Linux iptables router script

[Verwijderd]

Ik heb nu een redhat pc draaien, maar wil hem als router zetten, vorige keer heb ik lopen prutsen ermee. Is er ook een auto script die automatisch dat forwarding en nat regelt?
zo ja welke?
of anders iemand die me op weg kan helpen met dit?

[Neptunus]

http://www.linuxdoc.org/HOWTO/IP-Masquerade-HOWTO/
http://www.suse.de/~mha/linux-ip-nat/diplom/node4.html
http://www.e-infomax.com/ipmasq/

Mischien heb je hier wat aan!!!

[Verwijderd]

Of deze.

[Verwijderd]

ik wil die van mij wel posten, zeg het maar

[Eastern]

Deze dan?

code:

#!/bin/sh
#
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin

# Set path to iptables
path_iptables="/sbin/iptables"

echo ""
echo "Starting Firewall"

logger `date +'%b %d %k:%M:%S'`
logger "Starting iptables firewall ..."


# Insert modules if not compiled within the kernel
/sbin/insmod ip_conntrack_ftp
/sbin/insmod ip_nat_ftp
/sbin/insmod ipt_LOG
/sbin/insmod ipt_MARK
/sbin/insmod ipt_MASQUERADE
/sbin/insmod ipt_REDIRECT
/sbin/insmod ipt_REJECT
/sbin/insmod ipt_TOS
/sbin/insmod ipt_limit
/sbin/insmod ipt_mac
/sbin/insmod ipt_mark
/sbin/insmod ipt_multiport
/sbin/insmod ipt_state
/sbin/insmod ipt_tcpmss
/sbin/insmod ipt_tos
/sbin/insmod iptable_mangle
/sbin/insmod iptable_nat

# CRITICAL:  Enable IP forwarding since it is disabled by default since
echo 1 > /proc/sys/net/ipv4/ip_forward

# Turn on source address verification in kernel
if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then
    for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 2 > $f;
done
fi;

# Turn on syn cookies protection in kernel
if [ -e /proc/sys/net/ipv4/tcp_syncookies ]; then
    echo 1 > /proc/sys/net/ipv4/tcp_syncookies
fi;

# ICMP Broadcasting protection
if [ -e /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts ]; then
    echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
fi;

# ICMP Dead Error Messages protection
if [ -e /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses ]; then
    echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
fi;

# Turn on dynamic TCP/IP address hacking ... turn of with echo 0 > ...
if [ -e /proc/sys/net/ipv4/ip_dynaddr ]; then
    echo 1 > /proc/sys/net/ipv4/ip_dynaddr
fi;

# Set the maximum number of connections to track. (Kernel Default: 2048)
if [ -e /proc/sys/net/ipv4/ip_conntrack_max ]; then
    echo 4096 > /proc/sys/net/ipv4/ip_conntrack_max
fi

# Enable the LooseUDP patch which some Internet-based games require
#
#  If you are trying to get an Internet game to work through your IP MASQ box,
#  and you have set it up to the best of your ability without it working, try
#  enabling this option (delete the "#" character).  This option is disabled
#  by default due to possible internal machine UDP port scanning
#  vunerabilities.
#  Turned off by default ... turn on with echo 1 > ...
if [ -e /proc/sys/net/ipv4/ip_masq_udp_dloose ]; then
    echo 0 > /proc/sys/net/ipv4/ip_masq_udp_dloose
fi;


#----------------
# Initialisatie
#----------------

# ALL PPP and DHCP users must set this for the correct EXTERNAL interface name
# After pptp-connection established do ifconfig and use first IP-address here
ext_if="ppp+"
ext_ip=`/sbin/ifconfig ppp0 | grep 'inet addr' | awk '{print$2}' | sed -e 's/.*://'`

