Administrace komentářů

#predavani paketu povoleno

echo 1 > /proc/sys/net/ipv4/ip_forward

#ochrana pred spoofingem

echo 1 > /proc/sys/net/ipv4/conf/eth1/rp_filter

#zavedeni NAT modulu

modprobe iptable_nat

#zavedeni podpory FTP

modprobe ip_nat_ftp

#vse zakazano

iptables -P INPUT DROP

iptables -P OUTPUT DROP

iptables -P FORWARD DROP

#porty na serveru dostupne z internetu pro tcp segmenty

iptables -N tcp_segmenty

iptables -A INPUT -p TCP -i eth1 -j tcp_segmenty

#iptables -A tcp_segmenty -p TCP --dport 20 -j ACCEPT

iptables -A tcp_segmenty -p TCP --dport 21 -j ACCEPT

iptables -A tcp_segmenty -p TCP --dport 22 -j ACCEPT

iptables -A tcp_segmenty -p TCP --dport 25 -j ACCEPT

iptables -A tcp_segmenty -p TCP --dport 53 -j ACCEPT

iptables -A tcp_segmenty -p TCP --dport 80 -j ACCEPT

iptables -A tcp_segmenty -p TCP --dport 110 -j ACCEPT

#porty na serveru dostupne z internetu pro udp pakety

iptables -N udp_pakety

iptables -A INPUT -p UDP -i eth1 -j udp_pakety

iptables -A udp_pakety -p UDP --dport 53 -j ACCEPT

#vpustene ICMP pakety (povolit 0 a snad 3,8,11)

iptables -A INPUT -p ICMP -i eth1 --icmp-type 0 -j ACCEPT

#iptables -A INPUT -p ICMP -i eth1 --icmp-type 3 -j ACCEPT

#iptables -A INPUT -p ICMP -i eth1 --icmp-type 8 -j ACCEPT

#iptables -A INPUT -p ICMP -i eth1 --icmp-type 11 -j ACCEPT

#plny vstup z LAN

iptables -A INPUT -p ALL -i eth0 -j ACCEPT

iptables -A INPUT -p ALL -i lo -j ACCEPT

#iptables -A INPUT -j LOG

#vystupni pravidla

iptables -A OUTPUT -s 127.0.0.1 -j ACCEPT

iptables -A OUTPUT -s 192.168.1.1 -j ACCEPT

iptables -A OUTPUT -s 212.x.x.x -j ACCEPT

#iptables -A OUTPUT -j LOG

#pravidla postoupeni FORWARD

iptables -A FORWARD -i eth0 -j ACCEPT

iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

#iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

#SNAT pro moji sit

iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to 212.x.x.x

#presmerovani www na SQUID

#iptables -t nat -A PREROUTING -p tcp -i eth1 -d 212.x.x.x --dport 80 -j REDIRECT --to-port 3128

tak to je firewall,

doufam ze to bude citelne