About the transparent mode of iptables firewall

/* In general, the two network interfaces of the firewall should belong to two different networks. data packets are forwarded or rejected or discarded between the two interfaces according to the access rules defined by the system administrator. In fact, the firewall is not only an access control function, but also acts as a router. Of course, this is not anything inappropriate, but when you attempt /*
Generally, the two network interfaces of the firewall should belong to two different networks. according to the access rules defined by the system administrator, the two interfaces should forward data packets or reject or discard data packets. In fact, the firewall is not only an access control function, but also acts as a router. Of course, this is not anything inappropriate, but when you try to put the configured firewall into the running network to protect the security of the existing system, you have to rethink and change your network architecture. Another possible problem is that, in the event of a firewall accident, if there is no firewall hardware backup, you will be facing a huge psychological pressure, because of the firewall failure, the entire network is paralyzed. If you set the firewall to a transparent mode (which can be called a pseudo-Bridge), you do not need to change the network architecture. even if the firewall cannot work, you only need to remove the network cable, directly inserting the network cable into the internal interface of the router can make the network work normally, and then you have time to slowly recover the Faulty firewall.
To achieve efficient firewall and network detection, the system CPU must be powerful and fast enough. The system requires three NICs, two of which support the implementation of the bridge, and the other is used to manage the firewall. (At least two NICs can be configured on the bridging device ).
*/
#! /Bin/bash
# BY kerryhu
# QQ: 263205768
# MAIL: king_819@163.com
# BLOG: http://kerry.blog.51cto.com
# To enable Linux to implement the bridge function, in addition to compiling the kernel supporting the bridge (802.1d Ethernet Bridging), the application software is also required. this software is bridge-utils.
Cd/opt
Wget http://ncu.dl.sourceforge.net/project/bridge/bridge/bridge-utils-1.4/bridge-utils-1.4.tar.gz
Tar zxvf bridge-utils-1.4.tar.gz
Cd bridge-utils-1.4
./Configure -- prefix =/usr
Make; make install # brctl help for this command
#1. create a bridge device:
Brctl addbr br0
#2. add the network adapter eth0 and eth1 to br0
Brctl addif eth0
Brctl addif eth1
#3. delete eth0 and eth1 from the Net Bridge
Brctl delif eth0
Brctl delif eth1
#4. delete Bridge br0
Brctl delbr br0
# Gateway:
172.16.16.254
# Web Server (80, 443)
172.16.16.172
# Ftp server (21, 20)
172.16.16.173
# MySQL servers (3306)
172.16.16.174
# Configure the bridge interface
Ifconfig br0 172.16.16.171 netmask 255.255.255.0 broadcast172.16.16.255
# Configuring firewall policies
# Create the interface br0
/Usr/sbin/brctl addbr br0
# Add the Ethernet interface to use with the bridge
/Usr/sbin/brctl addif br0 eth0
/Usr/sbin/brctl addif br0 eth1
# Start up the Ethernet interface
/Sbin/ifconfig eth0 0.0.0.0
/Sbin/ifconfig eth1 0.0.0.0
# Configure the bridge ethernet
/Sbin/ifconfig br0 172.16.16.171 netmask 255.255.252.0 broadcast172.16.16.255
# I have added this internal IP to create my NAT
# Ip addr add 192.168.0.1/24 dev br0
/Sbin/route add default gw 172.16.16.254
Iptables-F FORWARD
Iptables-P FORWARD DROP
Iptables-a forward-s 0.0.0.0/0.0.0.0-d 0.0.0.0/0.0.0.0-m state -- state INVALID-j DROP
Iptables-a forward-m state -- state ESTABLISHED, RELATED-jACCEPT
# Limit ICMP
Iptables-a forward-p icmp-m limit -- limit 4/s-j ACCEPT
# Match string, a good simple method to block some VIRUS veryquickly
# Iptables-I FORWARD-j DROP-p tcp-s 0.0.0.0/0-m string -- string "cmd.exe"
# Allow the 222.11.22.33 connection MySQL server
Iptables-a forward-p tcp-s 222.11.22.33-d 172.16.16.174 -- dport3306-j ACCEPT
# Allow HTTP (80) connections with the WWW server
Iptables-a forward-p tcp-s 0.0.0.0/0-d 172.16.16.172 -- dport 80-j ACCEPT
# Allow HTTPS (443) connections with the WWW server
Iptables-a forward-p tcp-s 0.0.0.0/0-d 172.16.16.172 -- dport443-j ACCEPT
# Allow the WWW server to go out
Iptables-a forward-s 172.16.16.172-d 0/0-j ACCEPT
# Ftp Server Rules
Iptables-a forward-p tcp-s 0/0-d 172.16.16.173 -- dport 21-jACCEPT
Iptables-a forward-p tcp-s 0/0-d 172.16.16.173 -- dport 20-jACCEPT
# Allow the NTP server to go out
Iptables-a forward-s 172.16.16.173-d 0/0-j ACCEPT
# For kernel 2.6, the 2.6 kernel has been labeled with bridge-nf by default. I have passed the test on 2.6.12. any release that uses the 2.6 kernel should support bridge-nf.