# Assign the internal IP
local_if="eth1"
local_ip="192.168.0.1"
local_net="192.168.0.0/24"

# Assign modem IP
modem_ip="10.0.0.138"
modem_net="10.0.0.0/24"
modem_eth="eth0"
modem_ethip="10.0.0.100"

# Assign masqueraded machine IP
masq_machine_ip="192.168.0.1"

# traceroute ports
TRACEROUTE_SRC_PORTS="32769:65535"
TRACEROUTE_DEST_PORTS="33434:33523"

# Xwindow ports
xwindows_ports="6000:6063"

# Ports
priv_ports="0:1023"
unpriv_ports="1024:65535"

# tue ip range
tue="131.155.0.0/16"

# dns servers
dns1="195.121.1.34"
dns2="195.121.1.66"

# people
frank="192.168.0.2"
martin="192.168.0.3"
joop="192.168.0.4"

#############################################################################

#-------------------------------------------------------------------
# Flush and clearing rulez and setting default policies
#-------------------------------------------------------------------
$path_iptables -F
$path_iptables -X
$path_iptables -Z
$path_iptables -P INPUT DROP
$path_iptables -P OUTPUT DROP
$path_iptables -P FORWARD DROP
$path_iptables -t nat -F
$path_iptables -t nat -P POSTROUTING ACCEPT
$path_iptables -t nat -P PREROUTING ACCEPT

# Creating new chain (LDROP = LOG & DROP) for logging
$path_iptables -N LDROP

# Set up LDROP
$path_iptables -A LDROP -p tcp -m limit --limit 1/s -j LOG --log-level info --log-prefix "TCP Dropped: "
$path_iptables -A LDROP -p udp -m limit --limit 1/s -j LOG --log-level info --log-prefix "UDP Dropped: "
$path_iptables -A LDROP -p icmp -m limit --limit 1/s -j LOG --log-level info --log-prefix "ICMP Dropped: " 
$path_iptables -A LDROP -f -m limit --limit 1/s -j LOG --log-level warning --log-prefix "FRAGMENT Dropped: "
$path_iptables -A LDROP -j DROP

# Creating new chain (CHECK_FLAGS) for checking the flags of incoming packets
$path_iptables -N CHECK_FLAGS
$path_iptables -F CHECK_FLAGS


#--------------------------
# Loopback settings
#--------------------------
$path_iptables -A INPUT -i lo -j ACCEPT
$path_iptables -A OUTPUT -o lo -j ACCEPT
$path_iptables -A INPUT -i $ext_if -d 127.0.0.0/8 -j LDROP


#-------------------
# Modem trafic
#-------------------
# Refuse spoofing
$path_iptables -A INPUT -i $ext_if -s $modem_net -j LDROP        

# Only trafic between modem and server is welcome
$path_iptables -A INPUT -i $modem_eth -s $modem_ip -d $modem_ethip -j ACCEPT
$path_iptables -A OUTPUT -o $modem_eth -s $modem_ethip -d $modem_ip -j ACCEPT

# View your modemsettings with your browser via http://10.0.0.138 from every 
# computer on your LAN
# $path_iptables -t nat -A POSTROUTING -o $modem_eth -j MASQUERADE
### $path_iptables -t nat -A POSTROUTING -d $modem_ip -j MASQUERADE


#---------------
# Local trafic
#---------------
# Assemble before forwarding
$path_iptables -A OUTPUT -f -o $local_if -j LDROP

# Refuse spoofing
$path_iptables -A INPUT -i $ext_if -s $local_net -j LDROP        

# Everything else is fine
$path_iptables -A INPUT -i $local_if -s $local_net -j ACCEPT
$path_iptables -A OUTPUT -o $local_if -d $local_net -j ACCEPT


#-------------------
# Masquerade 
#-------------------
# Higher ports needed to accept incoming/outgoing calls
# Any trafic from masqueraded machines/server accepted
# Reject any trafic not started by masqueraded machine/server
$path_iptables -A INPUT -p tcp -i $ext_if -s any/0 -d $ext_ip --dport $unpriv_ports ! --syn -j ACCEPT
$path_iptables -A OUTPUT -p tcp -o $ext_if -s $ext_ip --sport $unpriv_ports -d any/0 -j ACCEPT

