Portál AbcLinuxu, 25. dubna 2024 08:36
iptables -A INPUT -i eth1 -p tcp --dport 23 -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 21 -j ACCEPT iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i eth1 -p icmp -j ACCEPT iptables -A INPUT -p icmp -i eth1 --icmp-type 0 -j ACCEPT iptables -A INPUT -p icmp -i eth1 --icmp-type 3 -j ACCEPT iptables -A INPUT -p icmp -i eth1 --icmp-type 8 -j ACCEPT iptables -A INPUT -p icmp -i eth1 --icmp-type 11 -j ACCEPT iptables -A INPUT -p all -i lo -j ACCEPT iptables -P INPUT DROP iptables -A OUTPUT -p icmp -o eth1 --icmp-type 0 -j ACCEPT iptables -A OUTPUT -p icmp -o eth1 --icmp-type 8 -j ACCEPT iptables -A OUTPUT -o eth1 -p tcp --sport 23 -j ACCEPT iptables -A OUTPUT -o eth1 -p tcp --sport 21 -j ACCEPT iptables -P OUTPUT DROP iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE iptables -P FORWARD ACCEPT
... iptables -A INPUT -p icmp -i eth1 -j ACCEPT iptables -A INPUT -p icmp -i eth1 --icmp-type 0 -j ACCEPT iptables -A INPUT -p icmp -i eth1 --icmp-type 3 -j ACCEPT iptables -A INPUT -p icmp -i eth1 --icmp-type 8 -j ACCEPT iptables -A INPUT -p icmp -i eth1 --icmp-type 11 -j ACCEPT ...
iptables -A FORWARD -i eth1 -j ACCEPT iptables -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -P FORWARD DROP
#!/bin/sh # IP adresa a vnejsi rozhrani INET_IP="192.168.65.4" INET_IFACE="wlan0" # IP, broadcast adresa a rozhrani vnitrni site LAN1_IP="192.168.65.180" LAN1_BCAST="192.168.65.191" LAN1_IFACE="eth0" # Lokalni loopback rozhrani LO_IFACE="lo" LO_IP="127.0.0.1/8" # Cesta k programu iptables IPTABLES="iptables" # Nastaveni implicitni politiky - Input a Forward mazat, Output prijmout $IPTABLES -P INPUT DROP $IPTABLES -P FORWARD DROP $IPTABLES -P OUTPUT ACCEPT #$IPTABLES -N SAMBANET # Povoleni Mac, ktere budou moci do site bez omezeni... (bezpecne adresy) $IPTABLES -N MACADR $IPTABLES -A MACADR -m mac --mac-source 00:C0:9F:0D:52:CC -s 192.168.65.124 -j ACCEPT # NOTEBOOK HP - XE4400 (ethernet) #$IPTABLES -A MACADR -m mac --mac-source 00:4F:62:00:53:13 -s 192.168.65.3 -j ACCEPT # router doma #$IPTABLES -A MACADR -m mac --mac-source 00:4F:62:00:53:13 -s 192.168.65.170/28 -j ACCEPT # sit doma $IPTABLES -A MACADR -s 192.168.65.160/28 -j ACCEPT # sit doma $IPTABLES -A MACADR -s 192.168.65.210 -j ACCEPT # Retezec FORWARD $IPTABLES -A FORWARD -i $INET_IFACE -p ICMP -j ACCEPT $IPTABLES -A FORWARD -i $INET_IFACE -j MACADR $IPTABLES -A FORWARD -i $INET_IFACE -p TCP --dport 137:139 -j SAMBANET #Samba $IPTABLES -A FORWARD -i $INET_IFACE -p TCP --dport 445 -j SAMBANET #Samba $IPTABLES -A FORWARD -i $INET_IFACE -p UDP --dport 137:139 -j SAMBANET #Samba $IPTABLES -A FORWARD -i $INET_IFACE -p UDP --dport 445 -j SAMBANET #Samba $IPTABLES -A FORWARD -i $INET_IFACE -p TCP --dport 3389 -j SAMBANET #Vzd. pl. $IPTABLES -A FORWARD -i $LAN1_IFACE -j ACCEPT $IPTABLES -A FORWARD -i $INET_IFACE -o $LAN1_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A FORWARD -i $INET_IFACE -s 192.168.0.0/16 -j REJECT # Retezec INPUT $IPTABLES -A INPUT -d $INET_IP -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 23 -j ACCEPT #TELNET $IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 80 -j ACCEPT #WWW server $IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 113 -j REJECT --reject-with tcp-reset #AUTH server $IPTABLES -A INPUT -i $INET_IFACE -p ICMP -j ACCEPT $IPTABLES -A INPUT -i $INET_IFACE -j MACADR $IPTABLES -A INPUT -i $INET_IFACE -s $INET_IP -j ACCEPT $IPTABLES -A INPUT -i $LO_IFACE -j ACCEPT $IPTABLES -A INPUT -i $LAN1_IFACE -j ACCEPT $IPTABLES -A INPUT -i $LAN1_IFACE -d $LAN1_BCAST -j ACCEPT $IPTABLES -A INPUT -d 192.168.100.252 -j ACCEPT $IPTABLES -A INPUT -i $INET_IFACE -s 192.168.0.0/16 -j REJECT
myslíte použít něco jako: iptables -P OUTPUT ACCEPT
Filtrovanie OUTPUT môže mať zmysel. Predstav si napríklad, že máš za FW sieť a na tú sieť sa dostane nejaká neplecha (nebudeme teraz riešiť, ako sa tam dostala) v takom prípade môžeš potrebovať filtrovať output, aby sa neplecha nemohla robiť flood, alebo sa nebodaj pripájať k svojmu tvorcovi. Spravidla nie je dôvod, aby z LAN odchádzalo niečo iné ako http a smtp.
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -s 192.168.65.160/28 -j SNAT --t o-source $INET_IP
# Retezec INPUT $IPTABLES -A INPUT -i $INET_IFACE -s $INET_IP -j ACCEPTProč povolujete tuto adresu, pokud je to lokální, tak to pokryje přece:
# Retezec INPUT $IPTABLES -A INPUT -d $INET_IP -m state --state ESTABLISHED,RELATED -j ACCEPT
Tiskni Sdílej:
ISSN 1214-1267, (c) 1999-2007 Stickfish s.r.o.