- 论坛徽章:
- 0
|
原帖由 ShadowStar 于 2007-12-14 21:16 发表 ![]()
从你162和166楼的状况来看，应该是没有限制住。
请你列出完整的iptables规则表，以及iptables的版本，内核的版本。
iptables的版本 iptables v1.2.11
内核版本
[root@test ~]# uname -a
Linux test 2.6.9-42.EL #1 Wed Jul 12 23:16:43 EDT 2006 i686 athlon i386 GNU/Linux
完整的iptables规则表
[root@test ~]# more /etc/init.d/firewall
#!/bin/bash
#Our complete stateful firewall script. This firewall can be customized for
#a laptop, workstation, router or even a server.
#change this to the name of the interface that provides your "uplink"
#(connection to the Internet)
UPLINK="eth1"
#if you're a router (and thus should forward IP packets between interfaces),
#you want ROUTER="yes"; otherwise, ROUTER="no"
ROUTER="yes"
#change this next line to the static IP of your uplink interface for static SNAT, or
#"dynamic" if you have a dynamic IP. If you don't need any NAT, set NAT to "" to
#disable it.
NAT="224.42.78.10"
#change this next line so it lists all your network interfaces, including lo
INTERFACES="lo eth1 eth0"
#change this line so that it lists the assigned numbers or symbolic names (from
#/etc/services) of all the services that you'd like to provide to the general
#public. If you don't want any services enabled, set it to ""
SERVICES="http ftp smtp ssh rsync"
if [ "$1" = "start" ]
then
/bin/echo "Starting firewall..."
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
/sbin/iptables -P INPUT DROP
/sbin/iptables -A INPUT -i ! ${UPLINK} -j ACCEPT
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -p icmp -j ACCEPT
/sbin/iptables -A INPUT -p udp --dport 161 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 8001 -m state --state NEW -j ACCEPT
for x in ${SERVICES}
do
/sbin/iptables -A INPUT -p tcp --dport ${x} -m state --state NEW -j ACCEPT
done
if [ "$ROUTER" = "yes" ]
then
/bin/echo 1 > /proc/sys/net/ipv4/ip_forward
if [ "$NAT" = "dynamic" ]
then
/bin/echo "Enabling masquerading (dynamic ip)..."
/sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
elif [ "$NAT" != "" ]
then
/bin/echo "Enabling SNAT (static ip)..."
/sbin/iptables -t nat -A POSTROUTING -s 192.168.5.0/24 -o eth1 -j SNAT --to-source 224.42.78.10
fi
fi
/sbin/iptables -A FORWARD -m ipp2p --ipp2p --xunlei -j DROP
elif [ "$1" = "stop" ]
then
/bin/echo "Stopping firewall..."
/sbin/iptables -F INPUT
/sbin/iptables -F FORWARD
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT
#turn off NAT/masquerading, if any
/sbin/iptables -t nat -F
fi
[ 本帖最后由 shined_zhang 于 2007-12-14 23:04 编辑 ] |
|
免费注册
楼主: ShadowStar
发表于 2007-12-14 15:04
发表于 2007-12-15 16:16