# Check if UDP connections are needed
$path_iptables -A INPUT -p udp -i $ext_if -s any/0 -d $ext_ip --dport $unpriv_ports -j ACCEPT
$path_iptables -A OUTPUT -p udp -o $ext_if -s $ext_ip --sport $unpriv_ports -d any/0 -j ACCEPT

# All local trafic is masqueraded externally
$path_iptables -t nat -A POSTROUTING -o $ext_if -s $local_net -j MASQUERADE
$path_iptables -t nat -A POSTROUTING -o $local_if -j MASQUERADE

# Only forward packages for our subnet
# Forward internal to external and external to internal net traffic
$path_iptables -A FORWARD -s $local_net -j ACCEPT
$path_iptables -A FORWARD -d $local_net -j ACCEPT

# Take advantage of connection tracking 
$path_iptables -A INPUT -i $ext_if -d $ext_ip -m state --state ESTABLISHED,RELATED -j ACCEPT 


#------------------------------------------
# TCP unpriviliged ports
#------------------------------------------
# Establish VNC-connection with Linux server
###$path_iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport 5901 -j DNAT --to $local_ip
###$path_iptables -t nat -A POSTROUTING -d $local_ip -p tcp --dport 5901 -j ACCEPT

# Establish VNC-connection with masqueraded machine
# $path_iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport 5900 -j DNAT --to $masq_machine_ip
# $path_iptables -t nat -A POSTROUTING -d $masq_machine_ip -p tcp --dport 5900 -j ACCEPT


#-----------------------
# ICMP settings
#-----------------------

# icmp trafic
# 0 = echo-reply            needed by ping
# 3 = destination-unreachable       needed by any TCP/UDP trafic
# 5 = redirect              needed by routing if not running routing daemon
# 8 = echo-request          needed by ping
#11 = time-exceeded         needed by traceroute

$path_iptables -A INPUT -i $ext_if -p icmp --icmp-type 0 -s any/0 -d $ext_ip -j ACCEPT
$path_iptables -A INPUT -i $ext_if -p icmp --icmp-type 3 -s any/0 -d $ext_ip -j ACCEPT
$path_iptables -A INPUT -i $ext_if -p icmp --icmp-type 8 -s any/0 -d $ext_ip -j ACCEPT 
$path_iptables -A INPUT -i $ext_if -p icmp --icmp-type 11 -s any/0 -d $ext_ip -j LDROP
$path_iptables -A INPUT -i $ext_if -p icmp --icmp-type 5 -s any/0 -d $ext_ip -j LDROP 


#-------------------------------------------
# Refusing some common attacks
#-------------------------------------------
# You can also use the module "limit" to avoid various denial of service attacks (DoS) 
# with a faster rate to increase responsiveness. 
# --limit followed by a number; specifies the maximum average number of matches to allow per second. 
# Syn-flood protection: 
$path_iptables -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT

# Furtive port scanner: 
$path_iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

# Ping of death: 
# pings are blocked by default. Set this option if you want to accept pings with
# protection against the ping of death.
$path_iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
$path_iptables -A OUTPUT -p icmp --icmp-type echo-reply -m limit --limit 1/s -j ACCEPT

# Block XMAS packets
$path_iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
$path_iptables -A OUTPUT -p tcp --tcp-flags ALL ALL -j DROP

# Block NULL packets
$path_iptables -A INPUT -p tcp --tcp-flags ALL NONE -j LDROP
$path_iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j LDROP

# Portscanner
$path_iptables -A INPUT -p tcp --tcp-option \! 2 -j LOG --log-tcp-options --log-prefix "Portscanner: " 
$path_iptables -A INPUT -p tcp --tcp-option \! 2 -j REJECT --reject-with tcp-reset 

# NMAP FIN/URG/PSH - XMAS - scan
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL FIN,URG,PSH -m limit \
        --limit 5/minute -j LOG --log-level notice --log-prefix "NMAP-XMAS: "
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP

