FreeSource - AltLinux/iptables/sample4router

2006-12-05 00:14:46

�� /Alt Linux / iptables / sample 4 router �� 2006-12-05 00:14:46 � 2006-12-05 00:17:42

��:

�� altlinux.org. �� freesource.info ��.

gateway iptables example

�� /etc/sysconfig/iptables �� Ethernet-��, �� , ��, � DSL (_REAL_IP), �� — � LAN (10.0.0.0/24). �� , �� -�� .
cp -a /etc/sysconfig/iptables /etc/sysconfig/iptables.bak
# �� /etc/sysconfig/iptables
# �� wget -O /etc/sysconfig/iptables http://fly.osdn.org.ua/~mike/docs/iptables-sample4router
subst 's,_REAL_IP,<��_��_IP_��>,g' /etc/sysconfig/iptables
$EDITOR /etc/sysconfig/iptables

��:

�� /etc/sysconfig/iptables �� Ethernet-��, �� , ��, � DSL (_REAL_IP), �� — � LAN (10.0.0.0/24). �� , �� -�� .
cp -a /etc/sysconfig/iptables /etc/sysconfig/iptables.bak
# �� /etc/sysconfig/iptables
# �� wget -O /etc/sysconfig/iptables http://linux.kiev.ua/~mike/do
2000
cs/iptables-sample4router
subst 's,_REAL_IP,<��_��_IP_��>,g' /etc/sysconfig/iptables
$EDITOR /etc/sysconfig/iptables

2006-12-04 22:49:03

�� /Alt Linux / iptables / sample 4 router �� 2006-12-04 22:49:03 � 2006-12-05 00:14:46

��:

�� /etc/sysconfig/iptables �� Ethernet-��, �� , ��, � DSL (_REAL_IP), �� — � LAN (10.0.0.0/24). �� , �� -�� .

��:

cp -a /etc/sysconfig/iptables /etc/sysconfig/iptables.bak
# �� /etc/sysconfig/iptables
# �� wget -O /etc/sysconfig/iptables http://linux.kiev.ua/~mike/do
2000
cs/iptables-sample4router
# �� , ��
subst 's,_REAL_IP,<��_��_IP_��>,g' /etc/sysconfig/iptables
$EDITOR /etc/sysconfig/iptables

# setup:
# world<->eth0[_REAL_IP]:::eth1[10.0.0.254]<->LAN
# _REAL_IP:_EXT_PORT is port-forwarded to _INT_HOST:_INT_PORT
# everything from inside gets masqueraded,
# with a few host-specific exceptions;
# everything from outside gets dropped unless
# targets explicitly allowed port
# or is a response to our request
# eth0-in/eth0-out count [paid] external traffic

# Generated by iptables-save v1.2.6a on Thu Nov 21 21:15:39 2002
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -d _REAL_IP -i eth0 -p tcp -m tcp --dport _EXT_PORT -j DNAT --to-destination _INT_HOST:_INT_PORT
-A POSTROUTING -s 10.0.0.0/24 -d ! 10.0.0.0/24 -j SNAT --to-source _REAL_IP
COMMIT
# Completed on Thu Nov 21 21:15:39 2002
# Generated by iptables-save v1.2.6a on Thu Nov 21 21:15:39 2002
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed on Thu Nov 21 21:15:39 2002
# Generated by iptables-save v1.2.6a on Thu Nov 21 21:15:39 2002
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:eth0-in - [0:0]
:eth0-out - [0:0]
:tcprules - [0:0]
-A INPUT -i eth0 -j eth0-in
-A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
-A INPUT -s 10.0.0.0/24 -d 10.0.0.254 -i eth1 -j ACCEPT
-A INPUT -s 10.0.0.0/24 -d _REAL_IP -i eth1 -j ACCEPT
-A INPUT -d _REAL_IP -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -d _REAL_IP -i eth0 -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -d _REAL_IP -i eth0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -d _REAL_IP -i eth0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -d _REAL_IP -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -d _REAL_IP -i eth0 -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -d _REAL_IP -i eth0 -p tcp -m tcp --dport 113 -j REJECT --reject-with tcp-reset
-A INPUT -j tcprules
# block :25 to world (only through 10.0.0.1:25)
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 25 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j tcprules
-A OUTPUT -o eth0 -j eth0-out
-A eth0-in -j RETURN
-A eth0-out -j RETURN
-A tcprules -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A tcprules -i ! eth0 -m state --state NEW -j ACCEPT
-A tcprules -i eth0 -m state --state INVALID,NEW -j DROP
-A tcprules -i eth0 -j REJECT --reject-with icmp-host-unreachable
COMMIT
# Completed on Thu Nov 21 21:15:39 2002

