两个桥的透明防火墙

banevv

三层设备 (可以划vlan,不能做访问控制)
                   /\
                 /    \
             ------------
             | br0    br1 |       防火墙
             ------------
            /                \
       用户一vlan1      用户二vlan2

没有改变网络结构 4块网卡 做了两个桥 来实现透明防火墙

ifcfg-eth0(1,2,3):
DEVICE=eth0(1,2,3)
ONBOOT=yes
BOOTPROTO=static
IPADDR=0.0.0.0

bridgeup脚本:
#!/bin/bash
#create and up bridge
brctl addbr br0
brctl addif br0 eth0
brctl addif br0 eth1
brctl addbr br1
brctl addif br1 eth2
brctl addif br1 eth3
ifconfig br0 10.122.0.38 netmask 255.255.255.0 up
route add default gateway 10.122.0.1
ifconfig br1 up

rc.local:

#!/bin/sh
#
# This script will be executed *after* all the other init scripts.
# You can put your own initialization stuff in here if you don't
# want to do the full Sys V style init stuff.
touch /var/lock/subsys/local
/usr/local/bridgeup
/usr/local/bridgefirewall

bridgefirewall:

#!/bin/sh
INET_IFACE1="eth1"
INET_IFACE2="eth3"
LAN_IFACE1="eth0"
LAN_IFACE2="eth2"
LO_IFACE="lo"
LO_IP="127.0.0.1"
IPTABLES="/sbin/iptables"
/sbin/depmod -a
/sbin/modprobe ipt_multiport
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack hashsize=1048576
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_state

/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -Z
/sbin/iptables -F -t nat
/sbin/iptables -F -t mangle
echo "1048576" > /proc/sys/net/ipv4/netfilter/ip_conntrack_max
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP
$IPTABLES -N bad_tcp_packets

$IPTABLES -N allowed
$IPTABLES -N tcp_packets
$IPTABLES -N udp_packets
$IPTABLES -N icmp_packets

$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK \
-m state --state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A bad_tcp_packets -p tcp -m multiport --dport 135,137,138,139 -j DROP
$IPTABLES -A bad_tcp_packets -p tcp -m multiport --dport 445,1022,1023,1433,1434 -j DROP
$IPTABLES -A bad_tcp_packets -p tcp -m multiport --dport 2500,2745,3128,3332,4444,5000 -j DROP
$IPTABLES -A bad_tcp_packets -p tcp -m multiport --dport 5238,5300,5554,6346,6667,9393 -j DROP
$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP -j DROP
$IPTABLES -A tcp_packets -p UDP -s 10.122.0.0/255.255.255.0 --dport 161 -j ACCEPT
$IPTABLES -A tcp_packets -p UDP -s 10.122.0.0/255.255.255.0 --dport 162 -j ACCEPT
$IPTABLES -A tcp_packets -p TCP -s 10.122.0.0/255.255.255.0 --dport 161 -j ACCEPT
$IPTABLES -A tcp_packets -p TCP -s 10.122.0.0/255.255.255.0 --dport 162 -j ACCEPT
$IPTABLES -A tcp_packets -p TCP -s 10.122.0.0/255.255.255.0 --dport 22 -j ACCEPT

$IPTABLES -A udp_packets -p UDP --destination-port 135:139 -j DROP
$IPTABLES -A udp_packets -p UDP --destination-port 445 -j DROP
$IPTABLES -A udp_packets -p UDP --destination-port 69 -j DROP
$IPTABLES -A udp_packets -p UDP --destination-port 593 -j DROP
$IPTABLES -A udp_packets -p UDP --destination-port 1343 -j DROP
$IPTABLES -A udp_packets -p UDP --destination-port 4444 -j DROP
$IPTABLES -A udp_packets -p UDP --destination-port 1029 -j DROP
$IPTABLES -A udp_packets -p UDP --destination-port 1068 -j DROP

$IPTABLES -A icmp_packets -p ICMP  --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP  --icmp-type 0 -j ACCEPT
$IPTABLES -A INPUT -p tcp -j bad_tcp_packets
$IPTABLES -A INPUT -p udp -j udp_packets
$IPTABLES -A INPUT -p ALL -m physdev --physdev-in $LO_IFACE -j ACCEPT
$IPTABLES -A INPUT -p ICMP -j icmp_packets
$IPTABLES -A INPUT -p ALL -j tcp_packets
#$IPTABLES -A INPUT -p TCP -j allowed

$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -p udp -j udp_packets
$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets
$IPTABLES -A FORWARD -p TCP -m physdev --physdev-in $LAN_IFACE1 -j ACCEPT
$IPTABLES -A FORWARD -p TCP -m physdev --physdev-in $LAN_IFACE2 -j ACCEPT
$IPTABLES -A FORWARD -p udp -j ACCEPT
$IPTABLES -A FORWARD -p icmp -j icmp_packets

$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets
$IPTABLES -A OUTPUT -p udp -j udp_packets

ytmin

以上有什么问题吗?请说明一下.学习了.