Proxy Server and Firewall Based on Soft Linux (1)

Article Title: proxy server and Firewall Based on Soft Linux (1 ). Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
Author: Li Yu
　　
#! /Bin/bash
# Proxy and firwall
# Defining variables
EXT_IFACE = eth0
EXT_ADDR = 192.9.100.8
INT_IFACE = eth1
INT_ADDR = 192.168.0.0/24
Manager_Addr = 192.168.0.3/32
　　　　
# Initialization settings
Service iptables stop
Iptables-F
Iptables-t nat-F
Iptables-X
Iptables-t nat-X
Iptables-Z
Iptables-t nat-Z
　　　　
Iptables-P INPUT DROP
Iptables-P OUTPUT DROP
Iptables-P FORWARD DROP
Iptables-t nat-P POSTROUTING DROP
　　
# Startup Module
Cd/lib/modules/2.4.3-3/kernel/net/ipv4/netfilter
Modprobe ip_conntrack_ftp
Modprobe ip_nat_ftp
Cd/
　　
# Set core parameters
　　
# Avoid ping of death attacks
Echo 1>/proc/sys/net/ipv4/icmp_echo_ignore_all
# Prohibit broadcast response (optional)
# Echo 1>/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Prevent source route attacks
Echo 0>/proc/sys/net/ipv4/conf/all/accept_source_route
# Icmp data packets that do not accept redirection
# Echo 0>/proc/sys/net/ipv4/conf/all/accept_redirects
# Prevent IP Spoofing
For interface in/proc/sys/net/ipv4/conf/*/rp_filter; do
/Bin/echo 1 >$ {interface}
Done
# Disable IP Forwarding (we recommend that you disable the packet forwarding function when configuring the firewall)
Echo 0>/proc/sys/net/ipv4/ip_forward
# IP camouflage
Iptables-t nat-a postrouting-s $ INT_ADDR-o $ EXT_IFACE-j MASQUERADE
# Define forward chain rules
Iptables-a forward-m state -- state INVALID-j DROP
Iptables-a forward-I $ INT_IFACE-o $ EXT_IFACE-s $ INT_ADDR-m state -- state
RELATED, NEW, ESTABLISHED-j ACCEPT
# Iptables-a forward-I $ INT_IFACE-s 192.168.0.3/32-m mac -- mac-source
00: D0: 59: 08: 5f: 23-o $ EXT_IFACE-j ACCEPT (you can use this method to bind an IP address to a physical address)
Iptables-a forward-I $ EXT_IFACE-o $ INT_IFACE-d $ INT_ADDR-m state -- state
RELATED, ESTABLISHED-j ACCEPT
# Restrictions on packet fragmentation (will affect the proxy server performance)
# Iptables-a forward-f-m limit -- limit 100/s -- limit-burst 100-j ACCEPT
# Restrict external access to this firewall
Iptables-a input-I $ EXT_IFACE-m state -- state ESTABLISHED, RELATED-j ACCEPT
Iptables-a input-I $ EXT_IFACE-p tcp! -- Syn-j ACCEPT
# Restrictions on internal user access to the firewall
Iptables-a input-I $ INT_IFACE-p icmp-j DROP # (other protocols can be restricted)
#...........
# Allow the Administrator to perform operations on the firewall
Iptables-a input-s $ Manager_Addr-I $ INT_IFACE-p tcp -- dport 3000-j ACCEPT
Iptables-a input-s $ Manager_Addr-I $ INT_IFACE-p tcp -- dport 22-j ACCEPT
Iptables-a output-d $ Manager_Addr-o $ INT_IFACE-m state -- state ESTABLISHED
-J ACCEPT
# Data packets allowed to be sent (from gateway)
Iptables-a output-o $ EXT_IFACE-j ACCEPT
　　
# Allow IP packet forwarding
Echo 1>/proc/sys/net/ipv4/ip_forward