��:

licata, riccardo: licata, riccardo, licata, riccardo, licata, riccardo, licata, riccardo; hell: hell, hell, hell, hell; ackermann, max: ackermann, max, ackermann, max, ackermann, max, ackermann, max; qixia si: qixia si, qixia si, qixia si, qixia si; alex and emma: alex and emma, alex and emma, alex and emma, alex and emma; capelle, jan van de-: capelle, jan van de-, capelle, jan van de-, capelle, jan van de-, capelle, jan van de-; bikom: bikom, bikom, bikom, bikom; paray-le-monial: paray-le-monial, paray-le-monial, paray-le-monial, paray-le-monial; mitsuyoshi tosa: mitsuyoshi tosa, mitsuyoshi tosa, mitsuyoshi tosa, mitsuyoshi tosa; four brothers – quattro fratelli: four brothers – quattro fratelli, four brothers – quattro fratelli, four brothers – quattro fratelli, four brothers – quattro fratelli; baumhauer, joseph: baumhauer, joseph, baumhauer, joseph, baumhauer, joseph, baumhauer, joseph; bentley, john francis: bentley, john francis, bentley, john francis, bentley, john francis, bentley, john francis; konarak: konarak, konarak, konarak, konarak; beauvais: beauvais, beauvais, beauvais, beauvais; il viaggio di felicia: il viaggio di felicia, il viaggio di felicia, il viaggio di felicia, il viaggio di felicia; fanum voltumnae: fanum voltumnae, fanum voltumnae, fanum voltumnae, fanum voltumnae; halle: halle, halle, halle, halle; divisionismo: divisionismo, divisionismo, divisionismo, divisionismo; vivin, louis: vivin, louis, vivin, louis, vivin, louis, vivin, louis; thule springs: thule springs, thule springs, thule springs, thule springs; abercrombie, sir patrick: abercrombie, sir patrick, abercrombie, sir patrick, abercrombie, sir patrick, abercrombie, sir patrick; tessenow heinrich: tessenow heinrich, tessenow heinrich, tessenow heinrich, tessenow heinrich; ebrach: ebrach, ebrach, ebrach, ebrach; piattabanda: piattabanda, piattabanda, piattabanda, piattabanda; piles, roger de-: piles, roger de-, piles, roger de-, piles, roger de-, piles, roger de-; charlotte gray: charlotte gray, charlotte gray, charlotte gray, charlotte gray; mills, robert: mills, robert, mills, robert, mills, robert, mills, robert; belfagor – il fantasma del louvre: belfagor – il fantasma del louvre, belfagor – il fantasma del louvre, belfagor – il fantasma del louvre, belfagor – il fantasma del louvre; cenerentola a parigi: cenerentola a parigi, cenerentola a parigi, cenerentola a parigi, cenerentola a parigi; la spirale della vendetta: la spirale della vendetta, la spirale della vendetta, la spirale della vendetta, la spirale della vendetta; praetexta: praetexta, praetexta, praetexta, praetexta; fashion: fashion, fashion, fashion, fashion; hilton, roger: hilton, roger, hilton, roger, hilton, roger, hilton, roger; lavedan, pierre: lavedan, pierre, lavedan, pierre, lavedan, pierre, lavedan, pierre; pontecagnano faiano: pontecagnano faiano, pontecagnano faiano, pontecagnano faiano, pontecagnano faiano; susanna: susanna, susanna, susanna, susanna; bambole russe: bambole russe, bambole russe, bambole russe, bambole russe; commedia sexy: commedia sexy, commedia sexy, commedia sexy, commedia sexy; buke-zukuri: buke-zukuri, buke-zukuri, buke-zukuri, buke-zukuri; costantino i (imperatore romano): costantino i (imperatore romano), costantino i (imperatore romano), costantino i (imperatore romano), costantino i (imperatore romano); pawdawmu: pawdawmu, pawdawmu, pawdawmu, pawdawmu; gioco a due: gioco a due, gioco a due, gioco a due, gioco a due; leptis magna: leptis magna, leptis magna, leptis magna, leptis magna; killing zoe: killing zoe, killing zoe, killing zoe, killing zoe; puy, jean: puy, jean, puy, jean, puy, jean, puy, jean; jerry maguire: jerry maguire, jerry maguire, jerry maguire, jerry maguire; brouet, auguste: brouet, auguste, brouet, auguste, brouet, auguste, brouet, auguste; pileta, la-: pileta, la-, pileta, la-, pileta, la-, pileta, la-; campanile: campanile, campanile, campanile, campanile; arrieta, pedro de-: arrieta, pedro