- 论坛徽章:
- 0
|
以下脚本内容是我自己做实验时候的脚本，有两个top图，第一个是真实top，而第二个是试验时使用的虚拟机环境，有详细的描述怎样去搭建环境，希望给大家一些帮助！已经经过我的test了，没有问题。
请多提建议阿！呵呵！-
#!/bin/sh
#
# DESCRIPTION: This IPTABLES shell script is setting for IPTABLES LAB. So,
# it's sharing for everyone. And please contact me if you find
# any bugs in this script.
# VERSION: 2.1
# BUGS: Report bugs to ancharn@yahoo.com.cn
# SEE ALSO: iptables( (see manual page for details)
# AUTHOR: Eric Cheung, 12/10/2006.
#
# START OF SCRIPT
#
# SECTION I: TOP Map
# ------------------
# The REAL TOP MAP:
# The following top map is REALLY map.
# ######
# |-----> eth0 # #
# | ######
# | 192.168.3.180 (Web \
# | Server)
# WAN FireWall |
# ###### ###### | #######
# # # <---------------> eth0 # # eth1 <------- # DMZ #
# ###### ###### | #######
# 62.36.21.254 192.168.3.54 |
# | ######
# |-----> eth0 # #
# ######
# 192.168.3.153 (DNS \
# Server)
#
# ------------------
# The LAB TOP MAP:
# The following top map is LAB map (make by above top) for us to practice.
#
# WAN FireWall LAN
# ###### ###### ######
# # Win# VMNet1<-------------->eth0 # # eth1<------------>eth0 # #
# ###### ###### ######
# 62.36.21.1 62.36.21.254 | 192.168.3.54 192.168.3.180(153)
#
# Description: The FireWall and LAN hosts are Linux OS, and WAN host is \
# Windows host, the FireWall's NICs eth0 and eth1 and LAN's NIC \
# eth0 connect to Windows NIC VMNet1. Windows host's default \
# route is 62.36.21.254, and FireWall's default gateway is \
# 62.36.21.1, the LAN host's default gateway is 192.168.3.54. \
# The LAN host is WEB server/FTP server/DNS server.
#
#
# SECTION II: MODPROBE FILTER
# ---------------------------
#
echo ;echo "Starting iptables ...... ";echo
echo -n " Open ip_forward ...... "
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "Done."
echo -n " Set rp_filter ...... "
for f in /proc/sys/net/ipv4/conf/*/rp_filter
do
echo 1 > ＄f
done
echo "Done."
# -------------------------- MODPROBE ---------------------------- #
echo -n " Modprobe now ...... "
# set kernel version.
KERNELVERSION=`uname -r`
modprobe ` ( cd /lib/modules/＄KERNELVERSION/kernel/net/ipv4/netfilter ; ls ) | awk -F . '{print ＄1}' `
echo "Done."
#
# SECTION III: SETTING IPTABLES
# -----------------------------
echo " Setting iptables policies ...... "
echo -n " Flush iptables ...... "
echo "Done."
iptables -Z
iptables -Z -t nat
iptables -F
iptables -F -t nat
iptables -X
iptables -X -t nat
echo -n " Setting iptables default policies ...... "
iptables -P INPUT DROP
iptables -P FORWARD DROP
echo "Done."
# Phase 1: Set your server's firewall.
# the kernel's firewall settings.
#
# TCP Flooding's setting. This setting is NOT good for high-loading servers.
echo 1 >/proc/sys/net/ipv4/tcp_syncookies
#
# unset reply of ping.
echo "1" >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
#
# record some problems packets.
for i in /proc/sys/net/ipv4/conf/*/log_martians; do
echo "1" > ＄i
done
#
# unset the routing from source.
for i in /proc/sys/net/ipv4/conf/*/accept_source_route ; do
echo "0" > ＄i
done
#
# unset the setting of redirect routing.
for i in /proc/sys/net/ipv4/conf/*/accept_redirects ; do
echo "0" > ＄i
done
#
# unset send_redirect.
for i in /proc/sys/net/ipv4/conf/*/send_redirects; do
echo "0" > ＄i
done
#
# Phase 2: Other settings.
#
# set allow ping packet INPUT(OUTPUT) firewallself.
echo -n " Setting ping to firewallself ...... "
iptables -A INPUT -i eth+ -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 1 -j ACCEPT
iptables -A OUTPUT -o eth+ -p icmp --icmp-type echo-reply -m limit --limit 1/s --limit-burst 1 -j ACCEPT
echo "Done."
#
# set LAN can access Internet with 62.36.21.254 ip address from eth0 \
# interface.
echo -n " Setting SNAT: LAN to Internet ...... "
iptables -A POSTROUTING -t nat -s 192.168.3.0/24 -o eth0 -j SNAT --to 62.36.21.254
echo "Done."
#
# set DNS query for Internet and LAN.
echo -n " Setting DNAT: DNS query ...... "
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j DNAT --to 192.168.3.153
iptables -A FORWARD -i eth0 -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -i eth0 -p udp --sport 53 -j ACCEPT
iptables -A FORWARD -o eth0 -p udp --sport 53 -j ACCEPT
iptables -A FORWARD -o eth0 -p udp --dport 53 -j ACCEPT
echo "Done."
#
# Publish 192.168.3.180 machine (Web Server) to Internet.
echo -n " Setting DNAT: HTTP server ...... "
iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -A PREROUTING -t nat -i eth0 -d 62.36.21.254 -p tcp --dport 80 -j DNAT --to 192.168.3.180
iptables -A FORWARD -i eth0 -o eth1 -d 192.168.3.180 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -o eth0 -i eth1 -p tcp --sport 80 -s 192.168.3.180 -m state --state RELATED,ESTABLISHED -j ACCEPT
echo "Done."
#
# Publish 192.168.3.180 machine (FTP Server) to Internet.
echo -n " Setting DNAT: FTP server ...... "
iptables -A PREROUTING -t nat -d 62.36.21.254 -i eth0 -p tcp --dport 21 -j DNAT --to 192.168.3.180
iptables -A PREROUTING -t nat -d 62.36.21.254 -i eth0 -p tcp --dport 20 -j DNAT --to 192.168.3.180
iptables -A FORWARD -d 192.168.3.180 -p tcp --dport 21 -o eth1 -i eth0 -j ACCEPT
iptables -A FORWARD -s 192.168.3.180 -p tcp --sport 21 -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -s 192.168.3.180 -p tcp --sport 20 -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
iptables -A FORWARD -d 192.168.3.180 -p tcp --dport 20 -o eth1 -i eth0 -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
echo "Done."
#
# Phase 3: Additional settings.
echo -n " Setting additional settings ...... "
# syn flood
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
# port scan
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
# ping flood
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
# tcp fragment flood
iptables -A FORWARD -f -m limit --limit 100/s --limit-burst 100 -j ACCEPT
echo "Done."
echo; echo "End of iptables." ; echo
# END OF SCRIPT |
|
免费注册
发表于 2006-12-19 13:03