- 论坛徽章:
- 0
|
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
#/sbin/ifconfig eth0:0 192.168.10.50
#/sbin/ifconfig eth1:1 192.168.100.2
su squid -c "/usr/local/squid/sbin/squid -s"
/usr/local/apache2/bin/apachectl -k start
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
iptables -F
iptables -X
iptables -F -t nat
iptables -X -t nat
iptables -F -t mangle
iptables -X -t mangle
iptables -P FORWARD DROP
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
#dns
iptables -A FORWARD -p udp --dport 53 -j ACCEPT
#ftp,telnet
iptables -t nat -A PREROUTING -d 202.96.186.240 -p tcp --dport 21 -j DNAT --to 192.168.100.4
iptables -A FORWARD -o eth0 -d 192.168.100.4 -p tcp --dport 21 -j ACCEPT
iptables -A FORWARD -i eth0 -s 192.168.100.4 -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -s 192.168.100.4 -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -o eth0 -d 192.168.100.4 -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
iptables -t nat -A PREROUTING -d 202.96.186.240 -p tcp --dport 23 -j DNAT --to 192.168.100.4
iptables -A FORWARD -o eth0 -d 192.168.100.4 -p tcp --dport 23 -j ACCEPT
iptables -A FORWARD -i eth0 -s 192.168.100.4 -p tcp --sport 23 -m state --state ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -d 192.168.100.4 -p tcp --dport 23 -j SNAT --to 192.168.100.1
iptables -t nat -A POSTROUTING -d 192.168.100.4 -p tcp --dport 21 -j SNAT --to 192.168.100.1
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A POSTROUTING -t nat -s 192.168.100.0/24 -j MASQUERADE
iptables -A PREROUTING -t nat -p tcp -s 192.168.100.0/24 -d 202.96.186.240 --dport 80 -j REDIRECT --to-ports 3128
#FIRE
#iptables -I FORWARD -m string --string "???繞" -j DROP
#iptables -I FORWARD -s 192.168.100.0/24 -m string --string "qq.com" -j DROP
#iptables -I FORWARD -d 192.168.100.0/24 -m string --string "聶穩?繕?簞?繙" -#iptables -I FORWARD -s 192.168.100.0/24 -m string --string "?竄?矇" -j DROP
#iptables -I FORWARD -p tcp --sport 80 -m string --string "繒瓊繡疆" -j DROP
#iptables -I FORWARD -s 192.168.100.0/24 -p tcp --dport 80 -j DROP -m comment --comment "the bad guy can not online"
#iptables -I FORWARD -s 192.168.100.0/24 -m string --string "qq.com" -j DROP -m comment --comment "denny go to qq.com"
#iptables -I FORWARD -p tcp --syn --dport 80 -m connlimit --connlimit-above 10 --connlimit-mask 24 -j DROP
#iptables -A INPUT -s 192.186.100.0/24 -p tcp --syn -m connlimit --connlimit-above 15 -j DROP
iptables -A INPUT -s 192.186.100.0/24 -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
#MAIL
iptables -A FORWARD -s 192.168.100.0/24 -p udp -m multiport --dport 53,1800,1810,8000,8080 -j ACCEPT
iptables -A FORWARD -p tcp -s 192.168.100.0/24 -m multiport --dport 110,25 -j ACCEPT
#SUPUSER
iptables -I FORWARD -m iprange --src-range 192.168.100.2-192.168.100.50 -j ACCEPT
#MSNUSER
iptables -I FORWARD -p tcp -m iprange --src-range 192.168.100.103-192.168.100.119 -m multiport --dport 443,80,8081,3389 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.60 -m multiport --dport 443,80 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.221 -m multiport --dport 443,80 -j ACCEPT
iptables -I FORWARD -p TCP -s 192.168.100.220 -m multiport --dport 443,80 -j ACCEPT
#USER
iptables -I FORWARD -p tcp -m iprange --src-range 192.168.100.61-192.168.100.70 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.67 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.70 --dport 4000 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.65 -j DROP
iptables -I FORWARD -p tcp -s 192.168.100.66 -j DROP
iptables -I FORWARD -p tcp -s 192.168.100.68 -j DROP
iptables -I FORWARD -p tcp -s 192.168.100.151 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.156 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.157 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.159 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.163 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.164 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.170 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.173 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.158 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.181 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.188 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.212 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.214 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.211 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.100.215 --dport 80 -j ACCEPT
#CWUSER
iptables -I FORWARD -p tcp -m iprange --src-range 192.168.100.71-192.168.100.79 -m multiport --dport 80,8080,7002,7001,443,3333 -j ACCEPT
以上,我设在开机启动执行rc.local,像以上这种写法是不是每次开机执行的效果都不一样??这一句iptables -A PREROUTING -t nat -p tcp -s 192.168.100.0/24 -d 202.96.186.240 --dport 80 -j REDIRECT --to-ports 3128,我发现没有转发到squid去处理,然后我去掉-d 202.96.186.240 ,透明代理正常.现在有点糊涂了,请指出应该怎样改. |
|