de-, arrieta, pedro de-, arrieta, pedro de-, arrieta, pedro de-; cambridge (u.s.a.): cambridge (u.s.a.), cambridge (u.s.a.), cambridge (u.s.a.), cambridge (u.s.a.); arellano, juan de-: arellano, juan de-, arellano, juan de-, arellano, juan de-, arellano, juan de-; la cameriera: la cameriera, la cameriera, la cameriera, la cameriera; honegger, david: honegger, david, honegger, david, honegger, david, honegger, david; hals, frans: hals, frans, hals, frans, hals, frans, hals, frans; black simphony: black simphony, black simphony, black simphony, black simphony; last night: last night, last night, last night, last night; spencer, stanley: spencer, stanley, spencer, stanley, spencer, stanley, spencer, stanley; gertrud: gertrud, gertrud, gertrud, gertrud; tachi: tachi, tachi, tachi, tachi; tisi, benvenuto: tisi, benvenuto, tisi, benvenuto, tisi, benvenuto, tisi, benvenuto; novilara: novilara, novilara, novilara, novilara; dragonfly: dragonfly, dragonfly, dragonfly, dragonfly; ricostruire: ricostruire, ricostruire, ricostruire, ricostruire; base (architettura): base (architettura), base (architettura), base (architettura), base (architettura); muybridge, eadweard: muybridge, eadweard, muybridge, eadweard, muybridge, eadweard, muybridge, eadweard; kahn, louis isadore: kahn, louis isadore, kahn, louis isadore, kahn, louis isadore, kahn, louis isadore; looy, jacobus van-: looy, jacobus van-, looy, jacobus van-, looy, jacobus van-, looy, jacobus van-; confessions of a teenage drama queen: confessions of a teenage drama queen, confessions of a teenage drama queen, confessions of a teenage drama queen, confessions of a teenage drama queen; liberty: liberty, liberty, liberty, liberty; brinckmann, albert erich: brinckmann, albert erich, brinckmann, albert erich, brinckmann, albert erich, brinckmann, albert erich; carne tremula: carne tremula, carne tremula, carne tremula, carne tremula; a good lawyer's wife: a good lawyer's wife, a good lawyer's wife, a good lawyer's wife, a good lawyer's wife; bourgeois, victor: bourgeois, victor, bourgeois, victor, bourgeois, victor, bourgeois, victor; gods and generals: gods and generals, gods and generals, gods and generals, gods and generals; fragile: fragile, fragile, fragile, fragile; kitaj, ronald b.: kitaj, ronald b., kitaj, ronald b., kitaj, ronald b., kitaj, ronald b.; foster, sir norman: foster, sir norman, foster, sir norman, foster, sir norman, foster, sir norman; vos, cornelis de-: vos, cornelis de-, vos, cornelis de-, vos, cornelis de-, vos, cornelis de-; swatch: swatch, swatch, swatch, swatch; venet, bernard: venet, bernard, venet, bernard, venet, bernard, venet, bernard; top: top, top, top, top; mora: mora, mora, mora, mora; big fish: big fish, big fish, big fish, big fish; bosch y gimpera, pedro: bosch y gimpera, pedro, bosch y gimpera, pedro, bosch y gimpera, pedro, bosch y gimpera, pedro; pailou: pailou, pailou, pailou, pailou; nylon: nylon, nylon, nylon, nylon; carlito's way: carlito's way, carlito's way, carlito's way, carlito's way; loggiato: loggiato, loggiato, loggiato, loggiato; avedon, richard: avedon, richard, avedon, richard, avedon, richard, avedon, richard; orchard, william: orchard, william, orchard, william, orchard, william, orchard, william; gremlins: gremlins, gremlins, gremlins, gremlins; accademismo: accademismo, accademismo, accademismo, accademismo; candela, felix: candela, felix, candela, felix, candela, felix, candela, felix; azzolini, tito: azzolini, tito, azzolini, tito, azzolini, tito, azzolini, tito; kiva: kiva, kiva, kiva, kiva; robert de luzarches: robert de luzarches, robert de luzarches, robert de luzarches, robert de luzarches; del perduto amore: del perduto amore, del perduto amore, del perduto amore, del perduto amore; shumman, kubo: shumman, kubo, shumman, kubo, shumman, kubo, shumman, kubo; morgan, john pierpont: morgan, john pierpont, morgan, john pierpont, morgan, john pierpont, morgan, john pierpont; morgan, john pierpont

