求安全性高的squid+iptables

bigbigsh

我SQUID是没问题的。。
为什么运行下面的脚本出现上不了网。。问题出在那里请帮忙指点一下。谢谢~

#!/bin/sh
modprobe ipt_MASQUERADE
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
iptables -F
iptables -t nat -F
iptables -X
iptables -t nat -X
iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 110,80,25 -j ACCEPT
iptables -A INPUT -p tcp -s 196.196.0.0/24 --dport 139 -j ACCEPT
iptables -A INPUT -i eth1 -p udp -m multiport --dports 53 -j ACCEPT
iptables -A INPUT -p icmp -j DROP
iptables -N syn-flood
iptables -A INPUT -p tcp --syn -j syn-flood
iptables -I syn-flood -p tcp -m limit --limit 3/s --limit-burst 6 -j RETURN
iptables -A syn-flood -j REJECT
iptables -P FORWARD DROP
iptables -A FORWARD -p udp -s 196.196.0.0/24 --dport 53 -j ACCEPT
iptables -A FORWARD -p gre -s 196.196.0.0/24 -j ACCEPT
iptables -A FORWARD -p icmp -s 196.196.0.0/24 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
sysctl -w net.ipv4.ip_forward=1 &>/dev/null
sysctl -w net.ipv4.tcp_syncookies=1 &>/dev/null
sysctl -w net.ipv4.ip_conntrack_max=300000 &>/dev/null
sbin/iptables -A FORWARD -p tcp --dport 23 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8009:8029 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 88 -j ACCEPT
iptables -A FORWARD -p tcp --dport 22 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 16000 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 3724 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 23 -j ACCEPT
iptables -t nat -A PREROUTING -s 196.196.0.0/24 -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
/sbin/iptables -A POSTROUTING -t nat -s 196.196.0.0/24 -o eth0 -j SNAT --to-source 222.66.101.226

[ 本帖最后由 bigbigsh 于 2008-7-9 21:31 编辑 ]

xwmhmily

上不了网？是你的机器上不了网还是LAN上不了？

bigbigsh

#!/bin/sh
modprobe ipt_MASQUERADE
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
iptables -F
iptables -t nat -F
iptables -X
iptables -t nat -X
iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth1 -p udp -m multiport --dports 53 -j ACCEPT
iptables -A INPUT -p tcp --dport 3128 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -P FORWARD DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp --dport 22 -j ACCEPT
iptables -t nat -A PREROUTING -s 196.196.0.0/24 -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
/sbin/iptables -A POSTROUTING -t nat -s 196.196.0.0/24 -o eth0 -j SNAT --to-source 222.66.x.x

以上方法可以实现SQUID+IPTABLES上网，上不了网的原因是忘了加INPUT 3128 ACCEPT  
请问这两句能不能改为其它的更具有安全性方法。。谢谢指教~~
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

[ 本帖最后由 bigbigsh 于 2008-7-9 21:33 编辑 ]

bigbigsh

帮忙指点一下这两个防火墙那好安全性高一点
系统是Centos 5.2 iptables-1.3.6 squid-2.6.16

例子1：
iptables -P INPUT DROP
iptables -A INPUT -i eth1 -s 196.196.0.0/24 -p tcp --dport 3128 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth1 -p udp -m multiport --dports 53 -j ACCEPT
iptables -A INPUT -p tcp --dport 3128 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -P FORWARD DROP
iptables -A FORWARD -p udp -s 196.196.0.0/24 --dport 53 -j ACCEPT
iptables -A FORWARD -o eth1 -d 196.196.0.0/24 -p tcp --sport 3128 -m state --state ESTABLISHED -j ACCEPT
iptables -P OUTPUT DROP
iptables -A OUTPUT -o eth1 -d 196.196.0.0/24 -p tcp --sport 3128 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 32768:61000 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -t nat -A PREROUTING -s 196.196.0.0/24 -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -A POSTROUTING -t nat -s 196.196.0.0/24 -o eth0 -j SNAT --to-source 222.66.x.x

例子2
iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth1 -p udp -m multiport --dports 53 -j ACCEPT
iptables -A INPUT -p tcp --dport 3128 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -P FORWARD DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp --dport 22 -j ACCEPT
iptables -t nat -A PREROUTING -s 196.196.0.0/24 -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
/sbin/iptables -A POSTROUTING -t nat -s 196.196.0.0/24 -o eth0 -j SNAT --to-source 222.66.x.x