# SYN/RST - scan
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags SYN,RST SYN,RST -m limit \
        --limit 5/minute -j LOG --log-level notice --log-prefix "SYN/RST: "
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

# SYN/FIN -- scan(probably)
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit \
        --limit 5/minute -j LOG --log-level notice --log-prefix "SYN/FIN: "
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

# FIN - scan
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL FIN -m limit \
        --limit 5/minute -j LOG --log-level notice --log-prefix "FIN: "
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags  ALL FIN -j DROP

# ALL/ALL - scan
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL ALL -m limit \
        --limit 5/minute -j LOG --log-level notice --log-prefix "ALL/ALL: "
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags  ALL ALL -j DROP

# NULL - scan
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL NONE -m limit \
        --limit 5/minute -j LOG --log-level notice --log-prefix "NULL: "
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags  ALL NONE -j DROP

# Check TCP packets coming in on the external interface for weird flags
$path_iptables -A INPUT -i $ext_if -p tcp -j CHECK_FLAGS
# Check TCP packets going out on the external interface for weird flags.
$path_iptables -A OUTPUT -o $ext_if -p tcp -j CHECK_FLAGS


#-------------------------------------------
# Refusing some common ports
#-------------------------------------------
# Avoid ports subject to protocol & system administration problems.

# NFS: disable incoming connections to port 2049 
$path_iptables -A INPUT -p tcp -i $ext_if --dport 2049 -j LDROP
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport 2049 -j LDROP
$path_iptables -A INPUT -p udp -i $ext_if --dport 2049 -j LDROP
$path_iptables -A OUTPUT -p udp -o $ext_if --dport 2049 -j LDROP

# openwindows: disable incoming connections to port 2000
$path_iptables -A INPUT -p tcp -i $ext_if --dport 2000 -j LDROP
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport 2000 -j LDROP

# Xwindows: disable incoming connections to port 6000+
$path_iptables -A INPUT -p tcp -i $ext_if --dport $xwindows_ports -j LDROP
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport $xwindows_ports -j LDROP
$path_iptables -A INPUT -p udp -i $ext_if --dport $xwindows_ports -j LDROP
$path_iptables -A OUTPUT -p udp -o $ext_if --dport $xwindows_ports -j LDROP

# SQUID: disable incoming connections on port 3128
$path_iptables -A INPUT -p tcp -i $ext_if --dport 3128 -j LDROP
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport 3128 -j LDROP

# WEBPROXY: disable incoming connections on port 8080
$path_iptables -A INPUT -p tcp -i $ext_if --dport 8080 -j LDROP
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport 8080 -j LDROP

# SOCKS: disable incoming connections to port 1080
$path_iptables -A INPUT -p tcp -i $ext_if --dport 1080 -j LDROP
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport 1080 -j LDROP


#-------------------------------------------
# Refusing some Trojan-ports
#-------------------------------------------
# Trojan-ports: disable incoming connections to common trojan ports

# Block Subseven (1.7/1.9)
$path_iptables -A INPUT -p tcp -i $ext_if --dport 1234 --syn -m limit --limit 2/minute -j LDROP 
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport 1234 --syn -m limit --limit 2/minute -j LDROP        
$path_iptables -A INPUT -p tcp -i $ext_if --dport  6711 --syn -m limit --limit 2/minute -j LDROP        
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport 6711 --syn -m limit --limit 2/minute -j LDROP        

# Block Backdoor-G and Subseven
$path_iptables -A INPUT -p tcp -i $ext_if --dport 6776 --syn -m limit --limit 2/minute -j LDROP
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport 6776 --syn -m limit --limit 2/minute -j LDROP

# Block NetBus
$path_iptables -A INPUT -p tcp -i $ext_if --dport 12345:12346 -m limit --limit 2/minute -j LDROP
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport 12345:12346 -m limit --limit 2/minute -j LDROP
$path_iptables -A INPUT -p udp -i $ext_if --dport 12345:12346 -m limit --limit 2/minute -j LDROP
$path_iptables -A OUTPUT -p udp -o $ext_if --dport 12345:12346 -m limit --limit 2/minute -j LDROP

# Block NetBus 2 Pro
$path_iptables -A INPUT -p tcp -i $ext_if --dport 20034 -m limit --limit 2/minute -j LDROP
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport 20034 -m limit --limit 2/minute -j LDROP
$path_iptables -A INPUT -p udp -i $ext_if --dport 20034 -m limit --limit 2/minute -j LDROP
$path_iptables -A OUTPUT -p udp -o $ext_if --dport 20034 -m limit --limit 2/minute -j LDROP

# Block Stacheldraht
$path_iptables -A INPUT -p tcp -i $ext_if --dport 16660 --syn -m limit --limit 2/minute -j LDROP        
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport 16660 --syn -m limit --limit 2/minute -j LDROP
$path_iptables -A INPUT -p tcp -i $ext_if --dport 60001 --syn -m limit --limit 2/minute -j LDROP        
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport 60001 --syn -m limit --limit 2/minute -j LDROP

# Block Back Orifice
$path_iptables -A INPUT -p tcp -i $ext_if --dport 31337 -m limit --limit 2/minute -j LDROP      
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport 31337 -m limit --limit 2/minute -j LDROP     
$path_iptables -A INPUT -p udp -i $ext_if --dport 31337 -m limit --limit 2/minute -j LDROP      
$path_iptables -A OUTPUT -p udp -o $ext_if --dport 31337 -m limit --limit 2/minute -j LDROP     

# Block Trinity v3\n
$path_iptables -A INPUT -p tcp -i $ext_if --dport 33270 --syn -m limit --limit 2/minute -j LDROP        
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport 33270 --syn -m limit --limit 2/minute -j LDROP       
$path_iptables -A INPUT -p udp -i $ext_if --dport 33270 -m limit --limit 2/minute -j LDROP      
$path_iptables -A OUTPUT -p udp -o $ext_if --dport 33270 -m limit --limit 2/minute -j LDROP     

# Block Trin00
$path_iptables -A INPUT -p tcp -i $ext_if --dport 1524 -m limit --limit 2/minute -j LDROP       
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport 1524 -m limit --limit 2/minute -j LDROP
$path_iptables -A INPUT -p tcp -i $ext_if --dport 27665 -m limit --limit 2/minute -j LDROP      
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport 27665 -m limit --limit 2/minute -j LDROP
$path_iptables -A INPUT -p udp -i $ext_if --dport 27444 -m limit --limit 2/minute -j LDROP      
$path_iptables -A OUTPUT -p udp -o $ext_if --dport 27444 -m limit --limit 2/minute -j LDROP
$path_iptables -A INPUT -p udp -i $ext_if --dport 31335 -m limit --limit 2/minute -j LDROP      
$path_iptables -A OUTPUT -p udp -o $ext_if --dport 31335 -m limit --limit 2/minute -j LDROP

# Block Multicast
$path_iptables -A INPUT -s 224.0.0.0/8 -d 0/0 -j LDROP      
$path_iptables -A OUTPUT -s 224.0.0.0/8 -d 0/0 -j LDROP
$path_iptables -A INPUT -s 0/0 -d 224.0.0.0/8 -j LDROP      
$path_iptables -A OUTPUT -s 0/0 -d 224.0.0.0/8 -j LDROP

# Block Packets with Stuffed Routing
$path_iptables -A INPUT -s 255.255.255.255 -j LDROP     
$path_iptables -A OUTPUT -s 255.255.255.255 -j LDROP
$path_iptables -A INPUT -s 0.0.0.0 -j LDROP     
$path_iptables -A OUTPUT -s 0.0.0.0 -j LDROP

# Block Fragmented Packets
$path_iptables -A INPUT -f -m limit --limit 10/minute -j LDROP


#----------------
# Traceroute
#----------------
# Deny incoming traceroute and sustain outgoing traceroute
$path_iptables -A INPUT -p udp -i $ext_if \
        --sport $TRACEROUTE_SRC_PORTS \
        -d $ext_ip --dport $TRACEROUTE_DEST_PORTS -j LDROP

# Allow outgoing traceroute
$path_iptables -A OUTPUT -p udp -o $ext_if \
        -s $ext_ip --sport $TRACEROUTE_SRC_PORTS \
        --dport $TRACEROUTE_DEST_PORTS -j ACCEPT


#------------------------------------
# SSH
#------------------------------------
$path_iptables -A INPUT -p tcp -i $ext_if -s $tue -d $ext_ip --dport 22 -j ACCEPT
$path_iptables -A OUTPUT -p tcp -o $ext_if -s $ext_ip --sport 22 -d $tue -j ACCEPT

#-----------------
# FTP
#-----------------
$path_iptables -A INPUT -p tcp -i $ext_if -s any/0 -d $ext_ip --dport ftp -j ACCEPT
$path_iptables -A OUTPUT -p tcp -o $ext_if -s $ext_ip --sport ftp -d any/0 ! --syn -j ACCEPT

$path_iptables -A INPUT -p tcp -i $ext_if -s any/0 -d $ext_ip --dport ftp-data ! --syn -j ACCEPT
$path_iptables -A OUTPUT -p tcp -o $ext_if -s $ext_ip --sport ftp-data -d any/0 -j ACCEPT
$path_iptables -A INPUT -p tcp --sport ftp-data --dport 1023:65535 ! --syn -m state --state RELATED -j ACCEPT

#----------------------------
# Apache
#----------------------------
$path_iptables -A INPUT -p tcp -i $ext_if -s any/0 -d $ext_ip --dport http -j ACCEPT
$path_iptables -A OUTPUT -p tcp -o $ext_if -s $ext_ip --sport http -d any/0 ! --syn -j ACCEPT

#-------------------
# IRC
#-------------------
$path_iptables -A INPUT -p tcp -i $ext_if -s any/0 -d $ext_ip --dport 6667 -j ACCEPT
$path_iptables -A OUTPUT -p tcp -o $ext_if -s $ext_ip --sport 6667 -d any/0 -j ACCEPT

#----------------------------
# Mail (smtp/pop3)
#----------------------------
# vanaf TUe toegang tot pop3
$path_iptables -A INPUT -p tcp -i $ext_if -s $tue -d $ext_ip --dport 110 -j ACCEPT
$path_iptables -A OUTPUT -p tcp -o $ext_if -s $ext_ip --sport 110 -d $tue -j ACCEPT

# iedereen mag mail naar tuxserver.dyndns.org sturen
$path_iptables -A INPUT -p tcp -i $ext_if -s any/0 -d $ext_ip --dport smtp -j ACCEPT
$path_iptables -A OUTPUT -p tcp -o $ext_if -s $ext_ip --sport smtp -d any/0 -j ACCEPT

#-----------------
# DNS (poort 53, tcp&udp)
#-----------------
###$path_iptables -A INPUT -p tcp -i $ext_if -s $dns1 -d $ext_ip --dport 53 -j ACCEPT
###$path_iptables -A INPUT -p udp -i $ext_if -s $dns1 -d $ext_ip --dport 53 -j ACCEPT
###$path_iptables -A INPUT -p tcp -i $ext_if -s $dns2 -d $ext_ip --dport 53 -j ACCEPT
###$path_iptables -A INPUT -p udp -i $ext_if -s $dns2 -d $ext_ip --dport 53 -j ACCEPT

#-----------------
# Frank game voice
#-----------------
$path_iptables -t nat -A PREROUTING -d $ext_ip -p tcp --destination-port 2300:2400 -i eth0 -j DNAT --to $frank
$path_iptables -t nat -A PREROUTING -d $ext_ip -p udp --destination-port 2300:2400 -i eth0 -j DNAT --to $frank
$path_iptables -t nat -A PREROUTING -d $ext_ip -p tcp --destination-port 47624 -i eth0 -j DNAT --to $frank:47624

#-----------------
# Martin ICQ
#-----------------

#----------------
# Logging
#----------------
# All other incoming, forwarding and outgoing is denied and logged. 
$path_iptables -A INPUT -i $ext_if -s any/0 -d any/0 -j LDROP        
$path_iptables -A OUTPUT -o $ext_if -s any/0 -d any/0 -j LDROP       
$path_iptables -A FORWARD -o $ext_if -s any/0 -d any/0 -j LDROP      


# log and show
logger "Firewall is up!"
echo "Done"

# THE END

Niet te lang hoop ik

[Verwijderd]

Op maandag 07 januari 2002 14:34 schreef ronaldZ het volgende:
ik wil die van mij wel posten, zeg het maar

mijn router script:

code:

#!/bin/sh

# Set some vars
EXTIP=`ifconfig eth0 | grep inet | tr -s " " | cut -d " " -f 3 | cut -d ":" -f 2`

# Load the NAT module (this pulls in all the others).
modprobe iptable_nat

# Turn on IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

#Flush rules
iptables -t nat -F PREROUTING

# In the NAT table (-t nat), Append a rule (-A) after routing (POSTROUTING)
# which says to MASQUERADE the connection (-j MASQUERADE).
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j MASQUERADE

# Allows forwarding specifically to our LAN
iptables -A FORWARD -s 193.168.0.0/24 -j ACCEPT

# Allow dhcp requests
iptables -A INPUT -i eth1 -p udp --sport bootpc --dport bootps -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --sport bootpc --dport bootps -j ACCEPT
iptables -A INPUT -i eth1 -p udp --sport bootps --dport bootpc -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --sport bootps --dport bootpc -j ACCEPT

# Allow dns requests
iptables -A INPUT -i eth1 -p udp --dport domain -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport domain -j ACCEPT

# Forward some ports
iptables -t nat -A PREROUTING -p tcp --dport 7000 -i eth0 -j DNAT --to 192.168.0.18:7000
iptables -t nat -A PREROUTING -p tcp --dport 5000 -i eth0 -j DNAT --to 192.168.0.18:5000
iptables -t nat -A PREROUTING -p tcp --dport 3389 -i eth0 -j DNAT --to 192.168.0.18:3389
iptables -t nat -A PREROUTING -p tcp --dport 443 -i eth0 -j DNAT --to 192.168.0.18:443
#msn porten
iptables -t nat -A PREROUTING -p tcp --dport 6891 -i eth0 -j DNAT --to 192.168.0.18:6891
iptables -t nat -A PREROUTING -p tcp --dport 6892 -i eth0 -j DNAT --to 192.168.0.18:6892
iptables -t nat -A PREROUTING -p tcp --dport 6893 -i eth0 -j DNAT --to 192.168.0.18:6893
iptables -t nat -A PREROUTING -p tcp --dport 6894 -i eth0 -j DNAT --to 192.168.0.18:6894
iptables -t nat -A PREROUTING -p tcp --dport 6895 -i eth0 -j DNAT --to 192.168.0.18:6895
iptables -t nat -A PREROUTING -p tcp --dport 6896 -i eth0 -j DNAT --to 192.168.0.18:6896
iptables -t nat -A PREROUTING -p tcp --dport 6897 -i eth0 -j DNAT --to 192.168.0.18:6897
iptables -t nat -A PREROUTING -p tcp --dport 6898 -i eth0 -j DNAT --to 192.168.0.18:6898
iptables -t nat -A PREROUTING -p tcp --dport 6899 -i eth0 -j DNAT --to 192.168.0.18:6899
iptables -t nat -A PREROUTING -p tcp --dport 6900 -i eth0 -j DNAT --to 192.168.0.18:6900
iptables -t nat -A PREROUTING -p udp --dport 6901 -i eth0 -j DNAT --to 192.168.0.18:6901
echo $EXTIP