我的 AS4 iptables 防火墙脚本（绝对可用）

hebzhjg

背景描述：网卡0接外网（网通光纤接入），网卡1接局域网，局域网中有若干太主机通过该服务器共享上网；我将80端口的www服务器放置在局域网的.10主机上，809端口的www服务器放在.6的主机上，将ftp服务器部署在.1主机上，通过iptables作转发

脚本内容如下：（如果在Windows下保存脚本，到Linux下时注意文件的换行符）

echo " Starting iptables rules..."
echo " Iptables rule edit by
hebzhjg@126.com
2006/11/23 "
echo " this rule for linuxserver network "
# the linuxserver has 2 interface eth0 and eth1
# eth0 for internat ip 218.12.170.144
# eth1 for localnet ip 192.168.10.1
#  in the host 192.168.10.10 has http www  service on port 8080
#  in the host 192.168.10.6 has snsoft short message service on port 809
#  on the host 192.168.10.1 has ftp service on port 21 and use passive mode for data
#  if has another service on host or localnet hosts then write chains
# the host 192.168.10.1 local manage for 192.168.10.4 by ssh
# set vars
IPT=/sbin/iptables
MOD=/sbin/modprobe
IP_SERVER=192.168.10.1
IP_ME="127.0.0.1"
IP_INTERNET="218.12.170.144"
# set admin manager ip
IP_ADMIN="192.168.10.4"
IP_WORK_RANGE="192.168.10.2/10"
IP_ALL="192.168.10.0/24"
# resetting iptables
$IPT -F
$IPT -t nat -F
# resetting chinas
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
# set internet access
$IPT -A INPUT -s $IP_ME -j ACCEPT
# set the www port 80 and 809(special use)
$IPT -A INPUT -p tcp --dport 80 -j ACCEPT
# set the ftp prot 21 20
$IPT -A INPUT -p tcp --dport 21 -j ACCEPT
$IPT -A INPUT -p tcp --dport 20 -j ACCEPT
# set the mail 110 143 25
$IPT -A INPUT -p tcp --dport 110 -j ACCEPT
$IPT -A INPUT -p tcp --dport 143 -j ACCEPT
$IPT -A INPUT -p tcp --dport 20 -j ACCEPT
# set admin use ssh manager access
$IPT -A INPUT -p tcp -s $IP_ADMIN --dport 22 -j ACCEPT
# set the localnet access
$IPT -A INPUT -s $IP_WORK_RANGE -j ACCEPT
# set SNAT chinas
$IPT -t nat -A POSTROUTING -s 192.168.10.2  -j SNAT --to $IP_INTERNET
$IPT -t nat -A POSTROUTING -s 192.168.10.3  -j SNAT --to $IP_INTERNET
$IPT -t nat -A POSTROUTING -s 192.168.10.4  -j SNAT --to $IP_INTERNET
$IPT -t nat -A POSTROUTING -s 192.168.10.5  -j SNAT --to $IP_INTERNET
$IPT -t nat -A POSTROUTING -s 192.168.10.6  -j SNAT --to $IP_INTERNET
$IPT -t nat -A POSTROUTING -s 192.168.10.7  -j SNAT --to $IP_INTERNET
$IPT -t nat -A POSTROUTING -s 192.168.10.8  -j SNAT --to $IP_INTERNET
$IPT -t nat -A POSTROUTING -s 192.168.10.9  -j SNAT --to $IP_INTERNET
$IPT -t nat -A POSTROUTING -s 192.168.10.10 -j SNAT --to $IP_INTERNET
# set DNAT chinas
$IPT -t nat -A PREROUTING -p tcp -d $IP_INTERNET --dport 80 -j DNAT --to-destination 192.168.10.10:8080
$IPT -t nat -A PREROUTING -p tcp -d $IP_INTERNET --dport 809 -j DNAT --to-destination 192.168.10.6:7080
# load ftp access model
$MOD ip_nat_ftp
$MOD ip_conntrack_ftp
echo " Setting iptables OK."


本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u1/45779/showart_359117.html