linux iptable設定實踐

linux iptable設定實踐 下面是設定網路時的基本狀況： 主機3個網卡：           eth0 192.168.0.1/24   內網          eth1 192.168.20.1/24  外網           eth2 192.168.50.1/24  會議室網路           ppp0  （ 設定為 eth1 上撥接）DHCP設定：            192.168.0.1/24      { 192.168.0.100----192.168.0.200 }           192.168.50.1/24   {192.168.50.100---192.168.50.200 }  VPN設定：         localip:    192.168.10.1          remoteip:  192.168.10. 100    192.168.10.150 下面是firewall的具體設定： [root@yujiagw ~]# cat firewall #!/bin/shiptables -Fiptables -t nat -Fiptables -P FORWARD ACCEPTiptables -X poweruseriptables -X qquseriptables -X httpuser # NATiptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE#iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE iptables -t nat -A PREROUTING -p tcp --dport 53 -j ACCEPTiptables -t nat -A PREROUTING -p udp --dport 53 -j ACCEPTiptables -t nat -A PREROUTING -p tcp --dport 25 -j ACCEPTiptables -t nat -A PREROUTING -p tcp --dport 110 -j ACCEPT#iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 443#iptables -t nat -A PREROUTING -p udp --dport 443 -j REDIRECT --to-port 443  # Port Forwarding#iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 3389 -j DNAT --to 192.168.0.4:3389#iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 80 -j DNAT --to 192.168.0.4:80#iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 8080 -j DNAT --to 192.168.50.2:8080#iptables -A FORWARD -d 192.168.50.2 -p tcp --dport 8080 -j ACCEPT#iptables -t nat -A POSTROUTING -d 192.168.50.2 -p tcp --dport 8080 -j SNAT --to 192.168.0.1 # Basic Port Openiptables -A FORWARD -p tcp --dport 53 -j ACCEPTiptables -A FORWARD -p udp --dport 53 -j ACCEPTiptables -A FORWARD -p tcp --dport 25 -j ACCEPTiptables -A FORWARD -p tcp --dport 110 -j ACCEPT # VPNiptables -A FORWARD -s 192.168.10.0/24 -d 192.168.0.0/24 -j ACCEPTiptables -A FORWARD -s 192.168.0.0/24 -d 192.168.10.0/24 -j ACCEPT # Conference Roomiptables -A FORWARD -s 192.168.50.0/24 -d 192.168.0.0/24 -j ACCEPTiptables -A FORWARD -s 192.168.0.0/24 -d 192.168.50.0/24 -j ACCEPT  # Set Connect WANiptables -A FORWARD -d 192.168.50.0/24 -j ACCEPT # HeQuanXin#iptables -A FORWARD -m mac --mac-source 00:1A:6B:35:A5:66 -j ACCEPT#iptables -A FORWARD -m mac --mac-source 44:D8:84:0A:9F:5D -j ACCEPT #-----------------------------------PowerUser-------define------------------------iptables -N poweruseriptables -A poweruser  -j ACCEPT  #---------------------------------httpuser define-----------------# Set Http Useriptables -N httpuser iptables -A httpuser -p tcp --dport 53 -j ACCEPTiptables -A httpuser -p udp --dport 53 -j ACCEPT # Reject QQZoneiptables -A httpuser -d user.qzone.qq.com -j REJECT iptables -A httpuser -p tcp --dport 80 -j ACCEPTiptables -A httpuser -p udp --dport 80 -j ACCEPTiptables -A httpuser -p tcp --dport 25 -j ACCEPTiptables -A httpuser -p tcp --dport 110 -j ACCEPTiptables -A httpuser -p tcp --dport 443 -j ACCEPTiptables -A httpuser -p udp --dport 443 -j ACCEPT iptables -A httpuser -j DROP  #-----------------------------------User-------start------------------------# HeQuanXiniptables -A FORWARD -m mac --mac-source 00:1A:6B:35:A5:66 -j httpuser # xiangshudeiptables -A FORWARD -m mac --mac-source 00:E0:4C:41:49:C4 -j httpuser  # shiyayuniptables -A FORWARD -m mac --mac-source C8:9C:DC:D2:55:7A -j poweruser # chenmingxiangiptables -A FORWARD -m mac --mac-source 54:04:A6:58:A3:EE -j poweruser # wangxiaopingiptables -A FORWARD -m mac --mac-source 00:B0:C4:04:A1:7E -j httpuser # chengmeirongiptables -A FORWARD -m mac --mac-source 90:2B:34:2D:E6:5B -j httpuser # zhangyinboiptables -A FORWARD -m mac --mac-source 14:DA:E9:D2:3F:DF -j httpuser # luxiaoxiongiptables -A FORWARD -m mac --mac-source 90:2B:34:CB:31:EE -j httpuser  #-----------------------------------HTTPUser-------end--------------------------  #-----------------------------------------------------------------------------------# Block Xunleiiptables -A FORWARD -d 58.61.39.0/24 -j REJECTiptables -A FORWARD -d 121.9.209.6 -j REJECTiptables -A FORWARD -d 121.9.209.7 -j REJECTiptables -A FORWARD -d 121.9.209.3 -j REJECTiptables -A FORWARD -d 61.183.55.216 -j REJECTiptables -A FORWARD -d 61.183.55.218 -j REJECTiptables -A FORWARD -d 61.183.55.222 -j REJECTiptables -A FORWARD -d 220.172.191.36 -j REJECTiptables -A FORWARD -d 121.11.69.108 -j REJECTiptables -A FORWARD -d 125.91.8.77 -j REJECTiptables -A FORWARD -d 218.6.13.134 -j REJECTiptables -A FORWARD -d 219.133.48.0/24 -j REJECTiptables -A FORWARD -d 219.133.49.0/24 -j REJECTiptables -A FORWARD -d 219.129.83.0/24 -j REJECTiptables -A FORWARD -d 219.133.60.0/24 -j REJECTiptables -A FORWARD -d 210.21.118.141 -j REJECTiptables -A FORWARD -d 210.21.118.147 -j REJECTiptables -A FORWARD -d 210.21.118.149 -j REJECTiptables -A FORWARD -d 221.238.251.118 -j REJECTiptables -A FORWARD -d 221.238.252.127 -j REJECTiptables -A FORWARD -d 221.238.252.154 -j REJECTiptables -A FORWARD -d 221.238.252.155 -j REJECTiptables -A FORWARD -d 221.238.252.233 -j REJECTiptables -A FORWARD -d 221.238.253.246 -j REJECTiptables -A FORWARD -d 222.208.156.0/24 -j REJECTiptables -A FORWARD -d 203.110.168.233 -j REJECTiptables -A FORWARD -d 208.115.244.194 -j REJECTiptables -A FORWARD -d 65.19.183.185 -j REJECT #Block BTiptables -A FORWARD -p tcp --dport 6880:6881 -j REJECTiptables -A FORWARD -p udp --dport 6880:6881 -j REJECT # Invalid connect dropiptables -A FORWARD -m state --state INVALID -j DROP # Accept the already establised connectioniptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT # Set the FORWARD chain to DENYiptables -P FORWARD DROP