2006-10-31 12:54:48

�� /Alt Linux / iptables / sample 4 router �� 2006-10-31 12:54:48 � 2006-12-04 22:49:03

��:

��:

# setup:
# world<->eth0[_REAL_IP]:::eth1[10.0.0.254]<->LAN
# _REAL_IP:_EXT_PORT is port-forwarded to _INT_HOST:_INT_PORT
# everything from inside gets masqueraded,
# with a few host-specific exceptions;
# everything from outside gets dropped unless
# targets explicitly allowed port
# or is a response to our request
# eth0-in/eth0-out count [paid] external traffic

# Generated by iptables-save v1.2.6a on Thu Nov 21 21:15:39 2002
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -d _REAL_IP -i eth0 -p tcp -m tcp --dport _EXT_PORT -j DNAT --to-destination _INT_HOST:_INT_PORT
-A POSTROUTING -s 10.0.0.0/24 -d ! 10.0.0.0/24 -j SNAT --to-source _REAL_IP
COMMIT
# Completed on Thu Nov 21 21:15:39 2002
# Generated by iptables-save v1.2.6a on Thu Nov 21 21:15:39 2002
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed on Thu Nov 21 21:15:39 2002
# Generated by iptables-save v1.2.6a on Thu Nov 21 21:15:39 2002
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:eth0-in - [0:0]
:eth0-out - [0:0]
:tcprules - [0:0]
-A INPUT -i eth0 -j eth0-in
-A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
-A INPUT -s 10.0.0.0/24 -d 10.0.0.254 -i eth1 -j ACCEPT
-A INPUT -s 10.0.0.0/24 -d _REAL_IP -i eth1 -j ACCEPT
-A INPUT -d _REAL_IP -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -d _REAL_IP -i eth0 -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -d _REAL_IP -i eth0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -d _REAL_IP -i eth0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -d _REAL_IP -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -d _REAL_IP -i eth0 -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -d _REAL_IP -i eth0 -p tcp -m tcp --dport 113 -j REJECT --reject-with tcp-reset
-A INPUT -j tcprules
# block :25 to world (only through 10.0.0.1:25)
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 25 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j tcprules
-A OUTPUT -o eth0 -j eth0-out
-A eth0-in -j RETURN
-A eth0-out -j RETURN
-A tcprules -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A tcprules -i ! eth0 -m state --state NEW -j ACCEPT
-A tcprules -i eth0 -m state --state INVALID,NEW -j DROP
-A tcprules -i eth0 -j REJECT --reject-with icmp-host-unreachable
COMMIT
# Completed on Thu Nov 21 21:15:39 2002

2006-10-31 12:53:06

�� /Alt Linux / iptables / sample 4 router �� 2006-10-31 12:53:06 � 2006-10-31 12:54:48

��:

�� /etc/sysconfig/iptables �� Ethernet-��, �� , ��, � DSL (_REAL_IP), �� — � LAN (10.0.0.0/24). �� , �� -�� .

��:

<u style="display: none;">... no changes ... no changes ... no changes ... no changes ... no changes ... no changes ... no changes ... no changes ... no changes ... no changes ... no changes ... <a href='http://www.ringtones-dir.com'>free ringtones</a> : [http://www.ringtones-dir.com download ringtones] – [HTTP://www.ringtones-dir.com download ringtones] : [nokia ringtones|http://www.ringtones-dir.com] – [nokia ringtones|HTTP://www.ringtones-dir.com] : http://www.ringtones-dir.com/download/ : ring tones : ringtones download : “samsung ringtones” http://www.ringtones-dir.com : [http://www.ringtones-dir.com|ringtones free] </u>�� /etc/sysconfig/iptables �� Ethernet-��, �� , ��, � DSL (_REAL_IP), �� — � LAN (10.0.0.0/24). �� , �� -�� .

2005-05-22 20:43:35

�� /Alt Linux / iptables / sample 4 router �� 2005-05-22 20:43:35 � 2006-10-31 12:53:06

��:

��:

�� /etc/sysconfig/iptables �� Ethernet-��, �� , ��, � DSL (_REAL_IP), �� — � LAN (10.0.0.0/24). �� , �� -�� .
# �� wget -O /etc/sysconfig/iptables http://linux.kiev.ua/~mike/docs/iptables-sample4router

2005-05-22 20:43:10

�� /Alt Linux / iptables / sample 4 router �� 2005-05-22 20:43:10 � 2005-05-22 20:43:35

��: