linux iptables nat & firewall

selfrun

               
               
                #! /bin/bash
OUT_SIDE=wlan0
SUB_NET=192.168.0.0/24
#内网服务器
_SERVICE_PORT_1=53389
_SERVER_1=192.168.0.128:3389
#本地服务
_SERVICE_PORT_2=3690
_SERVICE_PORT_3=80
_SERVICE_PORT_4=22
IPT="/sbin/iptables"
$IPT -F
$IPT -X
$IPT -F -t nat
$IPT -X -t nat
$IPT -F -t mangle
$IPT -X -t mangle
$IPT -P INPUT ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P POSTROUTING ACCEPT
$IPT -t mangle -P INPUT ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT
$IPT -t mangle -P FORWARD ACCEPT
$IPT -P INPUT DROP
$IPT -A INPUT -i vmnet1 -j ACCEPT
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -p tcp --dport 21 -j ACCEPT
$IPT -A INPUT -p tcp --dport $_SERVICE_PORT_1 -j ACCEPT
$IPT -A INPUT -p tcp --dport $_SERVICE_PORT_2 -j ACCEPT
$IPT -A INPUT -p tcp --dport $_SERVICE_PORT_3 -j ACCEPT
$IPT -A INPUT -p tcp --dport $_SERVICE_PORT_4 -j ACCEPT
$IPT -t nat -A POSTROUTING -s $SUB_NET -j MASQUERADE
#这条规则是建立一个端口映射,将内网的192.168.0.128上的3389映射到外网的53389端口
$IPT -A PREROUTING -t nat -i $OUT_SIDE -p tcp --dport $_SERVICE_PORT_1 -j DNAT --to-destination $_SERVER_1
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses


本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u1/59747/showart_1351251.html