unprivileged Port Range

EXTERNAL_IP=$(ifconfig $EXTERNAL_INTERFACE | grep 'inet addr:' | perl -pe 's/^\s*inet addr:(\S+).*$/\1/')
echo "external IP address is $EXTERNAL_IP"
echo 1 > /proc/sys/net/ipv4/ip_forward

#flush all rules
iptables -F
iptables -t nat -F

#Policy
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t nat -P POSTROUTING ACCEPT

#define masquerade
iptables -t nat -A POSTROUTING -s $INTERNAL_NETWORK -d ! $INTERNAL_NETWORK -j SNAT --to $EXTERNAL_IP


 #
 # FTP (20, 21) - Allowing outgoing client access to remote FTP servers
 #

     # Outgoing request

     iptables -A INPUT -i $EXTERNAL_INTERFACE -p TCP -m state --state ESTABLISHED,RELATED \
 --sport 21 --dport $UNPRIVPORTS -s $ANYWHERE -d $EXTERNAL_IP -j ACCEPT

     iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p TCP -m state --state NEW,ESTABLISHED \
 --sport $UNPRIVPORTS --dport 21 -s $EXTERNAL_IP -d $ANYWHERE -j ACCEPT

     # Normal Port mode FTP data channels

     iptables -A INPUT -i $EXTERNAL_INTERFACE -p TCP -m state --state NEW \
 --sport 20 --dport $UNPRIVPORTS -s $ANYWHERE -d $EXTERNAL_IP -j ACCEPT

     iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p TCP -m state --state ESTABLISHED,RELATED \
 --sport $UNPRIVPORTS --dport 20 -s $EXTERNAL_IP -d $ANYWHERE -j ACCEPT

     # Passive mode FTP data channels

     iptables -A INPUT -i $EXTERNAL_INTERFACE -p TCP -m state --state ESTABLISHED,RELATED \
 --sport $UNPRIVPORTS --dport $UNPRIVPORTS -s $ANYWHERE -d $EXTERNAL_IP -j ACCEPT

     iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p TCP -m state --state NEW,ESTABLISHED \
 --sport $UNPRIVPORTS --dport $UNPRIVPORTS -s $EXTERNAL_IP -d $ANYWHERE -j ACCEPT

        iptables -A FORWARD -p TCP -s $INTERNAL_NETWORK --sport $UNPRIVPORTS --dport 20:21 -j ACCEPT
        iptables -A FORWARD -p TCP -d $INTERNAL_NETWORK --sport 20:21 --dport $UNPRIVPORTS -j ACCEPT
        iptables -A FORWARD -p TCP -s $INTERNAL_NETWORK --sport $UNPRIVPORTS --dport $UNPRIVPORTS -j ACCEPT
        iptables -A FORWARD -p TCP -d $INTERNAL_NETWORK --sport $UNPRIVPORTS --dport $UNPRIVPORTS -j ACCEPT