Iptables instance Miscellaneous (port closed or forwarding, IP, Mac)

#/Sbin/modprobe iptable_filter
#/Sbin/modprobe ip_tables
#/Sbin/modprobe iptable_nat
#/Sbin/iptables-F-T Nat
ADSL dial-up forwarding
/Sbin/iptables-T Nat-A postrouting-s 172.16.0.0/24-O ppp0-J Masquerade
 
Nic forwarding
/Sbin/iptables-T Nat-A postrouting-s 172.16.0.0/24-O eth0-J Masquerade
 
Block tcp udp ports and open specific ports (including VPN forwarding and incoming ports)
/Sbin/iptables-I input-P TCP-s 172.16.0.0/24-M multiport -- dports 8383,139,172, 3-J accept
/Sbin/iptables-A input-p tcp-s 172.16.0.0/24 -- dport 5432-J accept
/Sbin/iptables-A input-p udp-s 172.16.0.0/24-M multiport -- dports 53,111-J accept
/Sbin/iptables-A input-P gre-s 172.16.0.0/24-J accept
#/Sbin/iptables-A input-M state -- State established, related-J accept
/Sbin/iptables-A input-s 172.16.0.0/24-p tcp-M state -- State established, related-J accept

/Sbin/iptables-a forward-p tcp-s 172.16.0.0/24-M multiport -- dports 80,110, 225, 1723,22, 5252,10101, 3306,443,543 8383,-J accept
/Sbin/iptables-a forward-p udp-s 172.16.0.0/24 -- dport 53-J accept
/Sbin/iptables-a forward-p udp-s 172.16.0.0/24 -- dport 8000-J accept
A game Port
#/Sbin/iptables-a forward-p udp-s 172.16.0.0/24 -- dport 7000-J accept
Protocols required for VPN
/Sbin/iptables-a forward-P gre-s 172.16.0.0/24-J accept
Run Ping
/Sbin/iptables-a forward-p icmp-s 172.16.0.0/24-J accept
 
# Add this sentence. Only ICMP response, FTP transmission, and DCC can work normally through the firewall. Most of the other UDP protocols depend on this mechanism. If you do not open the firewall, BT users will not be abnormal, and the btsoftware will not be able to penetrate the firewall. You need to enable it again during ftp. The limit is only to allow TCP packets to penetrate the firewall.
#/Sbin/iptables-a forward-M state -- state new, established, related-J accept

/Sbin/iptables-a forward-s 172.16.0.0/24-p tcp-M state -- state new, established, related-J accept
 
# Block all TCP and UDP ports (other methods should be available)
/Sbin/iptables-a forward-p tcp-s 172.16.0.0/24 -- dport 0: 65535-J Drop
/Sbin/iptables-a forward-p udp-s 172.16.0.0/24 -- dport 0: 65535-J Drop
/Sbin/iptables-A input-p tcp-s 172.16.0.0/24 -- dport 0: 65535-J Drop
/Sbin/iptables-A input-p udp-s 172.16.0.0/24 -- dport 0: 65535-J Drop
 
# My IP address is not restricted by rules
/Sbin/iptables-I input-s 172.16.0.108-J accept
/Sbin/iptables-I forward-s 172.16.0.108-J accept
 
# Iptables-l
Chain input (Policy accept)
Target prot opt source destination
Accept all -- 172.16.0.108 anywhere
Accept TCP -- 172.16.0.0/24 anywhere multiport dports POP3, HTTP, SMTP, ssh, https, ipvs, MySQL, FTP, Microsoft-ds, 10101,5252, webcache, 8383, NetBIOS-SSN, 1723
Accept TCP -- 172.16.0.0/24 anywhere state related, established
Accept TCP -- 172.16.0.0/24 anywhere tcp dpt: ipvs
Accept UDP -- 172.16.0.0/24 anywhere multiport dports domain, SunRPC
Accept gre -- 172.16.0.0/24 anywhere
Drop TCP -- 172.16.0.0/24 anywhere TCP
Drop UDP -- 172.16.0.0/24 anywhere UDP
 
Chain forward (Policy accept)
Target prot opt source destination
Accept all -- anywhere Anywhere state new, related, established
Accept all -- 172.16.0.108 anywhere
Accept TCP -- 172.16.0.0/24 anywhere multiport dports HTTP, POP3, FTP, SMTP, 1723, ssh, 5252,10101, MySQL, https, ipvs, webcache, sieve, 1935,8383
Accept UDP -- 172.16.0.0/24 anywhere udp dpt: domain
Accept UDP -- 172.16.0.0/24 anywhere udp dpt: 8000
Accept UDP -- 172.16.0.0/24 anywhere udp dpt: afs3-fileserver
Accept gre -- 172.16.0.0/24 anywhere
Accept ICMP -- 172.16.0.0/24 anywhere
Drop TCP -- 172.16.0.0/24 anywhere TCP
Drop UDP -- 172.16.0.0/24 anywhere UDP
 
Chain output (Policy accept)
Target prot opt source destination



========================================================== ====================
IP address
/Sbin/iptables-a forward-s 172.16.0. ***-J Drop
Disable IP address Blocking
/Sbin/iptables-D forward-s 172.16.0. ***-J Drop
========================================================== ====================
Route port forwarding. The donkey is a high-ID user, but it does not seem to work after the test.
/Sbin/iptables-T Nat-A prerouting-p udp-m udp -- dport 19145-j dnat -- to-destination 172.16.0.108: 19145
/Sbin/iptables-T Nat-A postrouting-s 172.16.0.0/16-D 172.16.0.108-p udp-m udp -- dport 19145-j snat -- to-source 172.16.0.2
 
/Sbin/iptables-T Nat-A prerouting-p tcp-m tcp -- dport 19145-j dnat -- to-destination 172.16.0.108: 19145
/Sbin/iptables-T Nat-A postrouting-s 172.16.0.0/16-D 172.16.0.108-p tcp-m tcp -- dport 19145-j snat -- to-source 172.16.0.2
 
#/Sbin/iptables-T Nat-A prerouting-p udp-m udp -- dport 4662-j dnat -- to-destination 172.16.0.108: 4662
#/Sbin/iptables-T Nat-A postrouting-s 172.16.0.0/16-D 172.16.0.108-p udp-m udp -- dport 4662-j snat -- to-source 172.16.0.2
 
#/Sbin/iptables-T Nat-A prerouting-p tcp-m tcp -- dport 4662-j dnat -- to-destination 172.16.0.108: 4662
#/Sbin/iptables-T Nat-A postrouting-s 172.16.0.0/16-D 172.16.0.108-p tcp-m tcp -- dport 4662-j snat -- to-source 172.16.0.2
========================================================== ==================================
###### Access through a MAC address
###### Sequence
 
#/Sbin/iptables-a forward-M Mac -- Mac-source 00: 00: BA: A5: 7d: 12-p tcp-M multiport -- dports 80,110, 225, 1723,22, 5252,10101, 3306,443,543 8383,-J accept
 
#/Sbin/iptables-a forward-M Mac -- Mac-source 00: 00: BA: A5: 7d: 12-p udp -- dport 53-J accept
 
#/Sbin/iptables-a forward-p icmp-J accept
 
###### Keep this line at the end. Use iptables-L to view it.
 
#/Sbin/iptables-a forward-M Mac -- Mac-source 00: 00: BA: A5: 7d: 12-J Drop