- 论坛徽章:
- 0
|
[root@test ~]# more /etc/init.d/firewall
#!/bin/bash
#Our complete stateful firewall script. This firewall can be customized for
#a laptop, workstation, router or even a server. 
#change this to the name of the interface that provides your "uplink"
#(connection to the Internet)
UPLINK="eth1"
#if you're a router (and thus should forward IP packets between interfaces),
#you want ROUTER="yes"; otherwise, ROUTER="no"
ROUTER="yes"
#change this next line to the static IP of your uplink interface for static SNAT, or
#"dynamic" if you have a dynamic IP. If you don't need any NAT, set NAT to "" to
#disable it.
NAT="124.42.78.10"
#change this next line so it lists all your network interfaces, including lo
INTERFACES="lo eth1 eth0"
#change this line so that it lists the assigned numbers or symbolic names (from
#/etc/services) of all the services that you'd like to provide to the general
#public. If you don't want any services enabled, set it to ""
SERVICES="http ftp smtp ssh rsync"
if [ "$1" = "start" ]
then
/bin/echo "Starting firewall..."
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
/sbin/iptables -P INPUT DROP
/sbin/iptables -A INPUT -i ! ${UPLINK} -j ACCEPT
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -p icmp -j ACCEPT
/sbin/iptables -A INPUT -p udp --dport 161 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 8001 -m state --state NEW -j ACCEPT
for x in ${SERVICES}
do
/sbin/iptables -A INPUT -p tcp --dport ${x} -m state --state NEW -j ACCEPT
done
if [ "$ROUTER" = "yes" ]
then
/bin/echo 1 > /proc/sys/net/ipv4/ip_forward
if [ "$NAT" = "dynamic" ]
then
/bin/echo "Enabling masquerading (dynamic ip)..."
/sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
elif [ "$NAT" != "" ]
then
/bin/echo "Enabling SNAT (static ip)..."
/sbin/iptables -t nat -A POSTROUTING -s 192.168.5.0/24 -o eth1 -j SNAT --to-source 224.42.78.10
fi
fi
/sbin/iptables -A FORWARD -m ipp2p --ipp2p --xunlei -j DROP
elif [ "$1" = "stop" ]
then
/bin/echo "Stopping firewall..."
/sbin/iptables -F INPUT
/sbin/iptables -F FORWARD
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT
#turn off NAT/masquerading, if any
/sbin/iptables -t nat -F
fi
机器双网卡
[root@test ~]# ifconfig -a
eth0 Link encap:Ethernet HWaddr 00:11:09 6:46:87
inet addr:192.168.5.154 Bcast:192.168.5.255 Mask:255.255.255.0
inet6 addr: fe80::211:9ff:fed6:4687/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:428865 errors:0 dropped:0 overruns:0 frame:0
TX packets:353183 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:62704145 (59.7 MiB) TX bytes:269769907 (257.2 MiB)
Interrupt:177 Base address:0x6800
eth1 Link encap:Ethernet HWaddr 00:0A:EB:9B:2E:7E
inet addr:224.42.78.10 Bcast:124.42.78.63 Mask:255.255.255.192
inet6 addr: fe80::20a:ebff:fe9b:2e7e/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:566543 errors:0 dropped:0 overruns:0 frame:0
TX packets:268869 errors:0 dropped:0 overruns:3 carrier:0
collisions:0 txqueuelen:1000
RX bytes:342661377 (326.7 MiB) TX bytes:52307635 (49.8 MiB)
Interrupt:169 Base address:0xe800
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:4 errors:0 dropped:0 overruns:0 frame:0
TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:200 (200.0 b) TX bytes:200 (200.0 b)
sit0 Link encap:IPv6-in-IPv4
NOARP MTU:1480 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
[root@test ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
224.42.78.0 0.0.0.0 255.255.255.192 U 0 0 0 eth1
192.168.5.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth1
0.0.0.0 224.42.78.1 0.0.0.0 UG 0 0 0 eth1 |
|
免费注册
楼主: ShadowStar
发表于 2007-12-14 10:34
