原創 iptables +squid 代理

#/bin/sh
 iptables -F
 iptables -X
 iptables -t nat -F
 iptables -t nat -X
 
 echo "1">/proc/sys/net/ipv4/ip_forward

 arp -s 192.168.0.4 00:E0:4C:83:76:E8
 arp -s 192.168.0.7 00:E0:4C:EA:42:A9

 iptables -t nat -A POSTROUTING -s 192.168.0.0/28 -o ppp0 -j MASQUERADE
 iptables -t nat -A POSTROUTING -s 192.168.0.0/28 -o tun0 -j SNAT --to-source 220.172.239.53
 iptables -A FORWARD -s 192.168.0.2 -j ACCEPT
 iptables -A FORWARD -s 192.168.0.4 -m mac --mac-source 00:E0:4C:83:76:E8 -j ACCEPT
 iptables -A FORWARD -s 192.168.0.7 -m mac --mac-source 00:E0:4C:EA:42:A9 -j ACCEPT
 iptables -A FORWARD -s 192.168.0.12 -j ACCEPT
 iptables -A FORWARD -s 192.168.0.0/28 -j DROP

# 三
 iptables -t nat -A POSTROUTING  -s 192.168.2.0/25  -j MASQUERADE
 iptables -A FORWARD -s 192.168.2.2 -j ACCEPT
 iptables -A FORWARD -s 192.168.2.0/25 -p tcp --dport ! 80 -j DROP
 iptables -A FORWARD -s 192.168.2.0/25 -p udp --dport 0: -j DROP

# 一
 iptables -t nat -A POSTROUTING -s 192.168.1.0/25 -o ppp0 -j MASQUERADE
 iptables -A FORWARD -s 192.168.1.2  -j ACCEPT
 iptables -A FORWARD -s 192.168.1.0/25 -p tcp --dport ! 80 -j DROP
 iptables -A FORWARD -s 192.168.1.0/25 -p udp --dport ! 53 -j DROP

 iptables -t nat -A PREROUTING -s 192.168.1.0/25 -i eth0 -p tcp  --dport 80 -j REDIRECT --to-ports 3128
 iptables -t nat -A PREROUTING -s 192.168.2.0/25 -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128