Generalitati::.
Generalitati::. - 2010 - .::Downloads
Lista Forumurilor Pe Tematici
Generalitati::. | Inregistrare | Login

POZE GENERALITATI::.

Nu sunteti logat.
Nou pe simpatie:
Angelina20 Profile
Femeie
19 ani
Cluj
cauta Barbat
24 - 55 ani
Generalitati::. / Linux / script firewall Moderat de Psycho, phantom2005_2006
Autor
Mesaj Pagini: 1
ronaldinho10
Moderator

Inregistrat: acum 17 ani
Postari: 10028
#!/bin/bash

# script de routare

# sterge tot
iptables -F
iptables -F -t nat
iptables -F -t mangle
echo "0" > /proc/sys/net/ipv4/ip_forward

# activeaza tot

modprobe ip_nat_irc
modprobe ip_nat_ftp

# activeaza ip forward intre placile de retea
echo "1" > /proc/sys/net/ipv4/ip_forward

# squid redirect
# iptables -t nat -A PREROUTING -i eth3 -p tcp --dport 80 -j REDIRECT --to 172.21.0.1:8080

#dnat catre ip real
iptables -t nat -A PREROUTING -i eth0 -d xx.xx.xx.xx -p tcp  -j DNAT --to 192.168.2.30


# mapeaza ip-uri de retea locala catre ip-ul routerului

iptables -A POSTROUTING -t nat -o eth0 -s 192.168.2.1/24 -j SNAT --to-source xx.xx.xx.xx


# crestem putin TTL-ul
iptables -t mangle -A POSTROUTING -j TTL --ttl-inc 1

# accepta IP-ul primar, de pe placa eth0

iptables -A POSTROUTING -t nat -s xx.xx.xx.xx -j ACCEPT

# accepta IP-ul secundar, de pe placa eth2
iptables -A POSTROUTING -t nat -s 192.168.2.1 -j ACCEPT

# accepta IP-ul secundar, de pe placa eth3
iptables -A POSTROUTING -t nat -s 192.168.3.1 -j ACCEPT

# Accepta loopback-ul
iptables -A POSTROUTING -t nat -s 127.0.0.1 -j ACCEPT

# accepta serverele de NS
iptables -A POSTROUTING -t nat -s xx.xx.xx.xx -j ACCEPT
iptables -A POSTROUTING -t nat -s xx.xx.xx.xx -j ACCEPT
iptables -A POSTROUTING -t nat -s xx.xx.xx.xx -j ACCEPT
iptables -A POSTROUTING -t nat -s xx.xx.xx.xx -j ACCEPT
iptables -A POSTROUTING -t nat -s xx.xx.xx.xx -j ACCEPT
# Accepta IP-urile din reteaua locala
iptables -A POSTROUTING -t nat -s 192.168.2.1/24 -j ACCEPT
iptables -A POSTROUTING -t nat -s 192.168.3.1/24 -j ACCEPT

# Blocheaza orice altceva
iptables -A POSTROUTING -t nat -o eth0 -j DROP

# reguli firewall

# inchidem mysql pentru exterior
iptables -A INPUT -i eth0 -p udp --dport 3306 -j REJECT --reject-with icmp-admin-prohibited
iptables -A INPUT -i eth0 -p tcp --dport 3306 -j REJECT --reject-with icmp-admin-prohibited

# reguli ssh
iptables -A INPUT -p tcp -s xx.xx.xx.xx/32 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.2.1/24 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.3.1/24 --dport 22 -j ACCEPT



#vsftpd
iptables -A INPUT -p tcp  --dport 21 -j ACCEPT
iptables -A INPUT -p tcp  --dport 20 -j ACCEPT



# accepta ce e ok, restu drop
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state INVALID -j DROP

# reguli de forward pe mac address

# forward per mac
iptables -A FORWARD -s 10.24.0.11 -m mac --mac-source 00:0A:E6:59:A6:B7 -j ACCEPT
iptables -A FORWARD -d 10.24.0.11 -j ACCEPT

# blocheaza restul forward-ului
iptables -P FORWARD DROP


_______________________________________
Adevărata măsură a vieţii unui om nu se poate obţine decāt prin lipsa de măsură, dorind fără măsură, īndrăznind fără măsură, iubind fără măsură. ( Octavian Paler )

pus acum 17 ani
   
Pagini: 1  

Mergi la