snat-firewall大家看看有没有问题！！！！！！！！

shenmiren

#!/bin/bash
#
echo "1" >; /proc/sys/net/ipv4/ip_forward
#
INET_IFACE="eth0"
INET_IP="218.62.26.138"
LAN_IFACE="eth1"
LAN_IP="192.168.0.1"
LAN_IP_RANGE="192.168.0.0/24"
IPT="/sbin/iptables"
#
WWW_IP_RANGE="192.168.0.199"
FTP_IP="192.168.0.199"
#PCAW_IP=""
HTTP="80"
HTTPS="443"
FTP="21"
FTP_DATA="20"

/sbin/depmod -a
/sbin/modprobe ip_tables
/sbin/modprobe iptable_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ipt_LOG
#
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
for TABLE in filter nat mangle ; do
$IPT -t $TABLE -F
$IPT -t $TABLE -X
done
#
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
for DNS in $(grep ^n /etc/resolv.conf|awk '{print $2}'); do
$IPT -A INPUT -p udp -s $DNS --sport domain -j ACCEPT
done
#
$IPT -A INPUT -p tcp --sport $HTTP -j ACCEPT
$IPT -A INPUT -p tcp --sport $HTTPS -j ACCEPT
$IPT -A INPUT -p tcp --sport $FTP -j ACCEPT
#
$IPT -N LOGDENY
$IPT -A LOGDENY -j LOG --log-prefix "iptables:"
$IPT -A LOGDENY -j DROP
$IPT -A INPUT -i ! lo -m state --state NEW,INVALID -j LOGDENY
#
if [ "$INET_IFACE" = ppp0 ] ; then
$IPT -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE
else
$IPT -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to $INET_IP
fi
#
$IPT -t nat -A PREROUTING -p tcp -d $INET_IP --dport $HTTP \
-j DNAT --to $WWW_IP_RANGEHTTP
$IPT -t nat -A PREROUTING -p tcp -d $INET_IP --dport $HTTPS \
-j DNAT --to $WWW_IP_RANGEHTTPS
$IPT -t nat -A PREROUTING -p tcp -d $INET_IP --dport $FTP \
-j DNAT --to $FTP_IPFTP
#